Notifications
Clear all
Topic starter
25/06/2026 1:07 am
TL;DR: Security vendors are increasingly using just-in-time and context-aware access controls internally because breach impact, audit pressure, and trust loss hit them harder than most buyers, according to Apono. The deeper lesson is that standing access and static workflows undermine the credibility of any security programme that claims zero trust.
NHIMG editorial — based on content published by Apono: Security Starts at Home, Why Zero Trust Is Powering Leading Security Companies
Questions worth separating out
Q: How should security teams replace standing access with zero trust controls?
A: Security teams should replace standing access by moving elevated permissions to task-scoped grants that expire automatically after use.
Q: Why does standing privilege create more risk in cloud environments?
A: Standing privilege creates more risk in cloud environments because the credential remains usable long after the immediate task is finished.
Q: What do security teams get wrong about just-in-time access?
A: Teams often treat just-in-time access as a scheduling problem when it is really a governance problem.
Practitioner guidance
- Map standing access across sensitive systems Inventory human, service account, and pipeline identities that retain persistent elevated access to cloud consoles, source control, and production tooling.
- Move privileged workflows to task-scoped access Require short-lived access grants for administrative tasks, with policy checks tied to the requester, environment, and business function.
- Tie audit evidence to business function Record why access was granted, what task it supported, and when it expired.
What's in the full article
Apono's full article covers the operational detail this post intentionally leaves for the source:
- How Apono positions JIT and JEP controls for security vendors working across AWS, GCP, Azure, Terraform, and CI/CD.
- The Cybereason example showing how access automation replaced manual bottlenecks in sensitive environments.
- The article's specific argument for why security companies should eliminate standing access as part of external credibility.
- The vendor's explanation of how native integrations support auditability tied to business justification.
👉 Read Apono's analysis of zero trust access controls for security vendors →
Zero trust access controls: what security teams are proving internally?
Explore further
25/06/2026 10:18 am
Zero trust credibility starts with internal access discipline: Security vendors cannot credibly sell least privilege externally while tolerating standing access internally. That inconsistency is not just reputational, it weakens the governance posture customers are being asked to trust. For practitioners, the takeaway is that internal access design is now part of market trust, not just control maturity.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Another finding from the same research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
A question worth separating out:
Q: Who is accountable when privileged access is granted too broadly?
A: Accountability sits with the identity, infrastructure, and governance owners together, because broad access usually reflects a gap in policy design, workflow enforcement, or review ownership. For regulated environments, the control owner must be able to show why access was granted, who approved it, and when it was removed.
👉 Read our full editorial: Zero trust access controls are reshaping security vendor credibility
