Notifications
Clear all
Topic starter
07/06/2026 9:05 pm
TL;DR: Break-glass access is a pre-staged emergency path for privileged accounts when IAM, PAM, MFA, or federation failures block legitimate access, and StrongDM says it should be monitored, time-limited, and rotated after use. The governance issue is not whether emergency access exists, but whether it is governed tightly enough to avoid becoming standing privilege by another name.
NHIMG editorial — based on content published by StrongDM: Break Glass Explained, Why You Need It for Privileged Accounts
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: What breaks when break-glass access is not tightly governed?
A: Break-glass access turns into permanent privileged backdoor risk when it is not tightly governed.
Q: Why do privileged emergency accounts need special lifecycle controls?
A: Privileged emergency accounts need special lifecycle controls because their purpose is temporary, but their impact is extreme.
Q: How do security teams know whether break-glass access is actually working?
A: Security teams know break-glass access is working when it is used rarely, leaves a complete audit trail, and is fully revoked after the event.
Practitioner guidance
- Define break-glass invocation criteria Limit emergency access to explicit outage, lockout, or incident conditions and document who can authorise use before any account is issued.
- Separate emergency identities from daily admin roles Keep break-glass accounts isolated from routine privileged workflows, with distinct storage, distinct ownership, and distinct approval paths.
- Rotate and disable after every use Revoke the used secret immediately after the incident closes, generate a new credential, and confirm the replacement is the only valid path forward.
What's in the full article
StrongDM's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step break-glass account setup for cloud and on-premises environments.
- The exact emergency workflow StrongDM describes for granting and documenting access.
- Practical notes on dual-control vaulting, including Shamir Secret Sharing and hardware storage.
- Post-incident cleanup steps for disabling or deleting the used account and recreating credentials.
👉 Read StrongDM's explanation of break-glass access for privileged accounts →
Break glass for privileged accounts: are your controls ready?
Explore further
08/06/2026 8:52 am
Break glass is a governance exception, not a privilege model. The control exists to restore access when normal IAM or PAM workflows fail, but it is only defensible when the exception is narrower than the primary control surface. Once emergency access becomes routine, the organisation has recreated standing privilege under a different label. Practitioners should treat the existence of a break-glass path as evidence that the normal control stack must be resilient enough to make exception use rare.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why emergency credentials and privileged non-human access need the same audit discipline.
A question worth separating out:
Q: Who should own emergency privileged access when incidents occur?
A: Emergency privileged access should be owned by a clearly designated control function, not by whoever happens to be available. Ownership must include approval authority, credential custody, and post-incident review. Without that separation, emergency access becomes ad hoc administration instead of governed identity practice.
👉 Read our full editorial: Break glass for privileged access: where IAM controls must yield
