Why Just-in-Time Access and Zero Standing Privilege Are Critical for Multi-Cloud Security

In this Expert Insights interview, Ketan Kapadia, Field CTO at Britive, sheds light on enterprise security, identity sprawl across a multicloud environment, and balancing productivity and security.  

Kapadia brings more than two decades of identity security leadership, having founded identity-focused firms acquired by larger players, led advisory services at Cyderes and Herjavec Group, and served as chief architect at Aveksa (acquired by EMC/RSA).

Overprivileged service accounts and non-human identities are an easy entry point for attackers. He believes in rethinking privileges for nonhuman identities using just-in-time access.

Read about overlooked multi-cloud identity risks, rethinking privileges, and enhancing productivity with security in just-in-time access models.

Vishwa: Cloud identity attacks are growing more sophisticated, particularly for enterprises operating across AWS, Azure, GCP, and SaaS platforms. From your perspective, what are the most overlooked identity-related risks organizations face in multi-cloud environments today?

Ketan: This is a common question that keeps surfacing in security reviews and boardrooms that I have been part of. When enterprises span across AWS, Azure, GCP, Oracle Cloud, and dozens of SaaS platforms, they often assume that their “cloud provider IAM” settings are enough, or the controls they have in place today for on-prem will suffice.

The reality is that a separate category of identity risk frequently goes unaddressed:

• Overprivileged service accounts and non-human identities (NHIs):
  • Most organizations focus on users, but it's their bots, scripts, agents, and automated workloads that hold long-lived credentials. These often run with excessive privileges and no clear ownership, making them an easy entry point for attackers.
• Static credentials and keys baked into configs:
  • Developers frequently store access keys in code repositories, containers, or CI/CD pipelines. When these credentials and access keys are leaked, attackers gain persistent access, often invisible to traditional perimeter defenses.
• Lack of real-time access control:
  • Organizations granting always-on or standing access to sensitive resources to humans, non-humans, and agents in a multi-cloud world are a breach multiplier. Just-in-time, ephemeral, and policy-driven access is rarely enforced but is critical to contain the blast radius.
• Weak governance of SaaS-to-SaaS and cloud-to-cloud connections:
  • OAuth grants, app integrations, and delegated permissions often go unchecked. A compromised integration can be as devastating as a stolen root credential.

The future of identity is more than “who.” It’s managing the “what, when, and how” that determines your risk exposure. 

Organizations that are getting this right are moving toward ephemeral, runtime authorization and policy-driven for all identities: human, non-human, and agentic AI.

Vishwa: Many enterprises in sectors like finance, healthcare, and technology are adopting multi-cloud strategies. Britive emphasizes Zero Standing Privilege as a way to secure access in these environments. How does this model change the traditional approach to privileged access? What challenges do these enterprises face when adopting it?

Ketan: Traditional privileged access management does not eliminate risk; it tries to manage it. It does this by relying on standing accounts like administrator IDs, service accounts, and static access keys that sit exposed, whether they are used or not. 

That permanence creates a massive attack surface because privileged accounts and permissions remain active even when they are not in use, providing constant opportunities for malicious actors to exploit and escalate access. Zero Standing Privilege (ZSP) changes that equation entirely. 

Instead of leaving privileges “always on”, access is provisioned just-in-time, scoped to the task, and automatically revoked when it is no longer needed. It eliminates the very concept of “always on standing privileges” and gives organizations runtime authorization control they never had before.

The common hurdles to adopting Zero Standing Privilege are less about technology and more about change management. Culturally, administrators and engineers are accustomed to permanent privilege, and shifting to time-bound access requires a mindset change. 

From a productivity standpoint, teams need assurance that just-in-time access will not slow down critical work or create unnecessary friction. And from a compliance perspective, governance processes must evolve from static account and permissions inventories to monitoring dynamic access events. 

Together, these changes demand education, alignment, and trust across the enterprise, which can be easily addressed as part of effective execution with organizational change management involved from day one of the initiative.

