Notifications
Clear all
Topic starter
25/06/2026 5:10 pm
TL;DR: Hybrid and multi-cloud environments are pushing privileged access away from VPNs and bastions toward identity-based control, with session brokering, credential injection, and revocation now central to modern PAM, according to Akeyless. The deeper shift is that access review and perimeter trust both break down when infrastructure changes faster than governance cycles.
NHIMG editorial — based on content published by Akeyless: the comparison of HashiCorp Boundary and Akeyless Secure Remote Access for modern privileged access
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
Questions worth separating out
Q: How should security teams replace VPN-style privileged access in hybrid cloud environments?
A: They should replace broad network trust with identity-based, task-scoped access that brokers a session to a specific target, records the activity, and removes or rotates credentials when the session ends.
Q: Why do static credentials create so much risk in modern privileged access workflows?
A: Static credentials create risk because they persist beyond the task and can be copied, reused, or exposed long after the access request is complete.
Q: What do organisations get wrong when they treat host discovery as access control?
A: They assume that automatically discovering a server or VM means the access model is already governed.
Practitioner guidance
- Map every privileged target to an identity-first access path Document whether each SSH, RDP, database, Kubernetes, and cloud console workflow uses brokering, injected credentials, or direct login.
- Separate discovery from authorization policy Keep cloud host discovery and access authorization as distinct control steps so tagged instances do not become implicitly reachable.
- Standardise session recording and post-session rotation Make sure privileged sessions across all target types produce a usable audit trail and that the credential used in the session is rotated or invalidated immediately after disconnect.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Exact platform workflow for browser-based access to SSH, RDP, databases, Kubernetes, and cloud consoles
- Feature-by-feature comparison of Boundary editions versus a unified PAM approach
- Demo-specific notes on session recording, credential injection, and live revocation
- Practical examples of how lightweight Gateways are deployed for private targets
👉 Read Akeyless' comparison of Boundary and modern PAM for hybrid cloud access →
Modern PAM for hybrid cloud access: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:42 pm
Identity trust is now the correct operating model for privileged access in dynamic infrastructure. VPN-era trust assumed a stable network boundary and a limited set of admin workflows. Hybrid cloud breaks that assumption because the target set changes continuously and access has to be granted to specific resources, not the environment as a whole. The implication is that PAM, IGA, and NHI governance must be designed around identity, scope, and session boundaries rather than perimeter membership.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, which is why privilege scope and credential lifetime remain governance weak points.
A question worth separating out:
Q: Who is accountable when privileged access spans VPNs, bastions, and identity-based tooling?
A: Accountability sits with the team that owns the access policy and lifecycle, not just the tool administrator. If access still relies on multiple manual steps, shared accounts, or delayed offboarding, the governance failure is organisational, because no single control owns the full session lifecycle.
👉 Read our full editorial: Modern PAM for hybrid cloud: why identity trust beats VPN access
