Topic starter
27/10/2025 8:55 pm
TL;DR: Standing privileges create open gates for both human and non-human identities, and the source argues that cloud-scale access should instead be provisioned just in time and rightsized to the minimum viable level, according to Britive. The central shift is that least privilege must be enforced dynamically across multi-cloud environments, not assumed through perimeter-era controls.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “The Principle of Least Privilege”.
By the numbers:
- By 2023, 75% of security failures will result from inadequate management of identities, access, and privileges, up from 50% in 2020.
- The average enterprise operates 80-100 public cloud platforms and applications, which makes perimeter-era access control harder to sustain.
Key questions
Q: What breaks when standing privileges are left in place for cloud infrastructure changes?
A: Standing privileges increase the chance that a routine change can affect shared systems far beyond the intended task.
Q: Why do over-permissioned cloud identities create so much risk?
A: Over-permissioned identities create risk because an attacker only needs one useful permission to expand access, alter controls, or reach sensitive data.
Q: How do security teams know whether least privilege is actually working?
A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.
Practitioner guidance
- Audit standing privilege across cloud identities Inventory human admin accounts, service accounts, and machine identities that retain persistent access after their task or change window ends.
- Move privileged access to just-in-time issuance Require access to be granted only at the moment of need and revoked when the work session ends.
- Right-size entitlements before they are approved Do not stop at whether access is allowed.
Bottom line: Standing privilege is the core cloud governance problem because it keeps access open after the original task or approval has ended.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 months ago by Britive
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:37 pm
Cloud least privilege fails when access is treated as a static entitlement. Britive's article describes a governance model that was built for a world where access could be granted once and trusted for long periods. That assumption no longer holds across multi-cloud estates, where identities, workloads, and privileged users move faster than manual review cycles. The implication is that least privilege has to be managed as a living control state, not as a provisioning event.
A few things that frame the scale:
- More than 95% of infrastructure-as-a-service accounts use less than 3% of the entitlements they are granted, according to Gartner.
A question worth separating out:
Q: When should organisations prioritise just-in-time admin access over permanent privilege?
A: Organisations should prioritise just-in-time admin access when elevated rights are not needed continuously and when compromise of standing privilege would create unacceptable blast radius. Time-bound privilege is especially valuable for directory administration, cloud control planes, and other paths that can reshape enterprise access.
👉 Read our full editorial: Least privilege for NHI access is now a cloud governance problem