The end of "Always-On": Architecting zero standing privilege & real-time authorization | SailPoint
Source: YouTube · SailPoint · published Oct 16, 2026 · 31:40
BLUF:
Zero standing privilege (ZSP) is no longer optional but essential for mitigating risks from AI agents and rapid attacks, requiring a shift from static access to Just-in-Time (JIT) activation that separates slow governance from fast, automated access 0:50.
Key Takeaways:
• The primary barrier to ZSP is not technology but the sheer volume of entitlements; however, AI-driven privilege classification can reduce this scope significantly, allowing organizations to prioritize high-tier access 1:20.
• Standing access is a time-based vulnerability, with 97% of privilege exposure occurring when entitlements are unused, whereas attackers can spread in as little as 30 seconds, making quarterly reviews obsolete 7:00.
• JIT architecture must separate eligibility (slow, governed) from activation (fast, automated); adding human approval to activation creates friction and defeats the purpose of rapid response 8:15.
• Break-glass accounts should be reserved strictly for platform outages, while high-severity incidents should use instant, audited JIT activation with mandatory justification and loud alerting 15:35.
• Modern JIT platforms utilize AI to generate entitlement descriptions, classify privileges, and guide users through natural language requests, reducing friction while ensuring least-privilege access 20:10.
• Auditors should be presented with JIT activation logs as superior evidence to static certifications, providing context on why access was used rather than just who has it 17:15.
Closing Statement:
Organizations must move beyond static credential management to time-boxed, just-in-time access to survive the speed of modern attacks and AI agent misuse. By implementing JIT for high-risk entitlements and leveraging AI for classification and remediation, security teams can make being wrong survivable and reduce the attack surface effectively 31:10.
Sources:
- 0:50 Introduction to the changing threat landscape and the necessity of zero standing privilege.
- 1:20 The challenge of managing hundreds of thousands of entitlements manually.
- 7:00 Analysis of standing access waste and the speed of modern cyber attacks.
- 8:15 Distinguishing between slow governance (eligibility) and fast access (activation).
- 15:35 Clarifying the role of break-glass accounts versus instant JIT access.
- 20:10 Demonstration of AI-assisted entitlement classification and JIT activation workflows.
- 31:10 Final recap on making security mistakes survivable through zero standing privilege.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Let's do it. >> Let's do it. Good afternoon everyone. Thank you for being here. We're super excited. I'm here with Alex Dunker. I'm Lori Robinson. We are going to be talking about just in time and zero standing privilege. Alex is going to continue a conversation he started last year at Navigate and I'm going to follow up with a little demo. But with that, I'm going to hand it over to my friend Alex. >> Thank you very much. Uh, thanks Lori. My name is Alex Dunker. I'm an identity architect over at NVIDIA. We heard a lot this morning about how the threat perspective is changing. I'll try to make that maybe a little bit more concrete in a few minutes. Um, but we'll probably acknowledge what we all already know in the room. Zero standing privilege is a good idea. But why are very few, if any, …