Topic starter
08/02/2026 10:14 pm
TL;DR: Zero standing privileges removes persistent entitlements and shifts access to just-in-time approval, making privilege control more dynamic than vault-first PAM alone, according to CyberArk. The security value is real, but practitioners still need to decide where ZSP fits, where it does not, and how to govern exceptions without recreating standing privilege in disguise.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Zero Standing Privileges: The Essentials”.
Key questions
Q: What breaks when least privilege is not enforced for NHIs?
A: When least privilege is not enforced for NHIs, credentials and service accounts retain more power than the task needs.
Q: When should teams prioritise ZSP over conventional PAM approaches?
A: Prioritise ZSP when an NHI's access can be made truly session-scoped and the business can tolerate issuance at use time.
Q: How do security teams know JIT access is actually ephemeral?
A: JIT is ephemeral only if the entitlement disappears after the task or session ends and does not persist as a reusable standing permission.
Practitioner guidance
- Define where standing privilege must be eliminated Map all non-human identities to identify which privileges can be removed entirely rather than merely vaulted or rotated.
- Separate entitlement governance from secret management Review whether your current PAM design protects credentials while leaving the identity permanently authorised.
- Classify legitimate exception paths Document scenarios where ZSP is not practical, such as tenant-level creation workflows, and define how those exceptions are approved, monitored, and removed so they do not become standing access.
Bottom line: Zero standing privilege addresses the persistence of NHI entitlements, which is often a bigger exposure than the credential itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:19 pm
ZSP is best understood as entitlement removal, not just controlled access. The article makes the important distinction that access is not merely delayed until use, but eliminated until explicitly issued. That matters because many NHI programmes still treat secret custody as the main control while leaving privilege attached. The governance question is whether the identity has any durable authority at rest, and ZSP answers that by design.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: What is the difference between ZSP and vaulting for NHI access?
A: Vaulting protects the secret that unlocks access, while ZSP removes the standing entitlement that makes the secret useful at all times. Vaulting can coexist with persistent privilege, but ZSP changes the authorisation model itself. Teams need both where appropriate, but they should not confuse secret custody with privilege elimination.
👉 Read our full editorial: Zero standing privileges and the new baseline for NHI access