Topic starter
19/08/2026 3:25 pm
TL;DR: PAM discovery should not end with vaulting every account, because the right disposition depends on what the account actually does. Hydden argues that entitlement data alone is insufficient and that authentication history is needed to decide between vaulting, JIT conversion, right-sizing, deprovisioning, or explicit acceptance.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Not Everything You Discover Belongs in the Vault”.
By the numbers:
- Only 39% of privileged access is managed through just-in-time or zero standing privilege, according to Hydden.
Key questions
Q: What breaks when PAM discovery does not include activity context?
A: Disposition turns into vault-everything governance, which confuses containment with risk reduction.
Q: Why does entitlement data alone create bad privileged access decisions?
A: Because entitlements describe possible access, not actual usage.
Q: How should teams decide between vaulting and JIT for discovered accounts?
A: Use the account’s authentication pattern, dependency profile, and business criticality.
Practitioner guidance
- Define disposition rules before bulk vaulting Create decision criteria that route discovered privileged accounts to vaulting, JIT conversion, right-sizing, deprovisioning, or explicit acceptance based on observed activity, not entitlement alone.
- Use authentication history as a classification signal Review logon frequency, interactive versus non-interactive use, and source diversity to distinguish service accounts from shared human credentials and dormant accounts.
- Map service account dependencies to named owners Record the services that depend on each privileged account and assign a named owner so rotation, review, and exception handling can be coordinated when activity is continuous.
Bottom line: PAM discovery is only useful when it leads to a clear disposition decision, not a blanket vaulting reflex.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
Activity context is the control boundary, not an enrichment layer: PAM discovery fails when teams treat discovery as a static inventory problem. Entitlements are necessary, but they do not explain whether privilege is dormant, operational, or being shared. The practical conclusion is that account disposition has to start from behaviour, not just ownership or group membership.
A few things that frame the scale:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when a privileged account is still needed but not well understood?
A: Assign a named owner, document what depends on the account, and set a review date before accepting the risk. That creates an accountable disposition rather than leaving the account in an unmanaged exception state.
👉 Read our full editorial: PAM discovery needs activity context to make the right account decision