An emergency credential used when normal access paths fail or become unavailable. These accounts are essential for recovery, but they are also high risk because they often bypass standard workflows, so they need tight vaulting, strong authentication, dual control, and continuous monitoring.
What Break-Glass Accounts Are For
Break-glass accounts exist for the worst case: when normal access paths, approval flows, or federation services fail and administrators still need a way to restore systems. They are not everyday admin accounts. Their purpose is narrow, and their value comes from being available when standard controls are unavailable.
That narrow purpose is why they should be treated as an exception path, not a convenience path. The account should be distinct, tightly governed, and reserved for recovery scenarios where delay would deepen outage, lockout, or containment problems.
Why Break-Glass Accounts Are High Risk
The same properties that make break-glass accounts useful also make them dangerous. They often bypass normal workflow checks, so compromise of one account can create an immediate path around routine approval, least privilege, and segregation of duties.
Because they are intended for exceptional use, they are also easy to neglect until a crisis forces activation. That combination, rare use plus high privilege, makes them a concentration point for operational and security risk.
How They Fit Into Recovery and Access Resilience
Break-glass accounts are part of resilience planning. They provide a fallback when the identity provider is down, MFA is unavailable, a policy mistake locks out administrators, or a critical change leaves no other operational path.
Used well, they reduce the chance that an access failure becomes a full business failure. Used badly, they become a hidden dependency that only works when it is least tested. That is why they belong in documented recovery design, not just in a vault.
They are most effective when paired with surrounding controls that preserve trust in the recovery path, including separation from everyday administration, limited scope, and clear conditions for when the account may be used.
What Good Governance Looks Like
Strong governance starts with vaulting the credential, protecting the unlock path, and making sure usage is visible. A break-glass account should not be managed like an ordinary shared admin login, because its risk profile is different from routine privileged access.
Good practice also includes dual control or equivalent quorum approval, strong authentication, and post-use review. The question is not only whether the account can get you back in, but whether you can prove who used it, why it was used, and what changed while it was active.
Testing matters as much as design. If the account has never been exercised in a controlled way, organisations often discover during an outage that the emergency path is broken, over-permissioned, or impossible to audit.
Risk and Threat Considerations
Break-glass accounts create a privileged bypass, so the main risk is that the emergency path becomes the attacker’s easiest path. If credentials leak, monitoring is weak, or the account is reused for convenience, it can bypass normal detection and control points.
Failure mechanism: The account is granted broad emergency access, stored imperfectly, or left too easy to activate, then used outside the intended recovery context without sufficient visibility or challenge.
Impact: An attacker or careless operator can gain high-impact access during a period when normal controls are already degraded, increasing the chance of persistence, unauthorized change, or recovery abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Break-glass accounts depend on tightly managed emergency credentials. |
| AC-2 — Account Management | Emergency accounts still require governed creation, activation, monitoring, and disablement. | |
| IA-2 — Identification and Authentication (Organizational Users) | Emergency administrative access still requires strong authentication before privileged use. | |
| Recommendation — Manage break-glass credentials with IA-5 controls for storage, rotation, and revocation. Apply AC-2 to control lifecycle, approvals, and tracking for break-glass accounts. Enforce IA-2 to require strong authentication before break-glass access is granted. | ||
| CIS Controls v8 | CIS-5 — Account Management | Break-glass accounts are privileged accounts that need explicit lifecycle and access governance. |
| CIS-6 — Access Control Management | Emergency access must be tightly limited and monitored to reduce bypass risk. | |
| Recommendation — Use CIS-5 to inventory, govern, and review emergency privileged accounts. Apply CIS-6 to constrain and review break-glass access paths. | ||
Practitioner Guidance
Why practitioners should care: A break-glass account is only valuable if it remains trustworthy under stress. Treat it as a recovery control with explicit ownership, not as a hidden admin fallback that nobody reviews. The operational goal is to preserve access when everything else fails without creating a standing privilege loophole.
What to watch for: Reuse, undocumented activation steps, weak vaulting, and missing post-use review are the usual warning signs that the emergency path is drifting into everyday use.
Related resources from NHI Mgmt Group
- Guide: Break-Glass and Emergency Access Account Guide
- Who should own break-glass account governance?
- What are the signs that break glass account controls are failing in practice?
- What breaks when break-glass access is not tightly governed?
- How do security teams know whether break-glass access is actually working?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org