Notifications
Clear all
Topic starter
07/06/2026 8:32 pm
TL;DR: Privileged access management is shifting from isolated credential vaulting to an embedded identity fabric as cloud, DevOps, NHIs, and AI agents expand the access surface, according to SSH Communications Security's Customer Advisory Board presentation with KuppingerCole analyst Alejandro Leal. Access review and static privilege models assume stable, human-paced administration, but that assumption breaks when ephemeral workloads and autonomous systems move faster than review cycles.
NHIMG editorial — based on content published by SSH Communications Security: a Customer Advisory Board analysis of PAM, NHIs, and AI agents
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern non-human identities in PAM programmes?
A: Treat non-human identities as governed principals with owners, purpose, and expiry conditions.
Q: Why do ephemeral workloads create problems for traditional privilege management?
A: Because traditional PAM assumes access persists long enough to be reviewed, but ephemeral workloads can create and consume privilege inside a short runtime window.
Q: What do organisations get wrong about crypto agility in identity systems?
A: They treat it as a cryptography project instead of an access architecture issue.
Practitioner guidance
- Unify privilege telemetry across identity tools Join PAM, IGA, CIEM, and authentication signals into one view of who or what can act, where privilege is used, and which paths remain exposed.
- Inventory non-human identities as governed principals Create a separate register for service accounts, workloads, bots, and APIs with named owners, purpose, and expiry conditions.
- Redesign access reviews for machine privilege Replace human-centric recertification assumptions with checks that verify runtime use, dependency ownership, and credential persistence for NHIs.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- The full presentation context around Alejandro Leal's identity-fabric framing and how the audience discussion unfolded.
- The specific PAM architecture patterns the speaker associates with context-aware and risk-adaptive access.
- The quantum-readiness and crypto-agility reasoning behind the future-state PAM model.
- The broader advisory board discussion that ties machine identities, ephemeral workloads, and privileged access together.
👉 Read SSH Communications Security's presentation on PAM, NHIs, and AI agents →
PAM, NHIs, and AI agents: what changes for IAM teams?
Explore further
07/06/2026 10:27 pm
Identity fabric is becoming the only workable model for privileged access at scale. PAM can no longer function as a standalone vault because the access problem now spans authentication, entitlement, telemetry, and response across humans and machines. The old operating model assumed these controls could be separated and still produce coherent governance. That assumption no longer holds when privilege is distributed across cloud services, ephemeral workloads, and identity-native infrastructure. Practitioners should treat the identity fabric as the new governance boundary.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: How do PAM, IGA, and CIEM work together for machine identities?
A: PAM enforces and observes privilege, IGA governs ownership and review, and CIEM exposes cloud entitlement paths. For machine identities, those functions need shared telemetry because separate tools miss the full access graph. Without that connective layer, entitlement drift and hidden privilege accumulate outside review.
👉 Read our full editorial: PAM is becoming identity infrastructure for NHIs and AI agents
