The Bastion Host Bill Nobody Sends to Finance

My colleague John Martinez wrote about what a bastion host actually costs an engineering team at 2 a.m., the jump box nobody fully understands, the failover that's never tested, the credential glue code somebody has to babysit forever. If you want that version, the practitioner's version, go read it here first: https://www.strongdm.com/blog/the-bastion-host-was-a-good-idea-in-2010.

This is the other half of the story, the part that lands on desks that never touch a terminal.

Where the Costs Hide

Start with procurement, because bastion access almost never shows up as its own line item. It's buried inside other budgets instead: the monitoring tool you bought to watch the jump box, the extra headcount hours going into patching and key rotation, the incident response retainer that gets used way more than anyone planned for. Add all that up across every cloud account, every team that quietly built its own version of the same setup, and you've got a total cost that nobody's ever actually added up in one place, because nobody had to.

The Deal That Stalls Out

Then there's the deal that stalls out. Enterprise prospects and their security teams ask pointed questions during procurement now: who has privileged access, how's it recorded, can you pull up an audit trail for one specific session from six months ago? “We route everyone through a shared jump host and eyeball the logs” is not the answer that gets a deal signed on schedule. It's the answer that gets your security questionnaire bounced back with follow-ups, and a sales cycle that quietly slides a quarter.

Insurance and M&A Are Asking Too

The same gap shows up again at renewal time, just with a different crowd asking. Cyber insurance underwriters want specifics on privileged access controls before they'll write or renew a policy, and a vague answer turns into a higher premium or a narrower one. And if you've ever sat through an acquisition, either side of the table, you already know privileged access hygiene made the diligence checklist, and a shaky answer there can move a valuation, not just a score on somebody's spreadsheet.

The One-Engineer Problem

There's a people cost too, and it's bigger than one engineer missing a flight. It's what it takes to replace them. Whoever understands why the bastion's configured the way it is has built that knowledge over years, mostly informally and mostly undocumented. Getting someone new up to that same level of trust takes months, and the whole time, the business is carrying risk that never made it onto anybody's risk register.

None of this means the security team got something wrong. This cost structure grew up around a decision that made sense at the time; it's just spread out now, across budgets, sales cycles, insurance renewals, and hiring plans, in ways most of the people footing the bill never see connected.

The Just-in-Time Alternative

This is where moving to just-in-time, least-privilege access actually changes the math. StrongDM plugs into what you've already built, whether AWS Secrets Manager, Delinea Secret Server, or whatever your team standardized on, and turns that shared hop into access that's granted per session, tied to a real identity, and closed the second the work's done. Nothing to rip out or migrate off of first. No standing access sitting around waiting for an auditor or an insurer to ask an uncomfortable question, and no tribal knowledge stuck in one person's head, because the policy lives in the platform instead of someone's memory. The next deal, the next audit, the next renewal, all get a little easier to answer, because the record's already there.