Standing access: the security risk hiding in your cloud environment
Most breaches don't start with a sophisticated exploit. They start with access nobody ever removed.
Pull an access review on any cloud environment and the same pattern repeats: accounts from two years ago, service accounts that outlived their purpose, and IAM roles nobody can explain. Someone granted each one for a good reason, whether a migration, a short contract, or a one-time fix. Six months later, the IAM role still exists with the same permissions.
The individual, team, or organization did not intend to create a permanent privilege. The team needed access for a specific task, but the access outlived the work. The same pattern appears when a contractor changes roles, a service account outlives a project, or a database account remains active after a migration ends.
The access that outlives the work
That leftover access is standing access, and it is one of the most reliable paths an attacker has in their toolkit. A stolen credential becomes more dangerous when the identity behind it already holds broad privileges that remain available around the clock.
Standing access becomes especially difficult to manage when teams divide infrastructure across AWS, Kubernetes, databases, and other systems. Each environment has its own roles, policies, accounts, and review processes. A project creates new access. A team change creates another exception. An environment migration creates another set of permissions to reconcile.
The scale of the problem is easy to underestimate. Gartner reports that "94% of organizations have seen an increase in machine identities" (Source: Gartner, Investor Opportunities for IAM and AI Agents, November 2025). Most teams never review the bulk of those identities, and a growing share of them carry far more privilege than any task needs.
AI agents raise the stakes even further. Gartner projects that "through 2029, more than 50 percent of successful cyberattacks against AI agents will exploit access control weaknesses rather than traditional vulnerabilities" (Source: Gartner, Emerging Tech Impact Radar: AI Cybersecurity Ecosystem, October 2025). Every agent you deploy inherits access the way a person does, and usually holds it far longer than it should.
Why periodic reviews fall behind
Traditional controls can't keep pace. Periodic access reviews and joiner-mover-leaver processes assume an environment that changes a few times a year. They ask security teams to reconstruct access after it already exists, often across several systems and owners. Cloud infrastructure and container environments can change daily. The result is a widening Access-Trust Gap: the distance between the access you have granted and the access you can actually see and control.
Closing that gap requires a change in the default state of privileged access. Security teams need to discover existing permissions, reduce access to what each task requires, and remove privileges when the work ends. This is the principle of zero standing privileges, and it is fast becoming the baseline for securing cloud and hybrid infrastructure.
ZSP eliminates permanent privileged access. Instead of privileges sitting around unused but available:
Access is requested when needed
Approvals can be required for sensitive actions
Privileges expire automatically
Each elevation is logged and attributable
Together, they dramatically shrink the attack surface and lower the risk of both accidental and intentional misuse.
Build access around the task
Just-in-time and just-enough access provide the two controls that make this model practical.
Just-in-time access determines when a privilege exists. A user, service account, or agent receives access when a task requires it, rather than holding the privilege between tasks.
Just-enough access determines how much authority the task receives. An engineer may need permission to restart one service without needing administrator access across the entire production environment. A deployment pipeline may need access to one database without needing access to every database.
Together, these controls reduce the exposure window and limit the potential impact of a compromised identity. They also give security teams a clearer policy decision. The question becomes specific: who needs access, to which resource, for what task, and for how long?
Make every request explainable
1Password Privileged Access replaces standing access with just-in-time, just-enough privileges, created at request time, scoped to the task, and deprovisioned automatically when the work is done.
Standing access is a risk you can see coming, and a problem you can design out. Our practical guide below shares why standing access persists, what zero standing privilege looks like in practice, and how to cut breach risk without slowing engineering down.