Matilda Bailey stands at the forefront of networking and next-gen security solutions, bringing years of expertise in how modern wireless and cellular technologies intersect with robust defense frameworks. As organizations grapple with the complexities of the AI era, her insights into identity and access management have become essential for leaders looking to harden their perimeters against increasingly sophisticated threats. Today, she joins us to discuss the evolution of privileged identity management and why the era of permanent, standing access is officially over.
Our conversation traverses the landscape of modern security breaches, focusing on how privileged identity management acts as a shield against credential misuse and the pervasive threat of lateral movement. We examine the functional mechanics of discovering effective privileges across diverse environments, the challenges of balancing security with operational friction, and the strategic integration of time-bound access within a broader zero-trust architecture. Matilda clarifies the nuances between managing eligibility and overseeing active sessions, offering a roadmap for implementing a defense-in-depth strategy that remains resilient in the face of evolving vulnerabilities.
Credential misuse and lateral movement are primary drivers in modern security breaches. How do you identify which accounts and pathways are most vulnerable within a complex network?
Identifying vulnerabilities starts with a comprehensive discovery phase where we look for every privileged user, role, and service account hidden in the architecture. We have to map out not just the obvious domain admins, but also the API keys, SSH keys, and cloud subscription owners that often go unmonitored in the shadows of a hybrid environment. By looking at “effective privilege,” we calculate the total sum of assets an entity can access, which often reveals dangerous levels of access granted through nested groups that admins might have forgotten about. This is a high-stakes game of visibility because hackers rely on these overlooked accounts to move through the network. When we see that lateral movement is a factor in a staggering 87% of all breaches according to the Global Incidents Response Report 2026, it highlights that the most vulnerable pathways are usually those using standard administrative tools like PowerShell or remote desktop protocol.
Transitioning from standing access to just-in-time privileged identity management sounds like a massive shift. Can you walk us through the mechanics of how an organization verifies and authorizes a user under this new model?
The shift involves moving away from the “always-on” privilege model and toward a system where users are merely “eligible” for access rather than possessing it permanently. When an administrator needs to perform a specific task, they must log into a dedicated console to request the initiation of their role, which kicks off a rigorous validation process. This isn’t just a simple password check; the system evaluates a range of risk signals, including device compliance, the user’s network location, and the necessity of multi-factor authentication. In many cases, a manager must manually approve the request before the temporary window of access even opens. Once the task is finished or the time limit expires, the permissions vanish automatically, ensuring that there is no lingering digital doorway left open for an attacker to exploit later.
The data suggests that credential theft is the root cause of 32% of all breaches. How does implementing a PIM strategy specifically neutralize the threat of stolen passwords?
A robust PIM strategy essentially makes a stolen password far less valuable to a threat actor by stripping away its permanent power. If a hacker manages to swipe a set of credentials, they typically find themselves trapped in a “least privilege” environment where that account has no standing rights to sensitive systems. Because PIM requires a fresh request and validation for every privileged action, the thief would still have to pass multi-factor authentication and meet specific policy requirements that they likely cannot fulfill. We are seeing that this approach significantly hampers the “X-Force Threat Intelligence Index 2026” findings regarding the 32% of breaches rooted in credential misuse. By ensuring that access is time-bound and sanctioned only for specific tasks, we reduce the window of opportunity for a hacker from days or weeks down to just a few minutes of heavily audited activity.
While security is the priority, many IT teams worry about the “friction” and complexity that these tools introduce. What are the practical challenges and operational costs organizations should prepare for?
There is no denying that moving to a zero-trust framework creates a certain level of operational tension, particularly for the administrators who now have to wait for approvals or deal with session timeouts. Adopting these tools can be both expensive and technically complex, especially when you are trying to bridge the gap between legacy on-premises databases and modern cloud environments. We often see a “friction” point where the speed of business operations feels like it is clashing with the slow, deliberate nature of gated access. Furthermore, there is a psychological risk of overconfidence; if a team secures the most obvious pathways but leaves a minor service account under-secured, they might feel safer than they actually are. It requires a cultural shift to accept that these extra steps are the necessary price for preventing the catastrophic costs of a full-scale network compromise.
For a CISO trying to organize their defense, how do you define the boundary between Privileged Identity Management (PIM) and Privileged Access Management (PAM)?
It is a common point of confusion, but I like to think of PIM as the “eligibility and elevation” layer while PAM is the “governance and execution” layer. PIM is the gatekeeper that decides if you are allowed to ask for access; for instance, it determines if an individual is eligible to be a database admin for a specific 45-minute window on a Tuesday. Once that person is inside the system, PAM takes over to monitor exactly what they are doing, recording the session and managing the rotation of the credentials they are using. PIM focuses on the “who” and the “when” of the privilege, making sure no one has more access than they need for a second longer than necessary. PAM, on the other hand, provides the hardened vault and the audit trail for the actual keys and secrets being utilized during that sanctioned window.
If an organization wants to move beyond the basics, what advanced techniques like session brokering or key vaulting should they be looking into?
To truly mature a security posture, organizations should implement session brokering, which acts as an intermediate system that secures the connection between the user and the target resource. This means the user never actually “touches” the target directly; instead, the connection is funneled through a secure portal or bastion host that logs every single action. We also recommend moving all sensitive keys and passwords into a hardened vault where they are not only stored but also automatically rotated. This automation is vital for service accounts, where PIM can manage the purpose, ownership, and credential scope without human intervention. By integrating these events with SIEM and SOAR tools, the security team can receive real-time alerts if the system detects an anomalous elevation pattern, allowing for an almost instantaneous response to potential threats.
What is your forecast for the future of identity security in the next few years?
I believe we are heading toward a landscape where “standing privileges” will be viewed as a massive liability, much like leaving the front door of a bank unlocked at night. As automation and AI-driven attacks become more prevalent, the speed of response will need to be handled by systems that can validate identity in milliseconds based on thousands of behavioral data points. We will see a tighter integration between network-level security and identity-level security, where the network itself “shrinks” or “expands” around a user based on their real-time authorization status. Organizations that fail to adopt these granular, time-bound controls will find themselves increasingly unable to defend against the rapid lateral movement that characterizes modern cyber warfare. Ultimately, identity will become the only true perimeter left in the digital world.
