Ask any team to list their admin accounts and you will get a number. Ask how many of those accounts are being used right now and the honest answer is almost always: nearly none. That gap — privileges that exist around the clock but are used minutes a week — is the quietest, most renewable risk in your environment.
Attackers understand this better than defenders. The modern intrusion playbook barely mentions malware: land on one endpoint, harvest a credential that already has standing access, and walk laterally through systems that treat the login as legitimate. Nothing needed to be "hacked" after the first step. The privilege was simply there, waiting.
Why the usual fixes fall short
Most organizations respond with reviews and rotation. Both help; neither addresses the actual problem.
Access reviews prune the list of who may hold privilege — quarterly, if the calendar holds. Between reviews, every approved account remains a 24/7 target. Reviews manage the roster, not the exposure window.
Password rotation shortens how long a stolen secret works, but the account behind it keeps its power continuously. Rotate a domain admin's password daily and it is still a domain admin every hour of every day.
The dimension neither touches is time. An account that holds admin rights for 8,760 hours a year, to do perhaps 40 hours of admin work, carries roughly 200× more exposure than the work requires.
The just-in-time model
Just-in-time access makes privilege an event, not a state:
- Request with context. An engineer asks for access to a specific target — a server, a database, a Kubernetes cluster — for a specific duration, with a stated reason. "prod-db, 60 minutes, incident #4821."
- Approve with context. Policy decides: low-risk requests can auto-approve; sensitive ones route to an owner, complete with who, what, why, and for how long. Approval arrives as a push notification, not a ticket that ages for a day.
- Grant, brokered. The session opens through the vault. The engineer never sees a password; there is nothing to paste into a notes file, nothing to phish later.
- Revoke by the clock. When the window closes, access ends on its own. No cleanup task, no orphaned grant, no "temporary" admin that quietly becomes permanent.
- Record everything. The session itself is recorded, so the audit trail shows not just that access happened but what was done with it.
The end state has a name: zero standing privilege. Not zero privilege — zero standing privilege. The work still happens; the standing attack surface does not.
What changes in practice
Teams that adopt JIT report the same pattern. The number that used to grow forever — standing admin accounts — starts trending toward zero. Lateral movement gets dramatically harder: a harvested credential that has no current grant opens nothing. Audits compress, because "who had access to what, when, and why" is a report, not an investigation. And engineers, after the first week of skepticism, mostly stop noticing: a 30-second approved request replaces a permission they used twice a month.
There is also a number worth putting on a dashboard: standing privileged accounts, by system, over time. It is the single clearest measure of whether your privileged-access posture is improving or just being reviewed.
Where Monofor fits
Monopam's just-in-time access implements this loop end to end: request, policy-driven approval with mobile push, vault-brokered sessions to servers, databases, and Kubernetes, automatic expiry, and session recording on every grant — with reports mapped to SOC 2, ISO 27001, and PCI-DSS evidence out of the box.
Standing privilege is a subscription to risk that renews daily, whether or not you use it. Cancel it.
Further reading: Local Admin Rights: The Quietest Risk on Every Laptop and the zero standing privilege glossary entry.
