Home / Knowledge hub / Privileged access management
Knowledge hub
Privileged access management
Tight control and recording of accounts that hold powerful admin rights.
What it means
Privileged access management, or PAM, is the set of tools and rules for accounts that can change systems, read everything or create other accounts: administrators, root users, database owners and cloud owners. It aims to keep those rights narrow, approved and recorded.
Typical features are a vault that stores the passwords, approval before use, sessions that are recorded, and credentials that change after each use. Together they replace shared admin passwords with controlled, accountable access.
Why it matters
Privileged accounts are where a small mistake becomes a large one. An attacker who reaches an administrator can read the data, switch off the logging and create more access. Most serious incidents involve a step up to this kind of account.
Buyers and auditors ask who has these rights, how they are approved and whether the use is logged. NIST SP 800-53 covers the control family around least privilege and privileged accounts. Having clear answers shortens security reviews.
How it shows up
You meet it as a vault product, as the cloud provider's own role and approval features, or as plain rules around who may use the root account. In a web application, the equivalent is the admin panel and the staff accounts that sit behind it.
The mistakes repeat. Admin rights are given to people who need them once. Shared accounts hide who did what. Break-glass credentials sit unused and unchecked. Admin pages are reachable from the internet. Check the list of privileged accounts, how each is protected, and whether their actions land in the audit log.
Questions people ask
Privileged access management, answered
Is PAM the same as IAM?
No. IAM covers everyone's identities and access. PAM focuses on the small set of accounts with the most power and adds extra control and recording on top.
PAM is usually a layer within a wider IAM approach.
Do small companies need PAM?
They need its habits more than its products: no shared admin passwords, MFA on every admin account, access given for a reason and removed afterwards, and logs that are kept.
A tool can come later if the number of admin accounts grows.
What is a privileged account?
Any account that can change system settings, read data it does not own, or manage other accounts. That includes administrators, cloud owners, database users with full rights and service accounts with broad permissions.
See also service accounts.
How does PAM relate to least privilege?
PAM puts least privilege into practice for the most powerful accounts, by giving rights only for a task and recording their use.
Without it, high rights tend to accumulate.
How do we test our privileged access?
List every privileged account, check how it signs in, try to use admin functions from a lower account, and confirm that use leaves a log entry.
Include the application's own admin features, not only infrastructure.
Related
Terms that sit next to this one
Least privilege
Giving every person and service the minimum access the job requires.
Just-in-time access
Granting elevated access only when needed, and removing it soon after.
Break-glass account
A powerful emergency account, locked away and loudly monitored when used.
Separation of duties
Splitting a sensitive task so no single person can complete it alone.
Admin panel exposure
A management page left reachable by the public or by ordinary accounts.
Who holds the keys to everything?
We check what each signed-in account can reach that it should not, including admin functions behind a normal login. Each finding is proven by exploiting it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.