Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: Privileged Access Management is moving from a point control for admin accounts to a broader identity governance layer for hybrid, cloud, and DevSecOps environments, according to Arcon. The real shift is that standing privilege, auditability, and just-in-time access now determine whether PAM can contain identity-based attacks and compliance exposure.
NHIMG editorial — based on content published by Arcon: PAM in 2025 and beyond
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams reduce standing privilege in privileged access management?
A: Security teams should convert standing privilege into time-bound access that is granted only for a specific task and revoked immediately afterward.
Q: Why does user provisioning fail so often in hybrid and cloud environments?
A: It fails when access is spread across too many systems for one team or workflow to govern cleanly.
Q: What do IAM teams get wrong about just-in-time access?
A: They often stop at policy design and never verify runtime behaviour.
Practitioner guidance
- Inventory every privileged identity across human and non-human actors Build a single inventory that includes administrator accounts, service accounts, cloud roles, and pipeline credentials.
- Convert persistent elevation into task-scoped JIT access Set elevation requests to expire automatically after the approved task window, and require re-approval for repeat use.
- Tie privileged session monitoring to abnormal command and target patterns Alert on privileged sessions that diverge from expected commands, destinations, or timing.
What's in the full article
Arcon's full article covers the operational detail this post intentionally leaves for the source:
- The article expands on practical PAM use cases across cloud, DevSecOps, IoT, and OT environments.
- It walks through feature areas such as unified access, RBAC, session recording, and automated workflows.
- It describes how JIT access, audit logging, and AI-assisted threat detection are positioned in the 2025 PAM model.
- It adds a forward-looking view of how organisations should prepare privileged access programmes for hybrid work and infrastructure change.
👉 Read Arcon's analysis of PAM in 2025 and beyond →
PAM in 2025: is your privileged access model keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Standing privilege is the control failure PAM was built to eliminate, but many programmes still tolerate it. The article correctly points to least privilege and JIT access, yet the deeper issue is that organisations often leave elevated access in place long enough for abuse to become inevitable. That is a governance failure, not a tooling gap. The practitioner conclusion is simple: if privilege remains persistent, PAM is being used as a wrapper around risk rather than a control against it.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- Our research also shows that the average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, which shows how quickly privilege gaps become systemic.
A question worth separating out:
Q: What is the difference between privileged session monitoring and access certification?
A: Session monitoring observes what an identity does after access is granted, while access certification decides whether that access should exist in the first place. Both are needed. Monitoring helps detect abuse, but certification prevents unnecessary privilege from remaining in the environment.
👉 Read our full editorial: PAM in 2025 is shifting from access control to identity governance
