Topic starter
25/06/2026 3:04 pm
TL;DR: DevOps teams still manage workloads with static credentials even though non-human identities now outnumber humans 45:1, and that mismatch makes least privilege hard to enforce across cloud, SaaS, and CI/CD environments, according to Aembit. The practical break point is structural: dynamic, policy-driven access is the only model that scales with modern workload identity.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Why DevOps Still Struggles with Least Privilege (Even in 2025)”.
By the numbers:
- Workloads now outnumber human users 45:1, according to Aembit.
Key questions
Q: What breaks when workloads still rely on static credentials for service-to-service access?
A: Static credentials break down when workloads are ephemeral, distributed across multiple environments, or expected to authenticate without preconfigured secrets.
Q: Why do static credentials create more risk in CI/CD and Kubernetes environments?
A: Static credentials are copied into many places, reused by many systems, and difficult to revoke cleanly once they spread.
Q: How do security teams know whether least privilege is actually working?
A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.
Practitioner guidance
- Target secretless pilots at the highest-risk workloads Start with CI/CD jobs, deployment scripts, and service-to-service integrations that currently depend on embedded API keys or passwords.
- Inventory where static credentials still bootstrap trust Map every place a workload needs an initial secret to reach a vault, broker, or downstream resource.
- Separate workload privileges by task and environment Stop sharing service accounts across multiple applications or deployment stages.
Bottom line: Workload least privilege fails when identity is still governed through reusable secrets and shared accounts rather than task-scoped access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
25/06/2026 4:23 pm
Static secrets are a workload governance debt, not a convenience. The article shows that least privilege fails when teams accept reusable credentials as normal operating infrastructure. That choice creates access that persists beyond task boundaries, which means the control problem starts at design time, not during incident response. Practitioners should treat every static secret as accumulated privilege that must eventually be justified.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations reduce dependence on shared service accounts?
A: They should assign identity and permissions to the workload or task, not to a reusable account that several systems inherit. Shared service accounts hide ownership, blur accountability, and make offboarding unreliable. A cleaner model is task-scoped access with short-lived credentials and explicit policy boundaries.
👉 Read our full editorial: Ephemeral access is the only path to least privilege for workloads
This post was modified 23 hours ago by NHI Mgmt Group