Topic starter
24/06/2026 11:24 pm
TL;DR: 91% of organisations still say at least half of privileged access is always on, while only 1% have fully implemented just-in-time privileged access and 45% apply the same controls to AI agents as to humans, according to CyberArk research. That combination turns privilege sprawl into a structural governance problem, not a tooling gap.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “New Study: Only 1% of Organizations Have Fully Adopted Just-in-Time Privileged Access as AI-Driven Identities Rapidly Increase”.
By the numbers:
- Only 1% have fully implemented a modern Just-in-Time privileged access model.
- 45% apply the same privileged access controls to AI agents as they do to human identities.
- 54% of organisations uncover unmanaged privileged accounts and secrets every week.
Key questions
Q: What breaks when privileged access is not continuously governed?
A: When privileged access is not continuously governed, standing privilege persists, dormant accounts remain usable, and the attack surface expands across human and machine identities.
Q: How do AI agents change privileged access governance?
A: AI agents separate delegated human authority from machine execution, so the access record must show both.
Q: How do security teams know if shadow privilege is getting worse?
A: Look for a growing gap between the identities you can explain and the privileges you can actually enumerate.
Practitioner guidance
- Define standing privilege as an exception state Map every privileged identity that can remain continuously active outside a named task, and require an explicit business reason for any exception.
- Build a unified privileged identity inventory Include human admins, service accounts, secrets, tokens, and AI-driven identities in one ownership and expiry register so reviewers can see the full privilege estate.
- Separate AI identity controls from human admin policy Set different approval, scope, and session assumptions for AI-driven identities instead of copying controls from human privileged access workflows.
Bottom line: Always-on privileged access is now colliding with AI-driven identity growth, turning privilege sprawl into a governance problem that PAM teams cannot solve with legacy assumptions alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:15 am
Shadow privilege is not a hygiene issue, it is a governance failure state. When organisations cannot explain why privileged access still exists, the problem is no longer just over-entitlement but a broken ownership model. That is why weekly discovery of unmanaged accounts and secrets should be read as a lifecycle signal, not an operational nuisance. The practitioner conclusion is that privileged access must be governed as a living inventory, not a static approvals file.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
Q: Should organisations prioritise just-in-time access over broad access reviews?
A: Yes, when the objective is to reduce active exposure rather than just document it. Access reviews tell you what exists, but just-in-time access changes how long privilege exists in the first place. For high-risk permissions, reducing standing access usually delivers faster risk reduction than another review cycle.
👉 Read our full editorial: AI-driven privileged access exposes the shadow privilege gap