CyberArk research finds that 99 percent of enterprises lack zero trust just-in-time access, a figure that reframes a well-worn architectural ambition as a near-universal operational gap. Just-in-time (JIT) access is the mechanism that makes zero trust meaningful for privileged users: rights are granted for a bounded window, scoped to a task, and withdrawn automatically. If almost no organisations have it, then most zero trust programmes are still perimeter exercises with new vocabulary.
The reasons for the gap are practical rather than philosophical. JIT access requires tight coupling between the identity provider, the privileged access platform and the systems being reached. It requires a policy model granular enough to describe tasks without overwhelming administrators, and approval workflows fast enough that engineers do not route around them. It also requires that standing entitlements be reduced, which is politically uncomfortable because standing privilege is frequently how operational teams guarantee their own availability during incidents.
There is a measurement problem underneath the headline. Many organisations believe they have JIT because one platform supports ephemeral elevation for a subset of accounts, usually administrators on servers. In practice, the population that matters extends much further: service accounts with interactive logon rights, database accounts used by application support, cloud roles with broad trust policies, and the growing set of non-human identities that authenticate without a human in the loop. The research points at the same underlying weakness that privileged account security programmes have struggled with for a decade, which is the difference between controlling accounts and controlling access.
The consequence is that session management becomes the compensating control most organisations actually rely on. If rights cannot be made ephemeral, they must at least be observed, recorded and reviewable. That is a reasonable intermediate state, but it is not zero trust, and treating it as such stalls the harder work of entitlement reduction.
A workable path starts with measurement rather than tooling. Enumerate standing administrative privilege across servers, databases and cloud platforms, then identify which entitlements were used at all in the past ninety days. In most estates a minority of standing rights account for the majority of actual usage, and those can be converted to brokered access first. Service and machine identities come next, since they are the accounts least likely to have JIT controls and most likely to hold persistent high privilege.
Policy design matters as much as coverage. JIT that requires a twenty-minute approval for routine maintenance will be defeated by an emergency exception process within a month. Scoped, pre-approved request templates for common tasks, combined with genuine approval for exceptional elevation, tend to survive contact with operations. Logging and alerting should focus on the elevation event itself, because that is where an attacker with a valid identity is most likely to reveal intent.
The 99 percent figure is uncomfortable but useful. It sets a benchmark that most organisations can improve against quickly, and it confirms that the next phase of PAM maturity is measured in the duration of privilege rather than the size of the vault.