CyberNest Access · JIT privileged access
Production access that expires on its own.
Engineers and contractors request access to a specific SSH host, database or Kubernetes cluster. A reviewer approves it from Slack, email or their phone. The grant closes after the time you set, and every session is recorded for replay.
14-day trial · Unlimited users on every plan · Billed per protected resource
Access request · REQ-2291
prod-orders-pg (Postgres 16)
Reason: investigate failed payment webhooks after the 14:20 deploy.
No standing credentials. Every grant has an owner, a reason and an end time.
Request queue
Reviewers see what is being asked for, how long, and why.
- Requests
- Resources
- Sessions
- Policies
Requests
Today
Open and recent requests
| Resource | Duration | Status |
|---|---|---|
| prod-orders-pg Postgres · read_only | 60 min | Pending |
| eks-prod-us-east Kubernetes · view | 2 h | Active |
| bastion-api-03 SSH · ubuntu | 30 min | Active |
| analytics-mongo MongoDB · readWrite | 4 h | Denied |
| prod-billing-mysql MySQL · read_only | 60 min | Expired |
Connect with the CLI you already use
$ cybernest ssh bastion-api-03Grant REQ-2287 approvedShort-lived cert issued, expires 15:42Recording session to vaultubuntu@bastion-api-03:~$
Grants close automatically
- Active grants
- 7
- Avg 48 min
- Expired today
- 23
- No manual cleanup
Sessions you can replay
- REQ-2291 connected to prod-orders-pg 14:31
- ran 14 queries, 0 writes 14:31 to 14:58
- grant expired, session closed 15:31
Outbound-only connectors
The connector runs inside your VPC or data center and dials out. No inbound ports, no public IPs on your databases.
Your identity provider decides who can ask
Sign-in and group sync through Okta, Microsoft Entra ID, Google Workspace or JumpCloud via SAML, OIDC and SCIM.
From install to first approved request in one afternoon
Most teams start with one database and one cluster, then add hosts as they retire shared keys.
- 01
Deploy a connector
Run it as a Docker container or Linux package next to your resources in AWS, Azure, Google Cloud or on-prem.
- 02
Connect your identity provider
Map IdP groups to requester and reviewer roles. Offboarding in the IdP revokes access here.
- 03
Define resources and rules
Register hosts, databases and clusters. Set who approves, the default duration and the maximum.
- 04
Engineers request access
From the CLI or web console. Approved grants issue short-lived credentials and start recording.
How we handle your traffic, recordings and data
- Encrypted tunnels
- Client-to-connector traffic runs over WireGuard. Tunnel keys rotate every 24 hours.
- Short-lived credentials
- SSH certificates and database credentials are minted per grant and are invalid once it ends.
- Least privilege by default
- New resources start with no access. Each grant covers one resource and one role.
- Recordings stay yours
- Recordings are encrypted at rest. Export sessions as asciinema v2 files and the audit log as JSON or CSV at any time.
- Deletion on request
- Close your account and we delete recordings and logs within 30 days, with written confirmation.
- People who answer
- Email support replies within one business day; Scale plans within four business hours.
Retire the shared prod key this month
Tell us how many hosts, databases and clusters you run and which IdP you use. We will set up a trial workspace with you.