Topic starter
03/12/2025 3:54 pm
TL;DR: Teleport shows that legacy PAM assumptions break down as static credentials, ephemeral resources, multi-cloud complexity, and DevOps automation reshape infrastructure access. Access governance now has to track session-bound identity across human and machine workloads, not just fixed accounts and servers.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Privileged Access for Modern Infrastructure: The Top Four Challenges”.
Key questions
Q: What breaks when privileged access still depends on long-lived secrets?
A: Long-lived secrets create standing privilege, which means compromise windows stay open long enough for attackers to harvest, reuse, and spread access.
Q: Why do long-lived secrets increase identity risk in cloud and SaaS environments?
A: Long-lived secrets remain reusable until someone revokes them, which gives attackers a durable target.
A: Common signs include orphaned privileged accounts, repeated screen switching, inconsistent policy enforcement, and manual effort to find who has access to what.
Practitioner guidance
- Replace standing credentials with session-bound access Use short-lived certificates and per-session authentication for administrators, workloads, and automation so access expires when the task ends.
- Map every privileged path to an identity lifecycle owner Assign ownership for human accounts, service accounts, API tokens, and machine credentials so provisioning, review, and offboarding follow the same governance model.
- Audit where secrets still back modern infrastructure Inventory SSH keys, API tokens, passwords, and certificates in code, pipelines, shared storage, and cloud environments, then remove durable secrets where cryptographic identity can replace them.
Bottom line: Legacy PAM breaks down when infrastructure is temporary, because controls built for stable assets cannot reliably govern access that appears and disappears with workloads.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Examples of how ephemeral certificates replace static credentials across cloud, Kubernetes, and database access
- The article's own breakdown of why legacy PAM patterns struggle with multi-cloud, on-premises, and infrastructure-as-code environments
- More detail on session recording, audit logging, and how Teleport applies role-based access control in practice
- The specific DevOps workflow integrations discussed in the source article, including CI/CD and automation touchpoints
👉 Read Teleport's analysis of why modern infrastructure breaks legacy privileged access →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 3:05 pm
Static credential governance is now a mismatch for ephemeral infrastructure: legacy PAM assumes access can be issued, reviewed, and revoked around stable assets. That assumption breaks when resources are created and destroyed continuously, because the access object often outlives the workload it was meant to protect. The implication is that privileged access governance must shift from account permanence to session-bound control.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern privileged access to databases, servers, and Kubernetes?
A: Security teams should govern privileged access at the resource layer, not only at the perimeter. That means using SSO for identity, just-in-time access for privilege, hidden credentials where possible, and session recording for accountability. The control objective is to reduce standing privilege and preserve evidence for review.
👉 Read our full editorial: Modern privileged access fails when infrastructure becomes ephemeral