At IMPACT in May, I said that every identity in the enterprise is privileged, and that the controls we built for administrators have to reach all identities.
Almost every conversation since has focused on the same response: “I know. Tell me how I do that across forty thousand identities without stopping the business.”
That is the right question. Today, we start answering it.
What Is Modern PAM?
Modern privileged access management, or PAM, extends privilege controls beyond a predefined set of administrator accounts. It protects privileged activity wherever it appears, across every workforce, cloud, infrastructure, and agentic identity in the enterprise. Modern PAM reduces the access an attacker can inherit and use to move through an environment. It does this by enforcing continuous authorization alongside zero standing privileges (known as ZSP) and just-in-time access, or JIT.
Attackers have lots of ways to sneak in: a stolen credential, an unpatched edge device, a publicly exposed management interface, a compromised supplier, or a user who clicked the wrong link. Identity is one of those doors, and a common one. None of these entry points is the interesting part.
Getting In Isn't Where the Damage Happens: Understanding Lateral Movement
Initial access buys one machine, one account, one session. Valuable things rarely live in that initial access. From that foothold, an attacker can:
- Move from the machine they have to the systems holding the money, the data, the secrets, or the infrastructure.
- Harvest whatever other credentials that machine is carrying.
- Follow the trust between accounts.
- Find the service account with more reach than anyone remembers granting it. Then repeat the process until something they control can reach something that matters.
Every one of those steps depends on identity.
This kind of intrusion used to be slow. It took patience, environment-specific knowledge, and a lot of noisy trial and error. It usually took days. That slowness was our advantage, and it is the reason detection worked at all.
AI-Driven Attacks: Time Is No Longer on Our Side
Frontier AI models can already perform complex, multistep security tasks with limited human direction. They can already act and move laterally based on known identity access pathways.
Earlier this year, one of them, run by its own developers as an internal evaluation, identified thousands of previously unknown vulnerabilities in the operating systems and browsers that enterprises use every day. Nobody was under attack. The model was given a goal, found the cheapest path to it, and acted. It was a demonstration of a capability, in controlled hands, with no adversary behind it.
Unfortunately, capabilities do not stay in controlled hands. Open models are closing the distance, and the reasoning that maps an enterprise is easier than the reasoning that finds a zero-day vulnerability. Planning for the version of this that arrives with an adversary behind it is not pessimism. It is the future reality.
When it lands, the expansion phase stops being slow.
What Attackers Inherit Is the Part You Control
You are not going to close every door. Assume the attackers will get in. What you decide is what they find when they do.
A compromised machine, account, or workload hands over exactly the access it is holding at that moment. Standing access means an intruder inherits those permissions and has longer access windows between scheduled privilege reviews.
You are not going to close every door. Assume the attackers will get in. What you decide is what they find when they do.
Ephemeral access, or access that’s granted only while work is actively being done, significantly shortens the potential opportunity for abuse. This is not a new idea. Least privilege has been industry-standard advice for twenty years. However, enforcing it by hand across an enterprise was always more aspirational than practical.
Today, JIT and ZSP deliver least privilege that actually holds. They turn a policy on paper into continuous, automated enforcement. That is why they sit at the center of modern PAM.
Privilege Is Defined by the Action, Not the Account
Traditional PAM concentrated on known privileged accounts and protected them through vaulting, credential rotation, session isolation, and monitoring. Those controls still matter.
But privilege appears whenever an identity can take an action with consequences, and that doesn’t end at login. At every moment of action, the organization must be able to verify who or what is acting, whose authority it’s using, what work was approved, and whether it’s justified.
Modern PAM expands the increased focus on privilege protection to every identity. JIT policies create the access window. Continuous governance helps determine whether it should remain open.
Six Places Standing Privilege Hides
JIT and ZSP are mechanisms for attaining stronger privilege protections, but they are not the whole picture. Standing access accumulates in six different places, and an attacker only needs to find one to create a problem.
