Topic starter
25/06/2026 12:46 am
TL;DR: Identity-related alerts are consuming 11 person-hours each on average, while credential theft rose 160% in 2025, pushing privileged access management toward just-in-time controls, short-lived tokens, and tighter NHI governance according to Apono. The governing assumption is no longer that privileged access is stable enough to review later; in practice, access must expire before it becomes a standing attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Top 10 Privileged Access Management Software Solutions”.
By the numbers:
- Identity-related alerts now consume 11 person-hours each on average, according to Apono.
- Credential theft rose 160% in 2025, according to Apono.
Key questions
Q: What breaks when NHI credentials are overprivileged?
A: Overprivileged NHI credentials turn a single compromise into a larger access problem.
Q: Why do short-lived credentials not solve NHI risk by themselves?
A: Short-lived credentials only shrink the exposure window.
Q: How do teams know if JIT access is actually working for NHIs?
A: JIT access is working when privileged requests are time-bound, approvals are traceable, sessions are observable and no NHI retains access after the task ends.
Practitioner guidance
- Define NHI privilege by task window Classify service accounts, APIs and bots by the jobs they perform, then issue access only for the duration of that job.
- Automate expiry for privileged access Set short-lived credentials and auto-expiring permissions as the default for high-value NHI workflows, especially where access supports cloud operations or DevOps jobs.
- Inventory machine identities with human admins Maintain a single view of privileged human and non-human identities so discovery, ownership and revocation follow one governance process.
Bottom line: Standing privilege is becoming the wrong default for NHIs because it leaves reusable access alive beyond the task that needed it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:45 am
JIT is becoming the control plane for NHI privilege, not a convenience feature. The article shows that persistent entitlement is increasingly misaligned with how cloud service accounts, APIs and bots actually operate. Once privilege is only issued for the task window, the attack surface becomes materially smaller and the governance model becomes enforceable rather than aspirational.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams treat machine identities and human admins the same way in PAM?
A: They should govern both under the same privileged access discipline, but not with identical workflows. Human admin access may rely more on authentication and approval, while machine identities need runtime issuance, expiry and lifecycle ownership. The common requirement is that both be discoverable, scoped and auditable.
👉 Read our full editorial: Privileged access management for NHIs is shifting to JIT controls