Attackers changed how they get in. They did not change what they do next.
That is the clearest read on the Verizon 2026 Data Breach Investigations Report, and it has a direct consequence for how security teams should think about privileged access.
Vulnerability exploitation became the top initial access vector for the first time in the report’s 19-year history, accounting for 31% of breaches up from 20% the prior year. Credential abuse as a first step fell to 13%.
Read only that line and you would conclude identity risk is receding.
It is not. When Verizon counted credential abuse anywhere across the breach progression rather than only at the entry point, it appeared in 39% of breaches — more than any other mechanism in the dataset.
The takeaway: initial access is now a vulnerability problem. Everything after initial access is still a privilege problem. A patched CVE closes a door. It does not revoke the service account credential the attacker copied on the way through.
That gap is what a privileged access management platform exists to close, and it is why PAM has quietly shifted from a compliance checkbox to the primary determinant of blast radius.
Standing Privilege Is the Default Nobody Decided On
Almost no organization sat down and chose to give its administrators permanent, always-on elevated rights. It accumulated. A contractor needed domain admin for a migration in 2021.
A service account was created with local admin because the installer demanded it. A break-glass account was provisioned during an incident and never retired.
Each decision was reasonable in isolation. Together they produce an environment where an attacker who lands anywhere finds credentials that work everywhere, immediately, with no approval step and no expiry.
This is what makes post-compromise activity so efficient in the current data. The DBIR shows stolen credentials holding steady at 36% across breach action varieties.
In System Intrusion patterns, stolen credentials and exploited vulnerabilities each appear as initial access vectors at 39%. In Public Administration, stolen credentials show up in 59% of hacking-related breaches.
There is a second signal worth pausing on. RMM tool abuse rose 240% year over year in the 2026 dataset, while traditional backdoor and C2 malware usage fell 27%.
Attackers are abandoning custom implants in favour of the remote access tooling IT teams already run because a valid privileged credential plus a sanctioned tool produces telemetry that looks like a Tuesday afternoon.
You cannot detect your way out of that. The control that works is removing the standing privilege the attacker is impersonating.
The Identities Your PAM Software Probably Is Not Covering
Here is where most privileged access programs have a genuine blind spot, and it has grown faster than anyone’s roadmap.
Palo Alto Networks’ 2026 Identity Security Landscape report, based on responses from 2,930 cybersecurity decision-makers, found machine identities now outnumber human identities by 109 to 1 up from 82 to 1 a single year earlier, a 32.9% jump.
The composition is the part that changes the security problem: of those 109 machine identities per human, 79 are AI agents.
Organisations in that survey expect AI agent identities to grow 85% over the next twelve months, machine identities overall by 77%, and human identities by just 56%. Axis Intelligence
Service accounts, API keys, OAuth tokens, deployment credentials, and now autonomous agents share three properties that make them attractive targets:
- They bypass MFA by design. There is no phone to prompt. Authentication is the secret itself.
- They have no behavioural baseline. They run at 3 a.m. because that is when the job is scheduled. Anomaly detection struggles to define “unusual.”
- They rarely expire. Nobody offboards an API key. Joiner-mover-leaver processes were built for people.
Cloud Security Alliance research published in May 2026 found the enterprise-wide average ratio sits near 45 to 1, climbing to 144 to 1 in cloud-native environments.
The ratio varies enormously by methodology which is itself the point. If four credible 2026 studies disagree by a factor of eight on how many machine identities exist, most organisations do not have a reliable inventory of their own.
A PAM solution that only vaults human admin passwords is solving the smaller half of the problem.
What Zero Standing Privileges Actually Requires
“Zero standing privileges” is one of those phrases that gets used loosely. In operational terms it means a privileged credential should not exist in a usable state until a specific request, for a specific target, for a bounded window, has been approved and should stop working when that window closes.
Delivering that requires five capabilities working together, not five products bolted together:
- Discovery and vaulting. You cannot govern what you have not enumerated. This includes local admin accounts on endpoints, embedded credentials in scripts, and service accounts in Active Directory that predate everyone on the current team.
