Notifications
Clear all
Topic starter
06/06/2026 1:42 am
TL;DR: Privileged access management is moving beyond administrator accounts toward action-based governance across humans, service accounts, APIs, workloads, and AI-driven systems, according to SSH Communications Security’s coverage of Alejandro Leal’s EMEA Partner Summit remarks. The shift makes visibility, short-lived access, and context-aware authorization the control points that matter most.
NHIMG editorial — based on content published by SSH Communications Security: analysis of PAM beyond administrator accounts
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams govern privileged access across service accounts and AI-driven systems?
A: Security teams should govern privileged access by focusing on the actions an identity can perform, not only on the account it uses.
Q: Why do non-human identities change the PAM risk model?
A: Non-human identities change the PAM risk model because they authenticate continuously, operate at machine speed, and often lack stable human ownership.
Q: What breaks when privilege is still managed as an account problem?
A: When privilege is still managed as an account problem, security teams miss the action-level permissions that actually create risk.
Practitioner guidance
- Map privileged actions before privileged accounts Create an action inventory for the top sensitive operations in your environment, then map humans, service accounts, APIs, workloads, and AI-driven systems to each one.
- Assign clear owners to every non-human identity Require a business or technical owner for each service account, token, workload identity, and automation path.
- Replace standing access with task-scoped controls Use short-lived credentials and real-time policy enforcement for privileged operations that do not need persistent access.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- How the article frames identity fabric as a practical operating model for PAM, IGA, secrets management, and cloud entitlements
- The specific posture shifts Leal recommends for short-lived credentials, just-in-time access, and real-time policy enforcement
- The article's discussion of digital sovereignty, cryptographic transition planning, and post-quantum preparation
- The source commentary on how AI changes both privilege escalation speed and identity governance assumptions
👉 Read SSH Communications Security's analysis of PAM beyond administrator accounts →
Privileged actions, not accounts: what IAM teams need to know?
Explore further
06/06/2026 2:58 am
Privilege is becoming an action model, not an account model. The article reflects a real shift in identity security: access decisions are increasingly about what an identity can do at runtime, not whether it holds a named privileged account. That aligns with how attackers already work across human, NHI, and AI-driven environments. The implication for practitioners is that PAM must be evaluated as a control layer over behaviour, not a vault around credentials.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: What frameworks help with action-based PAM governance?
A: NIST Cybersecurity Framework 2.0, Zero Trust Architecture, and NHI governance guidance are the most useful starting points. Together they help teams tie privileged access to verification, least privilege, and continuous control. The goal is to align access decisions with the operation being performed, not just the identity type.
👉 Read our full editorial: PAM is shifting to govern privileged actions across identities
