Topic starter
06/11/2026 6:34 pm
TL;DR: Some tier-one banks still cover only about 65% of privileged access, because mainframes, core platforms and vendor apps without APIs or SCIM remain outside IGA and PAM reach, so just-in-time access degrades into tickets and queues, according to Opnova. Zero standing privilege fails wherever governance cannot actually operate the application estate.
Editorial analysis by NHI Mgmt Group, based on content published by Opnova: “Zero Standing Privilege Is Here. It's Just Not Evenly Connected.”.
By the numbers:
- Some tier-one banks cover only 65% of privileged access, according to Opnova.
Key questions
Q: How do teams enforce zero standing privilege in disconnected applications?
A: Teams enforce zero standing privilege by removing persistent access from service accounts, API keys and admin accounts, then granting time-bound access only when a task requires it.
Q: Why does just-in-time access still fail in practice?
A: JIT fails when the process becomes broader or slower than the task it is meant to govern.
Q: What is the difference between Zero Standing Privilege and traditional PAM?
A: Zero Standing Privilege removes persistent administrative access and replaces it with on-demand privilege, while traditional PAM often focuses on controlling how credentials are checked out or stored.
Practitioner guidance
- Define enforceable coverage for privileged access Measure the share of privileged applications where access can be provisioned and revoked through the governance stack without manual admin work.
- Classify disconnected systems as unmanaged access paths Build a separate register for mainframes, core platforms, and vendor apps that lack APIs or SCIM, then assign explicit ownership for each access path.
- Test whether JIT still works when the app has no connector Walk one high-risk access request end to end and verify that approval, issuance, and revocation all complete without queue-based handoffs.
Bottom line: Disconnected applications are where zero standing privilege most often stops being a real control and becomes a policy statement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Coverage is the real zero standing privilege metric: A programme can only claim zero standing privilege where it can actually issue and remove access in the target application. If the application is disconnected, the policy outcome is still standing privilege, even if the governance dashboard looks complete. The practitioner implication is to measure enforceable coverage, not declared control coverage.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams prioritise legacy applications for access governance?
A: Security teams should prioritise legacy applications with shared accounts, manual provisioning, no central identity integration, weak logging and privileges that can reach sensitive systems. Those applications are hardest to govern because ownership is unclear, credentials often persist for years and access reviews are usually incomplete. Start with admin paths, service accounts and externally exposed interfaces.
👉 Read our full editorial: Disconnected apps keep zero standing privilege incomplete in banks