Topic starter
06/06/2026 1:42 am
TL;DR: Privileged access management is moving beyond administrator accounts toward action-based governance across humans, service accounts, APIs, workloads, and AI-driven systems, according to SSH Communications Security’s coverage of Alejandro Leal’s EMEA Partner Summit remarks. The shift makes visibility, short-lived access, and context-aware authorization the control points that matter most.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “PAM in the Age of AI and Non Human Identities”.
Key questions
Q: What breaks when standing privilege is still allowed in PAM?
A: Standing privilege breaks the core PAM promise because elevated access remains available even when no task is underway.
Q: Why do service accounts and other non-human identities increase breach impact?
A: Service accounts and other non-human identities increase breach impact because they often carry broad, persistent access and bypass interactive controls like MFA.
Q: What do teams get wrong about just-in-time privileged access?
A: They often treat JIT as a convenience layer rather than a control model.
Practitioner guidance
- Reframe privilege around actions Build your PAM inventory from the actions identities can perform, then map those actions to humans, service accounts, workloads, APIs, and AI-driven systems.
- Inventory non-human privilege Identify service accounts, machine identities, and tokens that hold standing access, then assign owners and review whether each privilege is still required.
- Use task-scoped access Replace persistent elevation with just-in-time access, short-lived credentials, and real-time policy checks for high-risk actions.
Bottom line: The article frames PAM as an action-governance problem, not an account-governance problem, which changes how teams define and measure privilege.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 2:58 am
Privilege has become an action property, not an account property. That change breaks the old PAM assumption that governance can start and end with privileged users and vaulted credentials. In cloud, API, workload, and AI-driven environments, the real unit of risk is the operation an identity can perform at runtime. Practitioners need to treat action scope as the governance object, not the account label.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Should organisations link PAM, identity governance, and secrets management?
A: Yes, because fragmented tooling creates inconsistent decisions about who or what can act. A connected identity fabric gives practitioners a single view of entitlement, ownership, and runtime privilege, which is necessary when humans, machines, and AI systems all exercise access differently.
👉 Read our full editorial: PAM is shifting to govern privileged actions across identities