Topic starter
14/07/2026 4:20 pm
TL;DR: KuppingerCole’s Leadership Compass for Privileged Access Management 2026 says privileged activity is shifting toward AI agents, service accounts, workloads, and automation, while static credentials and vault-centric models are reaching their limits, according to SSH Communications Security. The real governance problem is that privilege is now contextual and action-based, so access review, vaulting, and authentication alone no longer describe the risk boundary.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “AI agents and NHIs: What KuppingerCole’s 2026 PAM Leadership Compass Says on the Future of Privileged Access”.
Key questions
Q: What breaks when PAM still centers on accounts instead of actions?
A: Account-centric PAM misses the decision point that now matters most.
Q: Why do static NHI credentials create more risk than human credentials in cloud environments?
A: Static NHI credentials are reusable, often high privilege, and usually lack the human controls that limit user accounts, such as MFA and session review.
Q: What are the signs that a PAM programme is not keeping up with non-human privilege?
A: The clearest signals are broad permanent entitlements, repeated use of long-lived secrets, and access reviews that say little about actual runtime actions.
Practitioner guidance
- Reframe privileged scope around actions Inventory the high-risk actions that matter most in your environment, then map which identities can execute them today.
- Reduce standing privilege for non-human identities Prioritise service accounts, automation pipelines, APIs, and workloads that still hold persistent access.
- Use vaults as storage, not as the control objective Keep vaulting for secret custody, but measure whether the real control problem is access timing, entitlement scope, or credential lifetime.
Bottom line: The article’s main risk is that privilege is no longer well described by account inventories, because unattended identities now execute more sensitive actions than traditional admins.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:28 pm
Privilege is now an action property, not an account property. The article’s central shift is that organisations can no longer define PAM as protection for a small set of administrator logins. Privileged access now emerges from what an identity is permitted to do at runtime, across systems, security controls, and other identities. That changes the governance object itself, so practitioners must stop measuring only accounts and start measuring privileged actions.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise zero standing privilege over traditional vaulting?
A: They should prioritise zero standing privilege when privileged tasks are intermittent, repeatable, or short-lived, because persistent admin access adds exposure without adding value. If the role does not need continuous elevation, standing privilege becomes unnecessary attack surface and a governance burden.
👉 Read our full editorial: PAM is shifting from accounts to actions in privileged access