Privileged access management (PAM)

Privileged access management is the practice of securing, controlling, and monitoring elevated ("privileged") access to an organization's most critical systems and data. Privileged accounts — administrators, root, service accounts, and similar — can change configurations, reach sensitive data, and bypass ordinary controls. That power makes them the primary target in most serious breaches. PAM reduces the risk by removing standing access, hiding credentials, and keeping every privileged action auditable.

Privileged access is any access carrying elevated rights beyond those of a standard user. Common examples include:

• Administrator accounts — local and domain admins on servers and workstations.
• Root and superuser accounts on Linux and Unix systems.
• Service and machine accounts that run automated processes.
• Cloud infrastructure accounts with broad console or API permissions.
• Database, network device, and hypervisor administrator credentials.

Each can make sweeping changes or expose sensitive information, which is why they are governed differently from ordinary user accounts.

A PAM solution brings privileged accounts under central control through several core capabilities:

• Credential vaulting — privileged passwords, keys, and secrets are stored encrypted rather than held by users.
• Credential injection and brokering — credentials are delivered into sessions without being revealed to the user.
• Privileged session management — sessions to critical systems are proxied, monitored, and recorded, often through a privileged session manager (PSM).
• Just-in-time (JIT) access — elevated rights are granted for a limited window and removed automatically, eliminating standing privilege.
• Credential rotation — privileged passwords change automatically on a schedule or after each use.
• Auditing and reporting — every checkout, session, and action is logged for review and compliance.

Organizations most often adopt PAM to:

• Control third-party and vendor access — grant outside technicians scoped, time-limited access without handing over passwords.
• Secure service and automation accounts — vault and rotate the non-human credentials that scripts and applications rely on.
• Provide break-glass access — make emergency privileged access available in a controlled, fully audited way.
• Govern cloud and hybrid infrastructure — apply consistent controls across on-prem and cloud consoles.
• Meet audit and compliance requirements — produce evidence of who accessed what, and when.

Identity and access management (IAM) governs identities and everyday access for the whole user population. PAM is a focused discipline within that space, dealing specifically with the small number of high-risk, elevated accounts. In short, IAM manages access for everyone; PAM manages the powerful access that could do the most damage if misused.

Compromised privileged credentials are behind a large share of major security incidents, because they give an attacker the reach of a trusted administrator. PAM reduces that exposure by removing standing privilege, keeping credentials out of users' hands, and containing what any single account can do. It also produces the audit trail that frameworks such as SOC 2 and ISO 27001 expect for privileged activity — making it central to both security and compliance.