Notifications
Clear all
Topic starter
15/08/2026 6:10 pm
TL;DR: Privileged access management is shifting from vaulting and session recording to runtime control, as Britive argues that cloud ephemerality, non-human identities, and AI agents have broken the old admin-account model. The decisive issue is no longer who can log in, but whether privilege can be created, scoped, and revoked at execution time.
NHIMG editorial — based on content published by Britive: PAM as the Control Plane: Evaluating the Evolution of the PAM Market
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams move PAM from vaulting to runtime control?
A: They should evaluate whether privilege can be created, scoped, and revoked at the moment of execution.
Q: Why do non-human identities change PAM governance so much?
A: Because NHIs often execute privileged actions continuously, not occasionally, and they usually outlive the task or application they support.
Q: What breaks when organisations keep standing privilege in cloud environments?
A: Standing privilege breaks the assumption that high-risk access is rare, visible, and reviewable.
Practitioner guidance
- Map every privileged workflow to its actor type. Separate human admin actions, NHI-driven automation, and any AI-assisted workflows before redesigning controls.
- Eliminate standing privilege from cloud and pipeline paths. Move high-impact actions toward just-in-time provisioning with automatic revocation after task completion.
- Apply lifecycle controls to non-human identities. Define ownership, purpose, expiry, and offboarding for service accounts, API keys, and tokens.
What's in the full article
Britive's full blog covers the operational detail this post intentionally leaves for the source:
- The report's architecture discussion on runtime authorization and how it differs from vault-centric PAM.
- The practical breakdown of Zero Standing Privilege across cloud, SaaS, and hybrid targets.
- The report's view of how agentic AI changes the privilege model for identity teams.
- The surrounding market context for why PAM is being recast as a control plane.
👉 Read Britive’s analysis of PAM as the control plane for privileged identity →
PAM as a control plane: are your runtime boundaries keeping up?
Explore further
15/08/2026 6:18 pm
PAM is becoming a privileged identity access control plane, not a product category. The article is right to frame the market shift this way because cloud, NHI, and agentic systems all need enforcement at the moment of action, not at the moment of login. That means the historical boundary between PAM, NHI governance, and runtime authorisation is dissolving. Practitioners should stop evaluating PAM as a vault with extras and start testing whether it can govern high-impact actions across actor types.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, which widens exposure paths and complicates lifecycle control.
A question worth separating out:
Q: How do AI agents change privileged access governance?
A: AI agents separate delegated human authority from machine execution, so the access record must show both. Teams should review what the agent can do on its own, what the user authorised, and which systems the agent can reach through API calls. That makes accountability clearer than treating the agent as if it were just another user.
👉 Read our full editorial: PAM becomes the control plane for NHI and agentic access
