Topic starter
24/06/2026 11:24 pm
TL;DR: Always-on privileged access still dominates, with 91% of organisations saying at least half is persistent and only 1% fully adopting just-in-time privileged access, according to CyberArk. Privilege governance now has to account for AI identities as well as human admins, or exposure keeps accumulating between reviews.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “New Study: Only 1% of Organizations Have Fully Adopted Just-in-Time Privileged Access as AI-Driven Identities Rapidly Increase”.
By the numbers:
- Only 1% have fully implemented a modern Just-in-Time privileged access model.
- 45% apply the same privileged access controls to AI agents as they do to human identities.
- 54% of organisations uncover unmanaged privileged accounts and secrets every week.
Key questions
Q: How do AI agents change privileged access governance?
A: AI agents separate delegated human authority from machine execution, so the access record must show both.
Q: How do security teams know if shadow privilege is getting worse?
A: Look for a growing gap between the identities you can explain and the privileges you can actually enumerate.
Q: What breaks when privileged access is not continuously governed?
A: When privileged access is not continuously governed, standing privilege persists, dormant accounts remain usable, and the attack surface expands across human and machine identities.
Practitioner guidance
- Define standing privilege as an exception state Map every privileged identity that can remain continuously active outside a named task, and require an explicit business reason for any exception.
- Build a unified privileged identity inventory Include human admins, service accounts, secrets, tokens, and AI-driven identities in one ownership and expiry register so reviewers can see the full privilege estate.
- Separate AI identity controls from human admin policy Set different approval, scope, and session assumptions for AI-driven identities instead of copying controls from human privileged access workflows.
Bottom line: Always-on privileged access is now colliding with AI-driven identity growth, turning privilege sprawl into a governance problem that PAM teams cannot solve with legacy assumptions alone.
Glossary terms: Shadow Privilege, Standing Privilege, Just-in-Time Privileged Access Management, Privileged Activity Review
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 8:15 am
Shadow privilege is not a hygiene issue, it is a governance failure state. When organisations cannot explain why privileged access still exists, the problem is no longer just over-entitlement but a broken ownership model. That is why weekly discovery of unmanaged accounts and secrets should be read as a lifecycle signal, not an operational nuisance. The practitioner conclusion is that privileged access must be governed as a living inventory, not a static approvals file.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
Q: Should organisations prioritise just-in-time access over broad access reviews?
A: Yes, when the objective is to reduce active exposure rather than just document it. Access reviews tell you what exists, but just-in-time access changes how long privilege exists in the first place. For high-risk permissions, reducing standing access usually delivers faster risk reduction than another review cycle.
👉 Read our full editorial: AI-driven privileged access exposes the shadow privilege gap