Topic starter
17/08/2026 4:41 pm
TL;DR: Teleport’s 2024 survey of 250 security and engineering leaders finds that 89% of organisations have suffered at least one security incident in the past three years, while 88% say credentials and secrets proliferation is making infrastructure access security harder and 86% cite regulatory compliance as a major challenge. The real issue is that access governance now has to span security, engineering and compliance as one operating model, not three separate ones.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Why Secure Infrastructure Access Must Evolve: Insights from Teleport’s 2024 Survey”.
By the numbers:
- 89% of organisations have suffered at least one security incident in the past three years, according to Teleport’s survey.
- 88% say credentials and secrets proliferation makes infrastructure access security harder, according to Teleport’s survey.
- 86% cite regulatory compliance as a major challenge, according to Teleport’s survey.
Key questions
A: The organisation loses a single source of truth for who can access what, when access expires, and how evidence is produced.
Q: Why do credentials and secrets create so much risk in modern infrastructure?
A: Because each credential or secret is both an access path and a lifecycle obligation.
Q: What are the signs that privileged infrastructure access is poorly governed?
A: Common signs include unmanaged admin interfaces, inconsistent ownership of firewall or router consoles, direct internet exposure, and patch state that is tracked separately from privileged access records.
Practitioner guidance
- Inventory every infrastructure access path Map human, machine, pipeline and emergency access paths across cloud, edge and on-prem environments so that policy coverage reflects how systems are actually reached.
- Eliminate standing privileges from infrastructure workflows Replace persistent credentials and broad backdoor paths with ephemeral access tied to the specific task, environment and operator context.
- Pull secrets out of config files and pipelines Find hard-coded credentials in application configs, CI/CD variables and deployment scripts, then move them to governed secret handling with revocation ownership.
Bottom line: Infrastructure access now fails when identity, engineering and compliance are treated as separate governance problems.
What's in the full report
Teleport’s full blog post covers the operational detail this post intentionally leaves for the source:
- Survey framing and respondent breakdown for the 250 security and engineering leaders behind the findings
- Leader-versus-Novice comparisons that show how stronger access practices change incident cost and incident frequency
- Operational examples of how teams are consolidating identities, removing standing privileges and unifying policy
- The article’s full discussion of why compliance, productivity and security need one access model rather than three
👉 Read Teleport’s analysis of why secure infrastructure access must evolve →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Infrastructure access has become a governance problem, not a tooling problem. Teleport’s survey is really describing the collapse of the old assumption that access can be managed inside one team or one control plane. Once humans, machines, secrets and delivery workflows all create access paths, the unit of governance is the full access lifecycle. The practitioner conclusion is to govern access as an operating model, not as an isolated admin function.
A question worth separating out:
A: They should move to a shared operating model with one policy baseline, one evidence model and one revocation process. That does not eliminate specialist responsibilities. It stops access governance from fragmenting into separate decisions that produce contradictory results in production.
👉 Read our full editorial: Infrastructure access security is lagging behind cloud complexity