Topic starter
25/06/2026 12:12 am
TL;DR: Traditional PAM tools built around static credentials and vault-centric control struggle in hybrid IT, OT and cloud environments, where modern access governance now demands Zero Trust, just-in-time privilege, and short-lived certificate-based authentication according to SSH Communications Security and Info-Tech Research Group. Standing access and long-lived credentials are no longer a defensible baseline; the control model has to shift to ephemeral, auditable privilege.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “Navigating the PAM Landscape according to Info-Tech”.
Key questions
Q: What breaks when privileged access controls are still built for static servers?
A: Static-server PAM assumes predictable access paths, durable sessions and stable privilege boundaries.
Q: Why do short-lived SSH certificates reduce privileged access risk?
A: Short-lived certificates limit the window in which a compromised credential can be reused.
Q: What are the signs that PAM is not working across hybrid IT and OT?
A: Common signs include standing admin access, reused SSH keys, inconsistent session recording, manual exceptions for contractors, and different rules for IT and OT assets.
Practitioner guidance
- Replace standing privileged accounts with just-in-time elevation Define privilege as a time-bound event tied to a specific task, then revoke it automatically when that task closes.
- Migrate reusable secrets to short-lived certificates Use passwordless or certificate-based access where possible so privileged access does not depend on long-lived credentials that can be copied or reused.
- Extend session controls into OT pathways Record sessions, apply command-level restrictions, and preserve forensic evidence for SSH, RDP, VNC, and web access that reaches industrial systems.
Bottom line: Hybrid PAM is moving away from static credential vaulting and toward time-bound privilege that can be issued, observed, and revoked cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:02 am
Standing privilege is now the wrong baseline for hybrid estates: The article reinforces a structural shift in PAM from credential storage to ephemeral access governance. Traditional models assume elevated access can persist long enough to be safely managed, but hybrid IT, OT, and cloud operations reward the opposite assumption. The practitioner conclusion is clear: access governance has to be built around issuance, revocation, and session boundaries, not vault occupancy.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern application-to-application privileged access?
A: They should treat application-to-application access as privileged access subject to the same lifecycle controls as human administrator sessions. That means inventorying the secrets or credentials in use, limiting scope, automating revocation, and tying access to the workflow that actually needs it. Exceptions should be temporary and visible, not permanent by design.
👉 Read our full editorial: Modern PAM for hybrid IT, OT and cloud access governance