As we see it, Gartner has made time-bound privilege a core requirement of privileged access management. Just-in-time (JIT) provisioning, the ability to generate time-bound credentials in place of standing privileges, is now a mandatory capability. And, PAM must now broker temporary privileged access for machines, including AI agents.
This is a very natural evolution as frontier AI changes the attack surface. Identity weaknesses played a material role in almost 90% of the incidents investigated by Unit 42, our threat intelligence, incident response, and security consulting arm. Our frontier AI research found that nearly every AI model evaluated could find real vulnerabilities.
Our Key Takeaways: What's New in the 2026 Gartner Critical Capabilities for PAM
- JIT provisioning with time-bound credentials is now mandatory.
- PAM vendors must secure AI agent identities.
- Gartner evaluates four use cases: Privileged Account and Session Management (PASM), Privilege Elevation and Delegation Management (PEDM), Remote Privileged Access Management (RPAM), and PAM for Machines.
- Account discovery and threat detection carry more weight in PAM for Machines scoring.
- Gartner highlights “the rapid adoption of Model Context Protocol (MCP) has driven a major market transition, with a few PAM vendors introducing native MCP gateways to prevent unauthorized AI agent operations on sensitive enterprise targets without disrupting agentic automation.”1
Patching alone can't keep pace. A traditional patch still takes an industry average of 55 days to deploy. Identity is the fundamental control that keeps the business running and productive, and the last line of defense after an adversary gains initial access. As Amy Blackshaw wrote in You Do Not Have Three Years, identity security controls “how much privilege any identity holds, how long it lasts, and how quickly it can be revoked.”
In this post, we’ll detail the four key use cases highlighted in the new 2026 Gartner Critical Capabilities for Privileged Access Management report, and our approach with the Idira Identity Security platform from Palo Alto Networks.
Privileged Account and Session Management: Vaulting and Zero Standing Privileges, Together
Every enterprise has built-in, always-on accounts. Those accounts need a vault. Domain and local administrators, root and break-glass accounts, service accounts wired into legacy applications, network devices, and database administrators remain top targets for attackers. Yet these built-in accounts and credentials can’t be configured for ephemeral access without breaking something. As we see it, Gartner names securing these accounts as "the foundational use case in PAM."2
Gartner now recommends prioritizing "platforms that enforce zero standing privileges (ZSP) using JIT access, where ephemeral credentials or roles are created dynamically for the exact duration of a task and immediately destroyed upon completion."3 Our 2026 Identity Security Landscape found that, on average, only 39% of privileged access is managed through JIT or ZSP.
What Gartner evaluates: “account vaulting, check-out/in, session management, privilege task automation, credential rotation and JIT PAM approaches.”4
Gartner now recommends prioritizing "platforms that enforce ZSP using JIT access, where ephemeral credentials or roles are created dynamically for the exact duration of a task and immediately destroyed upon completion."
Idira manages both standing and ephemeral privileged access from one platform. For built-in accounts, Idira vaults the credential, rotates it, updates the accounts and services that depend on it, and isolates and records each session. For everything else, Idira grants ZSP: ephemeral users for infrastructure, short-lived certificates for Secure Shell (SSH), and time-bound, ephemeral roles for cloud access. Administrators keep their own RDP and SSH clients and command-line tools. Adopting zero standing privileges doesn't change how they work.
Our work on ZSP for managed Kubernetes shows where this goes next. Developers, CI/CD pipelines, and AI agents get cluster access for the task across Amazon EKS, Azure AKS, and Google GKE, without static keys or permanent roles.
Privilege Elevation and Delegation Management: Least Privilege on the Agentic Endpoint
AI agents on employee laptops now run with their user's privileges.
What Gartner evaluates: elevation and delegation on Windows, UNIX/Linux and macOS, scored on functions such as “privilege elevation, application controls, allow/deny/isolate and sandboxing.”5
Those capabilities are even more important in the age of agentic coding tools on employee workstations, as these desktop applications are often permitted by users to perform highly privileged tasks without explicit approval. Examples include installing packages, running scripts, and calling tools. Each command can look legitimate on its own, so detection tuned for malicious files sees routine activity.
Least privilege still bounds the damage. Endpoint Privilege Manager removes standing local administrator rights and grants elevation by policy, from one cloud console for Windows, macOS, and Linux. An agent inherits only what its user is allowed to do.
Remote Privileged Access Management: One Target, One Task, Nothing Left Open
A vendor or contractor should get one target for one task, and lose it when the task ends.
What Gartner evaluates: “a secure VPNless approach for performing remote privileged tasks”, including “session brokering and time-bound, session-specific JIT access.”5
Gartner research calls third-party and remote access "significant risk vectors."6 A VPN grants a network and trusts whatever happens next. Idira's remote access is clientless and VPN-less, with ZSP to the target, so third parties work under the same controls and recording as employees.
For Palo Alto Networks customers, more of that path runs through the browser. Secure Web Sessions now works in Prisma Browser, bringing session recording and in-session data controls to privileged web access.
