Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: 99% of users, roles, and services hold excessive standing permissions, while over 70% of threat activity flows through four admin protocols, making always-on privilege a lateral-movement problem as much as an access problem, according to Zero Networks. Zero standing privileges shifts the control model from persistent entitlement to time-bound access, but only if teams can map and govern every identity, including service accounts and AI agents.
NHIMG editorial — based on content published by Zero Networks: Zero Standing Privileges: What It Means, Why It Matters, and How to Implement It
By the numbers:
- More than 70% of threat activity flows through just four admin protocols.
- Machine and service identities now outnumber human identities 109:1.
- Only 2.6% of workload identity permissions are actually used.
Questions worth separating out
Q: How should security teams reduce standing privilege in NHI environments?
A: Start by identifying every non-human identity with persistent access, then classify which entitlements are truly required at all times.
Q: Why do standing privileges increase lateral movement risk so much?
A: Standing privileges give an attacker a ready-made route through the environment if a credential is stolen or misused.
Q: What do organisations get wrong about least privilege in access control?
A: Many teams treat least privilege as a provisioning rule instead of a living authorization outcome.
Practitioner guidance
- Map every standing privileged pathway Inventory human admins, service accounts, machine identities, and AI agents that can still open administrative routes without time-bound approval.
- Convert high-risk access to JIT windows Apply just-in-time access to interactive sessions, privileged ports, and critical services first.
- Measure privilege creep as a lifecycle failure Review whether access remains open longer than the task that justified it, especially for service accounts and delegated admin roles.
What's in the full article
Zero Networks' full post covers the operational detail this article intentionally leaves for the source:
- A step-by-step implementation approach for discovering privileged pathways across human, service, and AI identities.
- Specific guidance on where JIT access is practical and where legacy systems may require exceptions.
- The network-layer MFA and policy enforcement pattern used to close privileged internal routes.
- Practical examples of how deterministic identity-based policies are adapted over time.
👉 Read Zero Networks' post on zero standing privileges and implementation →
Zero standing privileges and JIT access: are your controls keeping up?
Explore further
24/07/2026 4:13 pm
Standing privilege is a scheduling failure as much as an access failure. ZSP matters because many IAM and PAM programmes still assume privilege can be safely left in place until a periodic review catches it. That assumption breaks in networks where attackers can move faster than review cycles, and where machine identities, admins, and service accounts all operate continuously. The practical conclusion is that time, not only scope, must become part of the access control model.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How do security teams know whether JIT access is actually reducing risk?
A: Look for shorter credential lifetime, fewer always-on permissions, and lower exposure of credentials in code, pipelines, and runtime environments. If the same identities remain broadly reachable or access still persists between tasks, JIT is only changing the workflow, not the risk model.
👉 Read our full editorial: Zero standing privileges is the new baseline for privileged access