- Just-in-time elevation. Rights are granted on request and revoked automatically. The default state of every account is unprivileged.
- Privileged session management. RDP, SSH, and database sessions are proxied and recorded, so post-incident investigation does not depend on endpoint logs the attacker could reach.
- Endpoint privilege management. Application-level elevation replaces standing local admin, which is where most lateral movement begins.
- Automated credential rotation. Assume some secrets are already in circulation. Rotation shrinks the window in which a stolen credential remains valuable.
Vendors have converged on this integrated model from different directions. CyberArk and Delinea have pushed from classic vaulting outward into workload identity.
CIEM platforms have added machine-identity discovery. A group of vendors including privileged access management software provider Securden built toward a single console from the start, combining vaulting, session management, endpoint privilege management, vendor access, and JIT remote access in one platform rather than as separately licensed modules.
The architectural argument for consolidation is not aesthetic. Fragmented tooling is the most commonly cited reason privileged access programs stall each product enforces policy against its own view of the estate, and the gaps between those views are where standing privilege survives.
Third-Party Access Is Now Half the Problem
One 2026 DBIR figure deserves more attention than it has received: third-party involvement in breaches reached 48%, up from 30% the previous year a 60% increase following a year in which the number had already doubled. Push Security
Most organisations still grant vendor access the same way they did a decade ago: a VPN account, a jump box, and a trust assumption.
The vendor’s technician is inside the network perimeter, authenticated once, with whatever the account permits. It is the exact pattern that ZTNA architectures were designed to replace.
The zero trust alternative routes vendor sessions through a brokered portal with no inbound ports open and no direct network path between the external party and internal resources.
The vendor reaches a gateway; the gateway proxies a specific, recorded, time-bound session to a specific target.
If the vendor is compromised as happened repeatedly across 2025 and 2026 the attacker inherits access to a portal, not to a network segment.
A Sequencing That Survives Contact With Reality
Ambitious PAM rollouts fail on scope. Narrow ones fail on relevance. A workable sequence:
Days 1–30: inventory and contain the worst of it. Discover privileged accounts across endpoints, servers, network devices, and cloud. Vault domain admin, root, and break-glass credentials. Do not attempt policy yet.
Days 31–60: remove standing local admin. Endpoint privilege management with application-level elevation. This single change materially degrades the most common lateral movement path, and it is the change users notice most so pair it with a fast approval workflow or adoption will collapse.
Days 61–90: broker the sessions that matter. Proxy and record privileged sessions to tier-0 assets and cut over third-party access to a brokered portal. Then start on service accounts, which will take longer than anyone estimates.
Two failure modes show up repeatedly in rollouts that stall. The first is discovery that runs against Active Directory only, missing local accounts on endpoints and hardcoded credentials in scheduled tasks which means the inventory looks complete while the actual attack path stays open.
The second is an approval workflow routed through a ticketing queue with a multi-hour SLA, which engineers respond to by finding a way around it. Both are process problems that no amount of product capability fixes after the fact.
Deployment model matters less than most buying committees assume cloud and on-premises editions of most mature PAM platforms now reach production readiness in weeks rather than quarters but political sponsorship matters enormously.
Removing admin rights from engineers is an organisational negotiation wearing a technical disguise.
What This Means Going Into 2027
The 2026 DBIR reports median time-to-patch rising from 32 days to 43 a 34% increase even as exploitation accelerates. Organisations are losing the patching race, which means initial access will keep happening. Tenable
That reframes what privileged access management is for. It is no longer primarily about preventing compromise.
It is about ensuring that a compromise stays small: that the attacker who lands on a workstation finds no credential that works anywhere else, no session they can hijack, and no service account with permanent rights to the database.
Ransomware appeared in 48% of breaches in the 2026 dataset, and 73% of ransomware victims had an associated infostealer or credential leak within the same year — a pattern visible across the current ransomware ecosystem.
The credential is still the hinge. Removing standing privilege is how you take the hinge off the door.
