Privileged Access
Also known as:
- Privileged Access Management (PAM)
What problem does it target?
Privileged identities are a frequent target for attackers.
When compromised, they can:
- Enable rapid lateral movement
- Disable security controls
- Lead to full infrastructure takeovers
PAM mitigates the risk by tightly controlling and auditing who gets privileged access, when, and how.
What does this solution do?
PAM tools:
- Remove always-on privileges from user accounts
- Grant temporary, just-in-time elevated access when needed
- Enforce step-up MFA before privileged actions
- Log, audit, and sometimes record all privileged sessions
Common Use Cases:
- Protecting admin access to sensitive systems (e.g., Active Directory Domain Controllers)
- Providing just-in-time local admin rights to Windows users - allowing them to operate as standard users and elevate securely when needed
Who is this for?
- Organizations with on-premises infrastructure, especially:
- Active Directory environments
- Systems that lack native MFA support
- Environments with legacy authentication protocols (e.g., NTLM, Kerberos)
Who might not benefit from this?
- Cloud-native or SaaS-based orgs without on-prem infrastructure
- Teams where SSO + strong MFA already protects privileged actions natively
Pitfalls and remedies
| Pitfall | Remedy |
|---|---|
| User experience issues when admins connect to protected systems | Ensure the PAM solution supports transparent workflows and quick elevation. Train admins on secure elevation workflows. Use context-aware access to reduce unnecessary prompts. |
Sample products
- CyberArk Privileged Access Security
- BeyondTrust Privileged Remote Access
- Delinea (formerly Thycotic & Centrify)
- Microsoft Local Administrator Password Solution (LAPS)
- Microsoft Entra Privileged Identity Management (PIM) (for Azure AD)