Notifications
Clear all
Topic starter
25/06/2026 5:16 pm
TL;DR: Legacy PAM architectures struggle with ephemeral workloads, multi-cloud estates, and non-human identities, while Akeyless argues its Modern PAM model combines secrets management, ephemeral credentials, encryption, and secure access in a SaaS platform, according to Akeyless. The governance shift is real: privileged access now has to be designed for short-lived machine and workload identities, not just human sessions.
NHIMG editorial — based on content published by Akeyless: Akeyless vs. Delinea, Modern PAM for hybrid and multi-cloud environments
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams govern privileged access in hybrid cloud environments?
A: Security teams should treat privileged access as a runtime governance problem, not just a vaulting problem.
Q: Why do static vaults struggle with cloud-native identity governance?
A: Static vaults assume access is persistent enough to store, retrieve, and review later.
Q: What breaks when secrets are reused across pipelines and workloads?
A: Reusable secrets collapse separation between tasks, environments, and identities.
Practitioner guidance
- Inventory standing privileged secrets first List every long-lived secret used for admin, pipeline, database, and cloud access, then classify which ones can be replaced by short-lived issuance and which still require temporary exception handling.
- Separate policy from secret reconstruction Review whether the control plane, operators, or downstream tools can reconstruct usable secrets, and remove any pathway that allows plaintext access beyond the minimum required for issuance and audit.
- Standardise privileged access across identity types Apply one governance model to human admin sessions, service accounts, and automation identities so entitlements, approval, and expiry behave consistently across the estate.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The exact feature comparison between Delinea PRA and Akeyless Modern PAM across deployment, session controls, and secret handling
- The platform-level claims about Zero-Knowledge design, Distributed Fragments Cryptography, and how the vendor describes secret visibility
- The detailed product matrix covering SSH, RDP, databases, Kubernetes, web apps, and cloud IAM workflows
- The vendor's own framing of scaling, rollout, and operational overhead for hybrid and multi-cloud environments
👉 Read Akeyless's comparison of modern PAM and Delinea PRA →
Modern PAM for hybrid environments: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:51 pm
Standing secrets are the wrong abstraction for ephemeral infrastructure: A PAM model built around durable credentials was designed for environments where access could be issued once and reviewed later. That assumption fails when workloads are short-lived, pipelines are automated, and identity is instantiated at runtime. The implication is not just better rotation, but a different way of thinking about privileged access as a transient condition rather than a stored asset.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned", according to The 2024 State of Secrets Management Survey Report.
- Only 44% of organisations are currently using a dedicated secrets management system, which helps explain why manual governance still dominates many estates.
A question worth separating out:
Q: Who is accountable when privileged access spans humans, machines, and automation?
A: Accountability sits with the identity owner and the programme that approved the access, not with the secret itself. When access spans humans, machines, and automation, teams need lifecycle ownership, policy enforcement, and audit evidence that show who can request access, who can approve it, and when it expires.
👉 Read our full editorial: Akeyless Modern PAM vs Delinea PRA for cloud-native access
