Topic starter
07/03/2026 9:38 pm
TL;DR: Akeyless says legacy PAM models are increasingly misaligned with cloud, machine, and AI-heavy environments, where identities now outnumber humans and standing secrets remain a major attack surface. Legacy PAM assumes privilege is human-centric and reviewable on a slower cadence, but autonomous access needs ephemeral issuance and immediate expiry.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Why the World Needs Modern PAM”.
By the numbers:
- Up to 85% of identities in many environments are now machines, services, containers, pipelines, and AI agents rather than humans.
- Over 50% of organizations have experienced a security incident tied to compromised machine credentials.
Key questions
Q: What breaks when PAM only covers human administrators?
A: A human-only PAM model leaves service accounts, workloads, and AI-connected systems outside the same governance discipline.
Q: Why do exposure management programmes struggle in cloud and automation-heavy environments?
A: They struggle because cloud assets, service accounts, and secrets change faster than ticket-based review cycles.
Q: How should security teams govern privileged access across service accounts and AI-driven systems?
A: Security teams should govern privileged access by focusing on the actions an identity can perform, not only on the account it uses.
Practitioner guidance
- Map privileged access by actor type Inventory human admins, service accounts, workloads, APIs, and AI agents separately, then trace where each one acquires elevated access, how long it persists, and who can revoke it.
- Replace standing secrets with task-scoped issuance Prioritise ephemeral credentials for workflows that do not require persistent access, and remove any default privilege that survives beyond the task or session.
- Bind access to context and expiry Require policies that enforce time-bound, context-aware issuance for elevated access, especially where automation or AI-driven execution can outpace human review.
Bottom line: Legacy PAM falls short when the privileged actor is a machine, workload, or AI system rather than a human administrator.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The generation-by-generation PAM breakdown, including what Gen 1 and Gen 2 PAM handled well and where they break down
- The architecture claims behind Zero-Knowledge protection and Distributed Fragments Cryptography™ in the Akeyless model
- The product-level description of unified privileged access, secrets management, encryption, and certificate lifecycle handling
- The enterprise validation example involving a cloud-heavy infrastructure provider and the evaluation criteria used
👉 Read Akeyless's analysis of Gen 3 PAM for machines and AI →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 8:10 pm
Standing privilege is now a machine-scale governance failure, not a human convenience issue. Legacy PAM assumed privileged access would be issued to a person, observed in a session, and then certified or revoked. That assumption breaks when machines, workloads, and AI agents operate continuously across environments and do not fit a human review cadence. The implication is that privileged governance has to move from session review to issuance-time control.
A few things that frame the scale:
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: Should organisations treat PAM, secrets management, and key management as separate programmes?
A: No. Separating them creates blind spots because the same operational workflow may depend on privileged access, application secrets, encryption keys, and certificates at once. A unified governance model is easier to audit and better matches how modern infrastructure actually consumes identity and privilege.
👉 Read our full editorial: Gen 3 PAM reframes privileged access for machines and AI