Vishwa: As more organizations automate infrastructure with DevOps and CI/CD, how should security leaders approach identity and access control without slowing developer velocity?

Ketan: Security is too often seen as a brake on progress, but the real shift comes when we stop treating it as a trade-off with velocity. The truth is, when security and speed are designed to work together, security becomes a driver of innovation rather than a barrier.

In DevOps and CI/CD environments, access must be rapid and seamless, yet permanent credentials and static secrets remain one of the biggest liabilities. The better path is to make access ephemeral, runtime-authorized, policy-driven, and automated into the pipeline itself.

With this model, developers and workloads get exactly the permissions they need, only when they need them, and those permissions disappear as soon as the task is complete. This model enforces no secrets hard-coded into configs, no credentials lingering in pipelines, with access issued on demand and expires by default.

The outcome is frictionless delivery, with security working quietly in the background and accelerating progress. Instead of holding teams back, security becomes the engine that drives them forward while keeping everything protected and reducing organizational risk.

Vishwa: Identity sprawl — when identities multiply across multiple clouds and SaaS platforms — is a growing concern in large enterprises. What practical steps can companies take to gain visibility and control across multiple clouds and SaaS platforms?

Ketan: The first step is recognizing that every Cloud and SaaS platform has its own identity model, and managing them in silos only fuels sprawl. Organizations need a unified layer of visibility across environments, beginning with the discovery of every identity (human, non-human identity, agentic) and associated permissions.

Once visibility is established, the focus shifts to governance. Instead of manually reviewing static access permissions across dozens of systems, the future lies in reviewing the profiles and policies that govern ephemeral access. This simplifies the attestation process by ensuring privileges are granted dynamically, only when needed, and revoked immediately afterward.

Real control comes when just-in-time and ephemeral access become the default, and every action is captured through continuous monitoring and centralized logging. This not only shrinks the attack surface but also turns compliance reporting into a simpler, more reliable process.

Vishwa: With AI agents increasingly performing automated tasks, do you see a need to rethink how privileges are granted to non-human identities?

Ketan: Absolutely, because traditional models were built for humans, not autonomous agents. Most non-human identities, whether they are bots or AI agents, rely on static credentials that are long-lived and broadly privileged. That creates an enormous risk, since these agents do not wait for instructions; they act continuously and at machine speed.

The shift needs to be toward granting privileges the same way we now secure human access i.e., ephemeral, just-in-time, runtime authorization, and tightly scoped to the task at hand. Instead of hard-coding API keys or standing permissions, AI agents should receive the same kind of dynamic credentials that expire automatically, with policies that enforce least privilege in real time.

The ZSP model for AI agents not only limits the blast radius if an agent is compromised, but it also gives organizations an auditable record of every action taken. 

As AI agents operate with greater independence, the ability to control and monitor what, when, and how they access becomes just as important as knowing who they are.

Vishwa: From a leadership perspective, how should CISOs and IT leaders balance productivity and security when implementing just-in-time access models? 

Ketan: The key is to stop treating productivity and security as competing goals. Just-in-time ephemeral access, when implemented well, strengthens security while improving the user experience. 

Leaders should frame it not as restricting access, but as modernizing how access is delivered, i.e., privileges are granted only when needed, removed immediately afterward, and governed by clear policies. 

With the right policies, visibility, and communication, just-in-time access becomes both a productivity enabler and a security multiplier.

Vishwa: Finally, on a practical note, could you recommend a few cybersecurity tools or apps, both for beginners and seasoned professionals, that you find especially valuable?

Ketan: The shift toward Just-in-Time access and Zero Standing Privilege is reshaping identity security. Open source and free tools provide a hands-on way to understand these concepts and why they matter. 

For awareness and learning, especially for beginners, the OWASP Juice Shop and the PortSwigger Web Security Academy are excellent resources. 

For professionals, here are a few resources for experimentation and potential hands-on practice: Open Policy Agent (OPA), Kyverno, SPIFFE/SPIRE, Istio, Consul (HashiCorp), and GCP Workload Identity Federation.