Topic starter
25/06/2026 5:10 pm
TL;DR: Akeyless's analysis of modern PAM finds perimeter-era VPNs, bastions, and shared admin accounts no longer govern hybrid and multi-cloud privilege reliably. Target-scoped identity, short-lived credentials, and recorded sessions are the controls that let teams revoke access cleanly.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Akeyless vs Hashicorp Boundary: Why Unified Beats Fragmented in Modern PAM”.
Key questions
Q: Why do shared admin accounts and long-lived credentials increase risk in modern PAM?
A: They extend the lifetime of privileged trust beyond the session and make offboarding imperfect.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Q: What breaks when privileged access still depends on VPNs and bastion hosts in hybrid cloud?
A: VPNs and bastions tend to grant broad network reach instead of task-scoped access to a single target.
Practitioner guidance
- Replace network-based privileged access with target-scoped authorization Define privileged access around the exact server, database, cluster, or console a user needs, then remove VPN-style broad reach where possible.
- Eliminate standing admin credentials Use short-lived credentials, automatic rotation, and just-in-time issuance for administrative tasks so users do not operate with reusable passwords or shared accounts.
- Require session recording for elevated access Record privileged SSH, RDP, database, and browser-based administrative sessions so approvals can be matched to observed actions during review or incident response.
Bottom line: Hybrid cloud privilege cannot be governed reliably with perimeter-era controls because network access is too broad for dynamic infrastructure.
Glossary terms: Identity trust, Just-in-Time Access Request, Session Recording, Credential Injection
What's in the full article
Akeyless's full article covers the implementation detail this post intentionally leaves for the source:
- Step-by-step comparison of Boundary and Akeyless target handling across SSH, RDP, databases, Kubernetes, and cloud consoles
- Feature-level walkthroughs of credential injection, session recording, and just-in-time access in real administrative workflows
- Practical differences between dynamic host discovery and unified privileged access for teams operating across AWS, Azure, GCP, and on-prem
- Demo-specific examples of how temporary users, short-lived certificates, and live revocation behave during active sessions
👉 Read Akeyless's analysis of modern PAM for hybrid cloud identity trust →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/06/2026 5:42 pm
Identity trust is now the governing model for privileged access in hybrid cloud. Network trust presumes a stable perimeter, but hybrid infrastructure changes too quickly for that assumption to hold. The practical implication is that PAM has become an identity decision problem, not a connectivity problem.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between identity-based access and network-based access for PAM?
A: Identity-based access authorises a specific person for a specific target and time window, while network-based access authorises movement inside a trusted segment. In modern environments, the first model limits blast radius and supports better revocation, while the second often exposes more than the task requires.
👉 Read our full editorial: Hybrid cloud PAM needs target-scoped identity and revocation
This post was modified 7 days ago by NHI Mgmt Group