Topic starter
30/09/2026 7:10 pm
TL;DR: Privileged access is moving beyond vaults and shared admin accounts toward dynamic, identity-tied authorization for cloud infrastructure, workloads and AI agents, according to P0 Security's SACR report. Standing privilege is becoming misaligned with modern environments, and just-in-time access is increasingly treated as the baseline rather than an add-on.
NHIMG editorial: based on content published by P0 Security: the SACR report on the evolution of the privileged access management market and the new competitive landscape
Questions worth separating out
Q: What breaks when standing privileges are left in place for cloud infrastructure changes?
A: Standing privileges increase the chance that a routine change can affect shared systems far beyond the intended task.
Q: When does just-in-time access reduce risk for non-human identities?
A: JIT reduces risk when the access is narrow, time-bound, and revoked automatically after the task finishes.
Q: What do security teams get wrong about AI access risk?
A: Many teams focus on the model while ignoring the identity path that reaches it.
Practitioner guidance
- Audit standing privilege across NHIs and workloads Inventory service accounts, workload identities and shared admin paths that still retain persistent rights after the task ends.
- Move privileged access issuance to runtime Use just-in-time access for actions that do not require persistent rights, especially in cloud operations and agent workflows.
- Tie authorization policy to identity and context Define access policy around the requesting identity, the resource touched and the duration required, rather than around a permanent role assumption.
What's in the full report
P0 Security's full report covers the operational detail this post intentionally leaves for the source:
- A phased PAM evolution model showing how vaults, shared admin accounts and session control map to newer runtime patterns
- Market context on why standing privilege no longer fits cloud infrastructure, workloads and AI agents
- The report's discussion of just-in-time and just-enough access as the emerging baseline for privileged access
- How privileged access maturity is framed as a prerequisite for safe agentic adoption
👉 Read P0 Security's report on the evolution of privileged access management →
Privileged access maturity: are your controls keeping up with AI agents?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
30/09/2026 7:11 pm
Standing privilege is becoming a structural mismatch, not just a poor practice. The report reflects a broader market shift away from persistent privilege because cloud and agentic systems operate on runtime needs, not stable human schedules. When access must exist only for a task, standing privilege turns into excess exposure by design. Practitioners should read this as a governance reset for PAM, not a feature refresh.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations decide when runtime authorization is better than static roles?
A: Runtime authorization is the better choice when the identity's work is ephemeral, the resource target is known only at execution time, or persistent entitlement would create unnecessary blast radius. Static roles still have a place, but they should not be the default for transient non-human access.
👉 Read our full editorial: Privileged access is shifting toward runtime authorization for NHIs