PAM for Machines: Software is a Privileged User
Machine identities and AI agents already reach sensitive data. In 2026, the definition of PAM itself names AI agents among those machines, and Gartner gave account discovery and threat detection more weight in how this use case is scored. In the same Identity Security Landscape research, respondents said 40% of their AI agents and 40% of their machine identities already have access to organizational data.
What Gartner evaluates: “securing the growing population of accounts and privileged entitlements used by software and workloads,” through secrets management and cloud infrastructure entitlement management (CIEM).7
Idira machine identity security offers native support for Secure Production Identity Framework for Everyone SPIFFE to give workloads short-lived, verifiable identities in place of stored keys. Secrets Hub gives one view of the secrets already sitting across AWS, Azure, and Google Cloud and keeps them in sync with the vault, without moving them. Idira Secure AI Agents gives each registered agent its own identity, limits which tools on an MCP server each agent can run, and routes every tool call through a broker for policy and audit, without exposing credentials to the agent. In October, Idira became generally available as the agent identity provider for the Prisma AIRS AI Agent Gateway.
Detection and Response Close the Loop
Least privilege limits how far an attacker can go. Detection and response stop the active attack. 2026 Gartner research finds that AI in PAM "has progressed from passive analytics to active conversational interfaces,"8 with leading vendors using LLM summaries to analyze session recordings for anomalous behavior. In Idira, AI reads active window titles in RDP sessions to flag suspicious behavior. Threat detection and response can end an SSH session the moment someone runs a high-risk command. Each privileged command becomes its own audit event, tied to the session and the user behind it.
Detection needs to integrate with your security operations workflows. Certified integrations send Idira audit, endpoint, and privileged-threat events to Cortex XSIAM and other security information and event management (SIEM) platforms. Idira Marketplace, part of our Palo Alto Networks technology partner program, has more than 500 partners: explore our partner directory here.
Where PAM Goes Next: Every AI Agent Gets a Broker
We expect brokering agent access to become as standard as recording human admin activity. Gartner notes: "The rapid adoption of MCP has driven a major market transition, with a few PAM vendors introducing native MCP gateways to prevent unauthorized AI agent operations on sensitive enterprise targets without disrupting agentic automation."9
AI agent brokers answer the question auditors are increasingly asking: which agent did this, on whose behalf, with what access, and what controls are in place?
5-Minute Demo: See an AI agent work through the Idira identity broker.
Standards for agent identity are being actively shaped across the Open Worldwide Application Security Project, the Coalition for Secure AI, the OpenID Foundation, the Internet Engineering Task Force (IETF) and the National Institute of Standards and Technology (NIST). They point towards the same fundamentals: agent identity you can verify, short-lived credentials, and authority that narrows as one agent delegates to another.
The same defense-in-depth controls and principles that are essential for securing human and machine identities are essential to securing AI agents. Organizations should pursue strict authentication, ephemeral access with ZSP, and brokering to control an agent’s actions with the ability to rapidly respond.
Get your complimentary copy of the full 2026 Gartner® Critical Capabilities for Privileged Access Management Report here.
Want to see these capabilities in action?
Join Eric Sun and Vlaho Djurkovic for Identity Security in the Frontier Era—Why Idira? This practical session shows how Idira discovers, controls, and governs human, machine, and AI agent identities with ZSP and JIT access. The live demo covers Idira Modern PAM and Secure AI Agents. Save your spot.
FAQs
What are the four core use cases in the 2026 Gartner Critical Capabilities for PAM?
The 2026 report evaluates solutions across four primary use cases: Privileged Account and Session Management (PASM), Privilege Elevation and Delegation Management (PEDM), Remote Privileged Access Management, and PAM for Machines (software and workloads, now including AI agents).
How do Zero Standing Privileges (ZSP) and credential vaulting work together?
Vaulting secures built-in, always-on accounts, such as domain administrator, root, and break-glass accounts, by storing and rotating their credentials and recording each session. Everywhere else, zero standing privileges replace always-on access with time-bound access, granted through just-in-time (JIT) workflows and revoked when the task ends. Gartner recommends prioritizing platforms that enforce ZSP, and calls PASM, where vaulting lives, “the foundational use case in PAM.”
Why does modern PAM include Model Context Protocol (MCP) and AI agents?
Autonomous AI agents running on endpoints or servers execute code, call APIs, and access internal databases on behalf of users. In our understanding, the 2026 Gartner PAM definition names AI agents among the machines PAM must broker. PAM solutions can use brokers to authenticate agent identities, restrict accessible tool endpoints, and record actions without exposing raw credentials.
Why is VPN-less access preferred for remote privileged management?
Traditional VPNs grant broad network-level visibility and lateral access. VPN-less remote PAM uses reverse proxies and session brokering to grant isolated, audited access strictly to a single target for a specific task, closing standing access pathways once disconnected.
Gartner, Critical Capabilities for Privileged Access Management, Shubham Gera, Paul Mezzera, Scott Brinker, 21 October 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates. Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.