Topic starter
25/06/2026 5:10 pm
TL;DR: Akeyless argues that hybrid and multi-cloud privileged access is outgrowing VPNs, bastions, and shared admin accounts because dynamic infrastructure now demands identity-based access, just-in-time credentials, session recording, and post-session revocation. The security model fails when access is granted to the network instead of the target, because governance cannot keep pace with changing infrastructure.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Akeyless vs Hashicorp Boundary: Why Unified Beats Fragmented in Modern PAM”.
Key questions
Q: What breaks when privileged access still depends on VPNs and bastion hosts in hybrid cloud?
A: VPNs and bastions tend to grant broad network reach instead of task-scoped access to a single target.
Q: Why do shared admin accounts and long-lived credentials increase risk in modern PAM?
A: They extend the lifetime of privileged trust beyond the session and make offboarding imperfect.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Replace network-based privileged access with target-scoped authorization Define privileged access around the exact server, database, cluster, or console a user needs, then remove VPN-style broad reach where possible.
- Eliminate standing admin credentials Use short-lived credentials, automatic rotation, and just-in-time issuance for administrative tasks so users do not operate with reusable passwords or shared accounts.
- Require session recording for elevated access Record privileged SSH, RDP, database, and browser-based administrative sessions so approvals can be matched to observed actions during review or incident response.
Bottom line: Hybrid cloud privilege cannot be governed reliably with perimeter-era controls because network access is too broad for dynamic infrastructure.
What's in the full article
Akeyless's full article covers the implementation detail this post intentionally leaves for the source:
- Step-by-step comparison of Boundary and Akeyless target handling across SSH, RDP, databases, Kubernetes, and cloud consoles
- Feature-level walkthroughs of credential injection, session recording, and just-in-time access in real administrative workflows
- Practical differences between dynamic host discovery and unified privileged access for teams operating across AWS, Azure, GCP, and on-prem
- Demo-specific examples of how temporary users, short-lived certificates, and live revocation behave during active sessions
👉 Read Akeyless's analysis of modern PAM for hybrid cloud identity trust →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:42 pm
Identity trust is now the governing model for privileged access in hybrid cloud. Network trust presumes a stable perimeter, but hybrid infrastructure changes too quickly for that assumption to hold. The practical implication is that PAM has become an identity decision problem, not a connectivity problem.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between identity-based access and network-based access for PAM?
A: Identity-based access authorises a specific person for a specific target and time window, while network-based access authorises movement inside a trusted segment. In modern environments, the first model limits blast radius and supports better revocation, while the second often exposes more than the task requires.
👉 Read our full editorial: Modern PAM for hybrid cloud: why identity trust beats VPN access