Mainframe Security
The Key Inventory Is the JCL
By SDS • 4 min read • October 2026
There is a specific conversation that happens on almost every mainframe security review, and it goes roughly the same way every time.
Someone asks how many SSH keys exist on the z/OS systems. There is a pause. Then somebody says they could probably work it out, and names a few places to look. The authorized-key files. The automation accounts. That thing the ETL team set up. Probably the vendor connection from the migration.
Nobody is being evasive. The answer genuinely does not exist in one place, because it was never built as one thing. It accumulated.
The 2026 Cost of a Data Breach Report has now measured what that accumulation costs.
The finding underneath the finding
The headline number from IBM and Ponemon’s study of 602 organizations is that 53% of breached organizations were not encrypting sensitive data at rest and in motion.
The number underneath it is the one worth more of your attention.
Sixty-one percent of organizations reported they lack controls to monitor and secure cryptographic assets such as keys, certificates, and algorithms across their environment. Thirty-four percent have them. Five percent were not sure.
Put those two findings together, and the picture is uncomfortable. A majority are not encrypting. Among those who are, most can’t tell you where the keys are, who holds them, when they were last rotated, or what they unlock.
Encryption without key control is half a control. It satisfies the audit question and leaves the operational one open.
What it costs, in both directions
The report analyzed 30 factors against the USD 4.99 million global average breach cost. Four of them describe this problem precisely.
On the cost side:
- Mismanaged secrets and keys added USD 198,933.
- Excessive privileges and poor role management added USD 177,313.
On the savings side:
- Key lifecycle management tools reduced average breach cost by USD 214,923.
- Certificate lifecycle management tools reduced it by USD 205,265.
And the single largest identity-related finding in the study: identity and access management reduced average breach cost by USD 225,622, second only to a DevSecOps approach across all 30 factors.
A vector finding also belongs in the same conversation. Abusing valid accounts was one of the year’s most common initial attack vectors, averaging USD 5.07 million per breach and taking 243 days to identify and contain. Attackers with a working credential do not need an exploit, and the report’s timeline data shows those breaches run long.
Why this is harder on z/OS than anywhere else
None of this is negligence, and it is worth being clear about that, because the usual framing insults people who are doing a hard job well.
Mainframe environments accumulate keys for the same reason they accumulate everything else: they are old, they work, and the cost of touching a working thing is high.
SSH keys get created during automation projects and outlive the project. Service accounts outlive the people who requested them. A key gets added so a batch job can move a file, the job runs every night for eleven years, and nobody revisits it because revisiting it means risking a 2am failure.
Pruning an authorized-key file on a distributed server is a Tuesday afternoon. Pruning one on a production LPAR means understanding what breaks, which means understanding what a job written in 2014 is actually doing.
So the inventory stays in the JCL, and in the heads of the two people who know.
The one number to get first
If this post produces exactly one action, make it this.
Get a count.
Not a policy, not a project plan, not a tooling evaluation. A number: how many SSH keys and authorized-key entries exist across your z/OS systems, and how many of them have no documented owner.
That number does three things at once. It tells you the size of the problem. It usually surprises somebody senior enough to fund the next step. And it turns an abstract risk into a finite piece of work, which is the only form in which this kind of thing ever actually gets done.
Once you have it, the follow-on questions get easier:
- Which entries have no owner, and what would break if you removed them?
- When was anything last rotated?
- Which accounts hold standing privilege that could be time-bound instead?
- Who reviews privileged activity, and when did that review last revoke something?
That last one matters more than it looks. A review that never revokes anything is not a review; it is a recurring meeting.
Where SDS fits
PrivX Key Manager centralizes, simplifies, and automates SSH key management. The first thing it gives you is the count, which is the thing most teams cannot produce today.
PrivX PAM provides zero-trust privileged access, granting connections only for the time needed and removing the dependency on passwords. That directly addresses standing privilege and the USD 177,313 the report ties to excessive privileges.
Neither is a large project. Both start by telling you what is already there.
Fifteen minutes
Section 2 of our 2026 Mainframe Security Self-Assessment is five questions on exactly this: key counts, ownership, standing privilege, review cadence, and whether your access reviews have ever actually revoked anything.
It is scored, and it produces a number you can take upstairs.
Source: IBM and Ponemon Institute, “Cost of a Data Breach Report 2026: The AI Tipping Point.” Findings referenced above appear on pages 21, 23, 25, 50 and 63. Figures are global averages across the study population and are not specific to any platform, industry or organization.
Free Demo/Trial
We offer individualized product demonstrations by request. Your organization can also try SDS Software on your system for 30 days, free of charge.
Phone: (800) 443-6183
Phone: (763) 571-9000
200 Village Center Drive, Suite 250
North Oaks, MN 55127
USA
