PAM 
Keeper Privileged Cloud delivers Zero Standing Privilege (ZSP) by extending KeeperPAM®'s Just-In-Time (JIT) access framework to cloud identity platforms. A user gets elevated permissions only after
3 min read
Published on September 02, 2026
You can reduce your cloud attack surface by auditing every persistent permission across your cloud and identity platforms, stripping away unnecessary access and replacing always-on admin rights with Just-In-Time (JIT) access that’s granted on approval, time-limited and automatically revoked.
Getting there starts with understanding why standing privilege makes up such a significant portion of the cloud attack surface. Staying there takes the right platform to enforce the fix across every cloud and identity you run.
Why standing privileges are your biggest cloud attack surface
Your cloud attack surface is the full set of ways an attacker could get into or act within your environment: every account, credential, permission and integration that touches it. On premises, much of that is network-shaped. In the cloud, it’s identity-shaped. A user, a service account or a connected app with valid credentials and the right permissions doesn’t need to breach a firewall because it’s already inside.
Standing privileges build up quietly. Roles change, projects end and people leave, but the access tends to stay. Over time, that shows up as a few predictable problems:
- Permission creep: Permissions accumulate as roles change and old access requests go unrevoked, leaving accounts with far more than they need.
- Zombie admins: Accounts left active after someone is offboarded or moves roles, still holding privileged access that nobody is watching.
- Shadow admins: Accounts with effective control that don’t look privileged in your directory groups, so standard reviews miss them.
- Machine and Non-Human Identities (NHIs): Service accounts, API keys and workload identities now outnumber human users, and most carry standing permissions of their own.
Each of these is a target. An attacker only needs one compromised credential to get a foothold, and standing privilege is what lets them go further. A single overpermissioned account opens the door to lateral movement and privilege escalation across your environment.
How to eliminate standing privileges
Here’s what to do to start eliminating standing privileges:
- Discover and audit privileged access: Inventory every privileged path across AWS, Entra ID, GCP, Okta and Active Directory, covering human users, service accounts and third-party integrations.
- Enforce least privilege: Strip away unused and excessive permissions, clean up orphaned and zombie accounts, and surface shadow admins who don’t show up in directory groups.
- Replace standing admin rights with JIT access: Stop leaving admin rights permanently assigned. Grant privilege on request instead: approved, scoped to a set time window and revoked automatically when the window ends.
- Target Zero Standing Privilege (ZSP): Least privilege minimizes what each account holds. Zero standing privilege goes further by removing standing access altogether, so no identity retains permanent privileged access and elevation exists only during an approved window.
- Vault the exceptions: Some credentials still need to exist, like master keys, root accounts and other break-glass access. ZSP doesn’t replace vaulting, so keep those in a vault under strict controls.
- Make it continuous: Run recurring access reviews and log every elevation so permission creep doesn’t quietly come back.
Something to keep in mind is that standing privilege you clear out of AWS doesn’t help if it’s still sitting in Entra ID or Okta. Enforcement has to cover every cloud and federated identity you run because the gaps you leave become the attack surface you didn’t reduce.
How Keeper Privileged Cloud reduces your cloud attack surface
Keeper Privileged Cloud handles JIT, replacing standing admin rights with elevation granted on request and automatically revoked. It extends KeeperPAM’s just-in-time framework to AWS IAM, Microsoft Entra ID, GCP, Okta and Active Directory, plus any application that federates through them.
Privilege is granted only after approval, for a set duration and removed automatically when the window closes. That’s zero standing privilege in practice: access is approval-based, time-bound and fully auditable, enforced the same way across cloud and federated identity from a single platform.
Shrink your cloud attack surface for good
Few controls reduce your cloud attack surface as much as removing standing privilege, because it removes the always-on access attackers rely on. Keeping it gone is the harder part, and it comes down to ongoing access reviews and automated, time-bound elevation that stop permission creep from rebuilding what you cleared.
To put this in place across every cloud and directory platform you run, start a free trial of KeeperPAM.
Frequently asked questions
What is a cloud attack surface?
A cloud attack surface is the full set of points where an attacker could gain access to or act within your cloud environment: user accounts, service accounts, credentials, permissions, APIs and connected third-party apps.
How do standing privileges increase the attack surface?
Standing privileges are permissions that stay assigned even when no one is using them, and each one is a permanent target. If the credentials are compromised, the attacker inherits that access and can use it for lateral movement and privilege escalation.
What is the difference between least privilege and zero standing privilege?
Least privilege means giving each identity only the access it needs to do its job. Zero standing privilege goes further; it removes permanent privileged access altogether and grants elevation only during an approved, time-limited window. Least privilege minimizes standing access, while zero standing privilege eliminates it.
What is permission creep?
Permission creep, also called privilege creep, is the gradual buildup of access an identity gathers over time as roles change, projects start and old permissions go unrevoked. It’s how accounts end up far more privileged than their current job requires.
How does Keeper help eliminate standing privileges?
Keeper Privileged Cloud replaces standing admin rights with approval-based, time-bound elevation across AWS IAM, Entra ID, GCP, Okta and Active Directory, plus the apps that federate through them. Access is granted on request, scoped to a set window and removed automatically, so no permanent privileged access remains. For the full request-and-approval workflow, see how Keeper Privileged Cloud delivers zero standing privilege.
