PAM Privileged Access Management
Just-in-time elevation for admin accounts. Eliminates standing privilege so attackers who steal credentials cannot turn that theft into full admin access.
PAM governs the accounts that can change things: domain administrators, cloud root and owner roles, database superusers, service accounts and the local administrator on every workstation. In practice it combines four capabilities. Credentials are vaulted rather than known, sessions are brokered so an administrator connects through the system instead of directly, privilege is elevated only for the window in which it is needed, and privileged sessions are recorded for audit.
Standing privilege is the specific problem. When an account holds administrative rights permanently, the value of stealing it is permanent too, and an attacker who phishes one help-desk engineer on a Tuesday can use those rights at three in the morning on Saturday. Just-in-time elevation removes that: rights exist for the duration of an approved task and then disappear, so a stolen credential is worth far less at the moment it is actually used.
This is also the control that most directly limits ransomware blast radius. Encrypting one workstation is an incident and encrypting a domain is a catastrophe, and the step between them is almost always the acquisition of administrative credentials. Constraining how privilege is held does not prevent intrusion, but it removes the escalation path that turns a contained problem into an organization-wide one.
Common questions
What does PAM stand for in cyber security?
PAM stands for Privileged Access Management. It covers the controls that secure high-privilege accounts, including vaulting their credentials, brokering and recording their sessions, and granting elevated rights only for the period they are genuinely required.
What is the difference between PAM and IAM?
IAM manages identity and access for everyone in the organization, handling authentication, provisioning and general entitlements. PAM is the specialised discipline for the small set of accounts that can cause the most damage. IAM is breadth across all users, PAM is depth on the dangerous ones, and PAM adds controls such as session recording and just-in-time elevation that general IAM does not provide.
What is just-in-time privilege?
Just-in-time privilege means an account holds no elevated rights by default and is granted them only for a specific approved task and a limited window, after which they are automatically removed. It eliminates standing privilege, so a credential stolen today is not a permanent administrative key to the environment.
PAM is one signal.
We watch the rest.
Vijilan runs a 24/7 SOC across endpoint, identity, cloud, network, SaaS and mobile, and acts on what it finds rather than forwarding an alert.