Topic starter
22/01/2026 5:19 pm
TL;DR: PAM selection now hinges on whether a platform can control standing privilege, secrets sprawl and auditability across hybrid and cloud environments, according to Keeper Security. The practical issue is not feature count but whether access governance can keep up with decentralized infrastructure and machine credentials.
Editorial analysis by NHI Mgmt Group, based on content published by Keeper Security: “How To Compare PAM Solutions on the Market”.
By the numbers:
- 60% of organisations using on-prem PAM solutions say it prevents them from reaching their security goals.
Key questions
Q: What breaks when PAM is treated only as session control in hybrid environments?
A: Privileged access governance breaks when teams focus only on recording sessions and ignore the entitlement state behind them.
Q: When should organisations prioritise JIT PAM over permanent privileged accounts?
A: Organisations should prioritise JIT PAM when cloud services are distributed, DevSecOps teams move quickly, and privileged access needs to be tightly bounded by session or task.
Q: How do you know if a PAM platform is actually working across cloud and on-prem systems?
A: A PAM platform is working when access is consistently enforced, sessions are recorded where they matter, secrets are centrally controlled and administrators can produce usable evidence across every environment.
Practitioner guidance
- Map standing privilege across hybrid estates Identify where durable privileged access still exists across on-prem, cloud and multi-cloud systems, then classify which accounts can be converted to time-limited access.
- Inventory human and machine secrets together Build one inventory for passwords, tokens and other credentials used by people and NHIs so storage, rotation and revocation are governed as one control surface.
- Require session recording across privileged protocols Verify that SSH, RDP, Kubernetes and database sessions are all captured in a way that supports audit trails and investigation.
Bottom line: Hybrid and cloud PAM selection is really about whether privileged access can stay governed after infrastructure becomes distributed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 1:50 am
Hybrid PAM has become a governance test, not a feature race. The core issue is whether privileged access can remain consistent when identity, infrastructure and audit evidence are split across multiple control planes. Legacy deployments often assume a stable perimeter and a relatively fixed infrastructure shape, which hybrid and cloud access patterns no longer provide. Practitioners should read platform choice as a test of whether governance survives distribution.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between secrets management and privileged session management?
A: Secrets management governs how credentials are stored, rotated and revoked, while privileged session management governs what happens during the active use of privileged access. The first reduces credential exposure, and the second provides visibility and control over actions taken after authentication. Strong programmes need both because protecting the secret does not by itself control the session.
👉 Read our full editorial: How PAM selection is shifting for hybrid and cloud access risk