Notifications
Clear all
Topic starter
11/07/2026 8:23 pm
TL;DR: Privileged Access Management now has to govern both human administrators and non-human credentials, because exposed secrets, unmanaged service accounts, and overprivileged access create the same blast radius, according to Soffid. Standing privilege is the real problem: once access is persistent, monitored too late, or not inventoried, PAM becomes a visibility exercise instead of a control system.
NHIMG editorial — based on content published by Soffid: Privileged Access Management (PAM): cómo reducir riesgos sin frenar al equipo
By the numbers:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should organisations manage privileged access for service accounts and secrets?
A: They should treat privileged non-human identities as governed assets with named ownership, defined purpose, rotation, and revocation.
Q: Why do non-human privileged accounts increase PAM risk?
A: Because they often bypass the human cues that make access review and session oversight effective.
Q: What breaks when privileged access is not time-bound?
A: Standing privilege creates a permanent attack path, even if it is used only occasionally.
Practitioner guidance
- Inventory every privileged non-human identity Build a complete register of service accounts, SSH keys, application accounts, API credentials, and other privileged secrets.
- Make elevation time-bound and task-scoped Replace standing privileged access with JIT approvals and auto-expiry for all administrative sessions.
- Record and enforce privileged sessions in real time Monitor commands, session actions, and policy violations as they happen, then block or terminate access when behaviour goes outside approved scope.
What's in the full article
Soffid's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step PAM workflow for JIT and JEA access requests, approval, monitoring, and revocation.
- Specific examples of privileged human and non-human account types across admin, SaaS, cloud, and endpoint environments.
- How SOFFID PAM is positioned alongside IGA and ITDR in the vendor's broader identity stack.
- A practical view of audit logging, session recording, and emergency access handling in the source article.
👉 Read Soffid's analysis of privileged access management for human and non-human identities →
PAM for human and non-human access: what teams need to change?
Explore further
11/07/2026 8:53 pm
PAM now has to govern privileged access as an identity lifecycle problem, not a login problem. The article correctly places human administrators and non-human accounts in the same control domain, because both can reach critical assets through elevated privilege. That means inventory, approval, monitoring, and revocation all belong in the privileged access lifecycle, not just authentication. Practitioners should treat privileged access as a governed state, not a feature.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, which means privilege often outlives the business context that created it.
A question worth separating out:
Q: Which frameworks should guide privileged access governance?
A: NIST CSF, OWASP NHI guidance, and Zero Trust principles are the most relevant starting points for this topic. Teams should map privileged access to least privilege, continuous verification, and identity lifecycle controls, then use those controls to reduce persistent rights across human and non-human accounts.
👉 Read our full editorial: Privileged access management is being reshaped by NHI governance
