Notifications
Clear all
Topic starter
10/07/2026 9:13 pm
TL;DR: Traditional PAM and secret rotation can reduce exposure, but they do not govern the full set of authentication paths, ticket reuse, and lateral movement opportunities inside modern environments, according to Zero Networks and cited research from Gartner and Unit 42. The real shift is toward enforcing identity policy at the point of access, because credential protection alone leaves too many gaps open.
NHIMG editorial — based on content published by Zero Networks: Simplifying Identity Security: Why We Don’t Need Another Tool to Protect the Tool That Protects the Tool
By the numbers:
- No single tool discovers 100% of privileged accounts.
- 99% of identities had excessive permissions, ermissions, some unused for 60 days or more.
Questions worth separating out
Q: What breaks when PAM is deployed but does not govern every authentication path?
A: The main failure is false confidence.
Q: Why do credential rotations sometimes fail to stop lateral movement?
A: Because rotation changes the secret, not necessarily the live artefacts already issued from that secret.
Q: How can security teams know whether identity segmentation is actually working?
A: Look for denied unexpected authentication paths, reduced protocol sprawl, and fewer successful lateral movement attempts using tickets or reused credentials.
Practitioner guidance
- Map every authentication path Inventory where service accounts, scripts, legacy systems, and human admins actually authenticate.
- Separate credential rotation from access revocation Treat password changes, ticket expiry, and session termination as distinct controls.
- Constrain authentication at the destination Use policy to block unexpected protocols and deny access by default on assets that do not need a given identity.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how identity segmentation is enforced across authentication and network paths.
- Operational discussion of why ticket reuse and post-rotation access persist in real Active Directory environments.
- Practical examples of how policy can block unexpected authentication paths without relying on session brokering alone.
- Detailed discussion of the trade-offs between PAM infrastructure, secrets tooling, and destination-level enforcement.
👉 Read Zero Networks' analysis of identity segmentation and PAM gaps →
Identity segmentation and PAM gaps: are your controls keeping up?
Explore further
10/07/2026 9:36 pm
Identity security breaks when programmes treat credentials as the control instead of the access path. Credential vaulting, rotation, and MFA all matter, but they only protect one layer of a much larger identity graph. The article correctly shows that service-to-service authentication, legacy protocols, and background jobs often sit outside classic PAM coverage. Practitioners should stop equating secret protection with access control.
A few things that frame the scale:
- No single tool discovers 100% of privileged accounts, according to the Ultimate Guide to NHIs , Key Challenges and Risks.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Who is accountable when privileged access controls do not contain post-authentication movement?
A: Accountability sits with the team that owns the full identity control plane, not only the vault or MFA stack. If service accounts, legacy authentication methods, and destination policies are managed by different groups, the gap is governance fragmentation. The fix is clear ownership across authentication, authorization, and session enforcement.
👉 Read our full editorial: Why identity segmentation is reshaping PAM and NHI governance
