Cybersecurity glossary
What is Privileged Access Management (PAM)?
Learn what Privileged Access Management (PAM) is, how vaults, JIT elevation, and session monitoring protect admin access, and PAM best practices that reduce breach impact.
Definition
Privileged Access Management (PAM) is the set of tools and processes that discover, vault, elevate, monitor, and revoke elevated credentials and administrative sessions so powerful access is least-privilege, time-bound, and auditable.
Why privileged access needs its own program
Attackers do not need every employee laptop. They need one path to domain admin, cloud owner, or production root. Privileged Access Management (PAM) concentrates controls on those paths: vault the secrets, mediate the sessions, shrink the time elevated, and record what happened.
Without PAM, privileged credentials become sticky notes—digital or literal—across an estate.
Core PAM capabilities
Discovery
Find local admins, domain privileges, cloud roles, and embedded secrets.
Vault & rotate
Store admin passwords/keys centrally and rotate them on check-in.
Session brokerage
Users connect through a proxy without learning standing passwords.
JIT elevation
Grant admin rights for a ticketed window, then remove them.
Monitoring
Record or keystroke-log sensitive sessions for forensics.
Analytics
Detect unusual elevation, shared accounts, and dormant privileges.
Privileged access lifecycle
Identify privileged identities
Humans, break-glass, service accounts, and automation with high blast radius.
Remove standing access
Convert always-on admin groups into requestable elevation.
Authenticate strongly
Phishing-resistant MFA and separate admin workstations where required.
Elevate with context
Ticket, reason, approver, and short TTL accompany each grant.
Expire, rotate, review
End sessions, rotate secrets, and certify continued need.
Standing admin vs PAM-managed access
| Aspect | Standing privilege | PAM-managed |
|---|---|---|
| Credential knowledge | Humans know passwords | Vault/broker hides secrets |
| Time elevated | Always | Minutes to hours |
| Visibility | Sparse logs | Session + elevation audit |
| Offboarding | Easy to miss a local admin | Central revocation point |
Implementation checklist
- Inventory privileged accounts across AD, cloud, SaaS, databases, and DevOps.
- Vault and rotate break-glass credentials; alert on any use.
- Replace shared admin passwords with individually attributable elevation.
- Enforce phishing-resistant MFA for all privileged paths.
- Prefer JIT and ephemeral credentials over permanent group membership.
- Record high-risk sessions and retain evidence for investigations.
- Extend PAM thinking to CI/CD and infrastructure-as-code secrets.
- Measure success by reduction of standing admin count—not by vault license count alone.
The practical takeaway
PAM makes powerful access rare, attributable, and observable. It is how organizations stop treating domain admin like a convenience group.
Vault secrets, elevate just in time, monitor sessions, and relentlessly eliminate standing privilege—the combination shrinks what a single compromised admin identity can do.
Related security terms
Just-in-Time Access (JIT)
Time-bound elevation pattern central to modern PAM.
Least Privilege
Design principle PAM exists to enforce for admins.
Identity and Access Management (IAM)
Broader identity program that includes PAM as a specialty.
Step-Up Authentication
Stronger proof often required before privileged actions.
Phishing-Resistant MFA
Should protect privileged account authentication.
Frequently asked questions
What is PAM in simple terms?
PAM controls the keys to powerful accounts—server admins, cloud owners, database root—so people get elevated access only when needed, with monitoring and automatic lockup afterward.
How is PAM different from ordinary IAM?
IAM covers all identities. PAM focuses on high-impact credentials and sessions with vaulting, elevation workflows, recording, and tighter controls.
What problems does PAM solve?
Shared admin passwords, standing domain admin rights, unmonitored RDP/SSH, credential sprawl in scripts, and slow revocation after offboarding.
What are core PAM capabilities?
Discovery of privileged accounts, credential vaulting and rotation, passwordless or brokered sessions, JIT elevation, session recording, and analytics.
Does PAM replace MFA?
No. Privileged users still need strong—preferably phishing-resistant—MFA. PAM adds vaulting, mediation, and oversight on top.
Where should PAM start?
Domain/cloud admins, break-glass accounts, production servers, database admin, CI secrets with prod reach, and third-party support access.
What is a common PAM failure mode?
Buying a vault but leaving standing admin groups intact, or allowing emergency bypasses that become the everyday path.
References
Explore authoritative guidance and frameworks related to privileged access management (pam).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.