Notifications
Clear all
Topic starter
25/06/2026 2:46 pm
TL;DR: Privileged access management still fails when teams rely on vaulting alone, because shared accounts, dormant entitlements, manual reviews, and weak audit links leave high-risk access exposed across critical systems, databases, cloud services, and enterprise applications, according to SafePaaS. The real issue is governance maturity: visibility, policy enforcement, and lifecycle controls have to work together, or privileged access remains a business liability.
NHIMG editorial — based on content published by SafePaaS: privileged access governance and platform selection guidance
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams govern privileged access across human and non-human identities?
A: They should manage privileged access by actor type and business ownership, not by account name alone.
Q: When does privileged access management fail in practice?
A: It fails when organisations equate password vaulting with governance.
Q: What do security teams get wrong about privileged access reviews?
A: They often review access as a periodic paperwork exercise instead of a live governance control.
Practitioner guidance
- Map every privileged identity to a named business owner. Identify administrative, service, third-party, and shared accounts across critical systems, then assign each to an accountable owner who can approve, review, and retire access.
- Separate credential storage from privilege governance. Treat vaulting, access approval, session monitoring, and certification as linked but distinct controls so a stored secret does not become a proxy for permanent access.
What's in the full article
SafePaaS's full article covers the operational detail this post intentionally leaves for the source:
- Platform selection criteria for policy-based privileged access controls in hybrid environments
- How SafePaaS maps privileged access workflows into broader governance and certification processes
- Operational considerations for session monitoring, audit readiness, and automation across enterprise systems
- Implementation details for integrating privileged access controls with existing identity and compliance tooling
👉 Read SafePaaS's analysis of privileged access governance and platform selection →
Privileged access governance gaps: what IAM teams need to know?
Explore further
25/06/2026 3:54 pm
Privileged access is not a vaulting problem, it is a governance problem. The article correctly centres policy, monitoring, and automation, but the field still too often treats those as separate feature choices instead of one privilege control model. If the organisation cannot explain who owns the entitlement, why it exists, and when it should disappear, the control surface is incomplete. Practitioners should treat privileged access as lifecycle-governed identity risk, not just credential storage.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs , Key Challenges and Risks.
A question worth separating out:
Q: How do organisations know if privileged access controls are actually working?
A: Look for three signals: privileged access is tied to named owners, session activity is traceable to approvals, and revocation happens as part of the lifecycle rather than after repeated exceptions. If any one of those is missing, privilege is still drifting outside governance boundaries.
👉 Read our full editorial: Privileged access governance gaps are still driving enterprise risk
