Privileged Access Management (PAM)

Privileged Access Management (PAM) is a set of tools and processes that secure, control and monitor accounts with elevated permissions. These accounts can change system configuration, run the infrastructure and reach sensitive data — things an ordinary user cannot do. PAM mainly watches over administrator accounts, service accounts, domain accounts and machine identities. Its goal is to reduce risk: grant only the permissions that are needed, keep passwords in an encrypted vault, and record sessions. PAM is a specialized part of the broader field of Identity and Access Management (IAM).

What is privileged access?

Privileged access is any permission that goes beyond what a normal user has. Privileged accounts are sometimes called the “keys to the kingdom”: whoever takes over one of them can move freely across the company network, switch off defenses and steal data. The most common types:

• Local administrator accounts — root on Unix/Linux, the built-in Administrator on Windows.
• Domain administrator accounts — Active Directory rights reaching the most critical Tier 0 systems (domain controllers, identity infrastructure).
• Service accounts — used by applications and processes, not by people. They often have passwords that were never changed.
• Break-glass (emergency) accounts — used in a crisis, carrying the highest privileges.
• Machine identities and secrets — API keys, SSH keys, certificates and tokens in software build pipelines (CI/CD). There are usually far more of them than human accounts.

How does PAM work?

PAM sits in the middle — between the user and the system they want to reach. The user never knows the real password. They log in to PAM, and PAM connects them to the target system: it slots the credential into the session or hands out a token that is valid for only a short time. That way the password never reaches the user’s computer, which might be infected. Key mechanisms:

• Credential vaulting — encrypted storage of passwords, keys and secrets. To use them, you formally check them out and check them back in.
• Automated rotation — passwords and secrets are changed regularly, so a stolen credential stops working quickly.
• Session isolation and recording — connections pass through an intermediary server (a bastion or jump server) and the whole session is recorded, creating a trail you can return to when investigating an incident.
• Just-in-time (JIT) access — privileges are granted only for the duration of a specific task and revoked the moment it is done.
• Multi-factor authentication (MFA) — extra proof of identity when reaching the vault and the most critical systems.

PASM vs PEDM — two approaches within PAM

Gartner splits PAM solutions into two main categories that enforce control in different ways:

• PASM (Privileged Account and Session Management) — a vault-based model. Privileged account passwords sit in a central vault. The user checks out access, gets a single-use session (usually with full administrative rights), and everything is monitored and recorded. This is a classic password vault plus session control.
• PEDM (Privilege Elevation and Delegation Management) — a granular model. Here you don’t hand over an entire admin account. Instead, a standard account is allowed to perform only specific, tightly defined actions with higher rights (for example, run one designated command). PEDM spells out exactly who can do what, so nobody ends up with more privileges than they actually need.

Least privilege and zero standing privileges

The foundation of PAM is the Principle of Least Privilege (PoLP): everyone gets only as much as they need for the task — nothing more. Newer deployments go a step further, toward zero standing privileges (ZSP), meaning no permanent administrative rights. Nobody holds them “just in case”. Privileges appear only when they are needed (the JIT mechanism) and disappear right after the work is done. This sharply cuts the number of accounts an attacker could take over at any given moment.

How does PAM differ from IAM, IGA and PIM?

These acronyms are often confused, yet each means something different within identity security:

• IAM (Identity and Access Management) — the overarching layer answering “who are you?”. It covers sign-in and access for all users. PAM is its specialized part, focused on the highest-risk accounts.
• IGA (Identity Governance and Administration) — oversight of identities. It enforces the rules and the account lifecycle: who gets which access and when, who should lose it, and whether a given access is appropriate and auditable.
• PIM (Privileged Identity Management) — a term often used interchangeably with PAM; in practice it emphasizes time-bound, approval-based activation of privileged roles (common in the cloud, such as Azure).

In short: IAM is the front door (who gets in at all), PAM is the vault (how the most sensitive areas are locked down), and IGA is the oversight that checks who should hold the keys.

Why does PAM matter for security and detection?

Most serious breaches run through abuse of privileged accounts — that is how an attacker hops from system to system and gains ever higher rights. PAM narrows that path, but it has another benefit: it produces data (telemetry) that is very valuable to the security team (SOC) and to network monitoring:

• Activity log and session recordings — a full record of administrative work lets an incident be reconstructed and pins down exactly what an attacker or a rogue employee did.
• Logs feeding SIEM/SOAR — events such as a password check-out, a privilege elevation or a session opening power detection rules (for example, access outside business hours or to an unusual system).
• Behavioral analytics (UEBA) — when a privileged account behaves unlike its usual self, it can signal a takeover, including techniques such as Pass-the-Hash or Kerberoasting.
• Correlation with network traffic — for network monitoring (NDR) teams, sessions going through a bastion have a known, predictable origin. If someone connects administratively while bypassing PAM (for example, straight over RDP on port 3389 or SSH on port 22 to Tier 0 systems), that alone is suspicious and worth an alert.
• Short credential validity — password rotation and JIT access mean a stolen token or hash stops working quickly, so the attacker has less time to act.

Learn more

• Cloud Security Posture Management (CSPM) — CSPM helps manage cloud risks that PAM must cover for privileged accounts.
• SaaS Security Posture Management (SSPM) — SSPM protects SaaS settings, including privileged access used in those apps.
• BYOD (Bring Your Own Device) — BYOD increases access risk, so PAM can restrict privileged use from personal devices.
• Inventory — Inventory helps identify assets and accounts that require privileged access control.