Notifications
Clear all
Topic starter
07/06/2026 8:30 pm
TL;DR: Persistent privileged access remains a major attack path because many PAM programmes still leave standing credentials, overprovisioned accounts, and slow operational change in place, according to SSH Communications Security’s summary of Gartner guidance. Zero Standing Privileges turns privileged access into time-bound, auditable access flows, making lateral movement and credential misuse materially harder.
NHIMG editorial — based on content published by SSH Communications Security: Zero standing privileges and the future of privileged access management
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams reduce standing privilege in privileged access programmes?
A: Start by mapping every account, workflow, and exception that can still hold access after a task is finished.
Q: Why do standing privileges increase breach impact in cloud and enterprise environments?
A: Standing privileges enlarge the attacker’s options because one exposed administrative path can be reused for lateral movement, persistence, or broad operational control.
Q: How do teams know whether ZSP is actually reducing risk?
A: Look for a measurable drop in persistent privileged entitlements, shorter elevation duration, and fewer workflows that bypass task-specific approval.
Practitioner guidance
- Discover every privileged account and access path Run account discovery across humans, service accounts, and administrative workflows before deciding where ZSP can replace standing access.
- Convert repeatable admin work into time-bound workflows Identify the privileged tasks that are genuinely episodic, then wrap them in just-in-time access with validated context and explicit expiry.
- Tie PAM to lifecycle governance Connect provisioning, review, rotation, and offboarding so temporary privilege does not drift back into standing entitlement.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- Gartner Buyer’s Guide context on PAM procurement, resource planning, and vendor evaluation.
- Step-by-step guidance for identifying privileged accounts across people and machine identities.
- Practical planning considerations for changing operational procedures without creating new security gaps.
- Discussion of TCO, licensing, and upskilling impacts when moving toward ZSP.
👉 Read SSH Communications Security's analysis of Zero Standing Privileges for PAM →
Zero standing privilege and PAM complexity: what teams need to know?
Explore further
07/06/2026 10:25 pm
Standing privilege is the control assumption ZSP breaks. Traditional PAM assumes privileged access can exist continuously and still be made safe through monitoring, rotation, and review. That assumption fails when attackers target reuse, lateral movement, and overtrusted administrative paths faster than the review cycle can react. The implication is that privilege must be designed to expire by default, not simply be better monitored.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why privileged access programmes so often miss the identities that matter most.
A question worth separating out:
Q: What should organisations do if PAM is deployed but standing access remains?
A: Treat that as an operating-model problem, not a tooling problem. Rework discovery, lifecycle controls, and approval paths so privileged access is granted only for defined work and removed as soon as the task ends. If persistent access remains normal, the deployment has not changed the security posture enough.
👉 Read our full editorial: Zero standing privilege is becoming the baseline for PAM programs
