Topic starter
24/06/2026 11:34 pm
TL;DR: Emergency privileged access can bypass MFA, approvals, and standard workflows during outages and P0 incidents, according to SecurEnds. Break-glass access needs expiry, logging, and review to stay attributable after the incident.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Break-Glass Access Explained: Risks, Controls, and IGA Best Practices”.
Key questions
Q: When should organisations prioritise JIT access over break-glass accounts?
A: Organisations should prioritise just-in-time access when the work is urgent but predictable, because JIT gives temporary privilege with a clearer end state.
Q: How do you know whether emergency access is actually working?
A: Emergency access is working only if every activation is visible, time-bounded, and reviewed after the event.
Q: What breaks when break-glass access is not tightly governed?
A: Break-glass access turns into permanent privileged backdoor risk when it is not tightly governed.
Practitioner guidance
- Define a break-glass lifecycle Document activation, approval bypass conditions, time limits, and required closure steps so emergency access has a clear beginning and end.
- Automate post-incident certification Trigger a recertification review after every emergency access event so owners confirm why the account was used and whether it still needs to exist.
- Enforce expiry on all emergency privilege Use timed deprovisioning or forced disablement so break-glass accounts cannot remain active after the incident response window closes.
Bottom line: Break-glass access is necessary for continuity, but it becomes a governance risk when it bypasses normal identity controls without a clear lifecycle.
Glossary terms: Break-glass Access, Just-in-Time Access Request, Identity Governance and Administration (IGA), Role-Based Access Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 8:31 am
Break-glass access is a governed exception, not a separate trust model: The control objective is to preserve service continuity without creating a second, weaker identity regime. Once emergency access bypasses MFA, approvals, and workflow checks, the organisation has created a privilege path that is operationally necessary but structurally dangerous. The implication is that emergency access must be designed as part of the normal governance fabric, not exempt from it.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Who is accountable when break glass access is used in a healthcare identity programme?
A: Accountability should sit with the access owner, the security governance function, and the audit process together. Break glass access must be time bound, logged, reviewed, and tied to a documented operational need. Without clear ownership, emergency access becomes standing privilege by another name, which undermines compliance and makes post-incident review difficult.
👉 Read our full editorial: Break-glass access governance is where RBAC and IGA fail