Notifications
Clear all
Topic starter
19/08/2026 3:25 pm
TL;DR: PAM discovery should not end with vaulting every account, because the right disposition depends on what the account actually does. Hydden argues that entitlement data alone is insufficient and that authentication history is needed to decide between vaulting, JIT conversion, right-sizing, deprovisioning, or explicit acceptance.
NHIMG editorial — based on content published by Hydden: activity-based PAM routing for privileged accounts
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
A: Decide from activity, not entitlement alone.
Q: Why do privileged accounts with the same rights often need different treatments?
A: Because rights describe theoretical capability, while authentication history shows actual use.
Q: How do teams know when a privileged account should be deprovisioned instead of vaulted?
A: An account should move toward deprovisioning when nothing depends on it, when usage is absent or obsolete, or when the service it supported has been replaced.
Practitioner guidance
- Route discovered accounts by activity profile Classify each privileged account by authentication cadence, interactivity, and service dependency before sending it to a vault, JIT workflow, deprovisioning queue, or acceptance review.
- Separate shared credentials from service identities Flag accounts showing interactive logons from multiple workstations or regions and move them into a remediation path that splits human use from machine use.
- Use historical evidence in recertification Preserve when accounts were added to admin groups, when they last authenticated, and whether their behaviour changed between reviews.
What's in the full article
Hydden's full article covers the operational detail this post intentionally leaves for the source:
- The account routing logic used to decide between vaulting, JIT conversion, deprovisioning, and explicit acceptance.
- Examples of how authentication history changes the treatment of a service account versus a shared credential.
- The evidence model for linking account ownership to review dates and dependency tracking.
- The continuous record approach used to support repeated disposition decisions as accounts change.
👉 Read Hydden's analysis of activity-based PAM routing for privileged accounts →
PAM discovery without activity context: what should teams do next?
Explore further
19/08/2026 4:10 pm
Vaulting every discovered privileged account is a control shortcut, not a governance strategy. Discovery creates a list of candidates, but disposition depends on usage, ownership, and dependency. When teams vault by default, they preserve standing access under a different mechanism instead of resolving whether the account should exist, be time-bound, or be split apart. The practitioner conclusion is simple: routing must be evidence-led, not reflexive.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months.
A question worth separating out:
Q: What should teams do when a shared credential looks like a service account?
A: Investigate whether the account is actually being used by multiple people through interactive logons, failed password retries, or access from many endpoints. If so, treat it as a shared human credential, put it behind stronger control immediately, and plan to split it into individual accounts before the next review.
👉 Read our full editorial: PAM discovery needs activity context to make the right account decision
