Blog

Access, for the people accountable for it

Written for CISOs, platform and SRE leads and the executives they report to: why standing access persists, what auditors expect, how to scope, approve and measure access, and worked use cases with the diagrams and the screens.

The landscape

Why standing access is still the default, what the market offers, and what auditors and regulators now expect of privileged access.

The landscape For every reader

Standing access is the risk you already carry

Most breaches do not break in. They log in, and find the permissions waiting.

12 min read The landscape For CISOs & security leaders

PAM, JIT, CIEM and the cloud consoles: a market map for access

Four categories, one job, and the gap between finding over-permission and fixing it

13 min read The landscape For CISOs & security leaders

Why just-in-time access programmes stall

Approval fatigue, roles that are still too broad, and the engineer at 3 a.m.

11 min read The landscape For executives & boards

What auditors and regulators expect of privileged access

SOC 2, ISO 27001, PCI DSS 4.0, NIS2 and DORA, read for the access controls

13 min read

The operating model

How to scope, score, approve and measure access, and how far to let agents act on their own.

The operating model For platform & SRE leads

Least privilege, written per request

From “give me ReadOnlyAccess” to four log actions on one log group

12 min read The operating model For CISOs & security leaders

Approvals that match the risk

A score anyone can read, and a route that follows from it

12 min read The operating model For executives & boards

Access metrics for the board

Standing admin left, time to access, and the numbers that look good while risk goes up

11 min read The operating model For CISOs & security leaders

Letting agents act on access: the autonomy dial

Draft, ask first, act and tell, act. Per agent, per organisation, with a ceiling.

12 min read

Use cases, worked end to end

One real situation per post: what happens, who does what, and what the console shows at each step.

Use cases, worked end to end For platform & SRE leads

Into the payments database during an incident

One sentence, one table, sixty minutes, then the login is gone

11 min read Use cases, worked end to end For every reader

When a read-only grant reaches for a secret

Matching what a person does against what they asked for

10 min read Use cases, worked end to end For platform & SRE leads

Admin in production: two people and a second factor

Rolling back a deploy without anyone keeping AdministratorAccess

11 min read Use cases, worked end to end For platform & SRE leads

Break-glass at 3 a.m.

Instant for whoever is on call, loud for everyone else, reviewed in the morning

10 min read Use cases, worked end to end For CISOs & security leaders

Retiring standing admin without breaking anything

Discovery, escalation paths, last-used dates and a reversible conversion

12 min read Use cases, worked end to end For platform & SRE leads

kubectl in production, scoped to one namespace

A RoleBinding per grant instead of a cluster-admin group

10 min read Use cases, worked end to end For CISOs & security leaders

The quarterly access review that prepares itself

Every line pre-filled with real usage and a recommendation

11 min read Use cases, worked end to end For executives & boards

Access evidence your auditor will accept

Every request, decision, grant and removal, in words, with who and when

10 min read

Adopting it

The business case, the security review of the broker and the first ninety days.

Adopting it For executives & boards

The business case for just-in-time access

Breach exposure, audit effort, engineer time and the tools you can retire

12 min read Adopting it For CISOs & security leaders

Security-reviewing an access broker

The questions to ask any vendor that will change your production permissions

13 min read Adopting it For CISOs & security leaders

The first ninety days

From standing admin to on-request access, one system at a time

12 min read

See it on your own estate

Stop reading about it

Bring one AWS account and one database to a working session and see standing access become on-request access on your own estate.

Request a demo