Here is where those static permissions routinely hide across modern enterprise environments:
- Privileged accounts. The AWS root account, the break-glass admin, and the domain administrator nobody has logged into since the last audit. Vaulting, rotation, isolation, and session monitoring are still the fundamental controls here.
- Cloud and infrastructure entitlements. An identity and access management role with a wildcard policy, a Kubernetes cluster-admin binding, and a pipeline that can deploy anywhere. This is where JIT and ZSP apply most directly.
- Endpoints. Whether it's local admin rights on a developer laptop or a forgotten Linux sudoers rule from three years ago, endpoint privilege management removes the standing rights and only elevates per task.
- Secrets. A hardcoded API key in a repository, a CI token with no expiry, or a database credential that outlived the workload using it. Issued centrally, revoked centrally—or not controlled at all. (Learn more about secrets management).
- Workforce credentials. The Salesforce administrator, the HR system login, or the browser holding passwords for forty applications. Ordinary identities with real reach.
- Agentic identities. An agent with a SPIFFE-issued workload identity and a token that never expires, calling tools on behalf of someone who has since changed roles. Scoped, time-bound, and revocable—otherwise, it is just a standing privilege problem with better branding.
Identity Is Your Fastest Control Plane
Nobody does this by hand. The volume is unmanageable.
So the automated platform does the work. Discovery surfaces identities, entitlements, and access paths across cloud, endpoint, secrets, and workforce. AI analyzes what it finds and returns prioritized, multi-step recommendations instead of another endless queue. Remediation agents then act on them.
When initial access comes through code your customer does not own or control, identity may be the last control they can still change immediately. A vulnerable system takes weeks to patch. An architecture takes quarters to change. Access can be revoked in a second. When attackers gain the ability to reason about your environment at machine speed, the control plane that answers in seconds is the one worth investing in.
The same technology that is about to make the attack more attainable is also what makes the defense affordable.
That is what identity security changes. The intruder may get in. Their reach stops.
Modern PAM Moves at Attack Speed
Modern PAM is not “traditional PAM with more features.” It’s a different operating model. Traditional identity environments measured changes in months. Frontier AI compresses attack decisions into minutes. A system that can’t discover, control, or govern until it waits for another project or upgrade window can’t meet that threat. Modern PAM continuously responds as conditions change. It proactively governs the access estate and doesn’t wait until it’s too late to revoke access. It fights AI with AI.
What You Can Do with Modern PAM Today
This latest release advances modern PAM across three essential areas: platform and user experience, ZSP policy controls, and discovery and visibility.
How these advances make an impact:
- Enhanced user experience through a unified Command Center that brings discovery, control, and remediation into one place.
- Dynamic ZSP policies to grant and revoke access to correspond with the specific work being performed; this includes policies for JIT access to cloud workloads, including Kubernetes.
- AI-driven discovery across the entire identity estate, with the risk context to take action against what is discovered.
What Comes Next: Machine and Agentic Identities
Machine and agentic identities are the fastest-growing populations in every organization I speak to, and the biggest concern for most security teams. These identities hold real privilege, and they are created faster than any governance process was designed to absorb. Machine identities already outnumber human identities 109:1, and their sheer volume, variety, and velocity make it a much harder problem to solve—especially as we move to the era of privileged autonomous agents. It requires a deep, robust machine identity foundation, combined with modern privilege controls. Look forward to more leadership from Idira on that front.
Idira Modern PAM is now generally available. See it in action with a customized Idira demo.
FAQs
What is modern privileged access management?
Modern PAM expands traditional privilege controls beyond IT admin vaults to secure every human, cloud, workload, and AI identity using continuous authorization.
How do zero standing privileges differ from traditional PAM?
Traditional PAM vaults and monitors persistent admin credentials. ZSP removes standing access entirely, granting permissions dynamically only while work is actively performed.
Why are agentic and machine identities a risk for standing privilege?
Agentic identities scale faster than governance processes can track. They often hold non-expiring tokens or broad scopes that AI-driven attackers can exploit at machine speed.