Notifications
Clear all
Topic starter
25/06/2026 1:10 am
TL;DR: Cybersecurity DevOps teams are replacing standing access with Just-in-Time and Just-Enough-Privilege controls as AI agents, pipelines, and machine identities expand cloud attack surface, according to Apono and supporting industry research. The governance lesson is that static privilege models no longer match machine-speed operations, so access must become task-scoped and context-aware.
NHIMG editorial — based on content published by Apono: Why DevOps in Cybersecurity SaaS Are Leading the Shift to JIT Access
By the numbers:
- According to the 2025 Verizon DBIR, credential abuse played a role in 22% of non-error, non-misuse breaches.
Questions worth separating out
Q: How should security teams implement JIT access for machine identities in cloud environments?
A: Start by identifying which service accounts, pipeline identities, and automation tokens truly need elevation, then bind each request to a specific task and duration.
Q: Why do standing privileges increase risk for non-human identities?
A: Standing privileges create persistent reach for identities that often only need access briefly.
Q: What breaks when periodic access reviews are used for machine identities?
A: Periodic reviews assume access is stable enough to be observed, explained, and recertified.
Practitioner guidance
- Inventory standing machine access first Map service accounts, bot accounts, pipeline identities, and automation tokens that still hold persistent privileges after their original task is complete.
- Scope elevation to the task, not the role Define approval and entitlement boundaries around a specific action, environment, and duration.
- Tie revocation to lifecycle events Trigger access removal when a workload is decommissioned, a pipeline is retired, or an integration changes ownership.
What's in the full article
Apono's full blog covers the operational detail this post intentionally leaves for the source:
- How Apono frames JIT and JEP workflows across AWS, GCP, Azure, Slack, Terraform, and Backstage.
- Examples from customer environments showing how temporary access replaced standing privilege in day-to-day operations.
- Implementation detail on how contextual access decisions are tied to policy, risk, and request timing.
- Vendor case examples describing workflow changes for security and DevOps teams when access is granted only on demand.
👉 Read Apono's analysis of why DevOps teams are shifting to JIT access →
JIT access for machine-heavy environments: what teams need to know?
Explore further
25/06/2026 10:25 am
Standing privilege is a lifecycle failure, not just an access-control mistake. When machine identities outnumber humans and are left with persistent access, the real problem is that governance never reclaims privilege after the task ends. That is why JIT and JEP resonate in DevOps environments: they fit the operational reality that access should exist only while work is active. The practitioner conclusion is that lifecycle offboarding for non-human identities must be treated as a core control, not an afterthought.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, according to The 2026 Infrastructure Identity Survey.
- A separate finding in the same survey shows that 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments.
A question worth separating out:
Q: Who should own JIT access governance across DevOps and IAM teams?
A: Ownership should sit with the team that can enforce lifecycle controls across the full access path, but it must include DevOps, IAM, and PAM stakeholders. The critical issue is accountability for revocation, auditability, and exception handling. Without shared ownership, temporary access quickly turns back into standing privilege by another name.
👉 Read our full editorial: Cybersecurity DevOps teams are driving the shift to JIT access
