What is Privileged Access Management (PAM)?
Privileged Access Management (PAM) is a security discipline that controls, monitors, and audits access to accounts with elevated permissions, such as system administrators, root accounts, and service accounts. It reduces the risk of credential theft, insider abuse, and lateral movement by limiting who can use privileged credentials and recording what they do with them.
What it does
PAM tools sit between users and the systems they need to administer. At a minimum, a PAM platform:
- Stores privileged credentials in an encrypted vault so users never see raw passwords
- Rotates passwords and SSH keys automatically after each use or on a schedule
- Brokers sessions so administrators connect through a proxy rather than directly to a target system
- Records keystrokes, commands, and screen video for every privileged session
- Enforces just-in-time (JIT) access, granting elevated rights only for a defined window and revoking them automatically
- Manages local administrator rights on endpoints, removing standing admin access from workstations
- Controls vendor and third-party access with time-limited, audited sessions
Some platforms extend into Zero Standing Privilege (ZSP), where no persistent privileged accounts exist at all. Others cover non-human identities such as service accounts, API keys, and application credentials, which overlaps with Secrets Management.
Why teams buy it
Privileged accounts are the highest-value target in most environments. Attackers who compromise a domain admin or root account can move freely across systems. Regulators including PCI DSS, HIPAA, SOX, and ISO 27001 explicitly require controls over privileged access and audit trails of privileged activity. PAM satisfies both the security need and the compliance requirement in one place.
Teams also buy PAM to reduce the blast radius of a breach. Vaulted credentials that rotate automatically are useless to an attacker who exfiltrates a password database. Session recording gives incident responders a precise record of what an attacker or insider did.
What to look for
- Vault and credential rotation: Supports all target types you use: Windows, Linux, databases, network devices, cloud consoles, SaaS apps