Privileged accounts — root, domain admin, database superuser, cloud IAM admin, service accounts — are the accounts that can do the most damage if compromised. Privileged Access Management (PAM) is the discipline of controlling, monitoring, and protecting those accounts specifically, separately from normal user access.
The core components of real PAM
1. Credential vault
Privileged passwords and SSH keys are stored encrypted in a vault, not known by the humans who use them. When someone needs to connect to a target system, the vault hands out a session — the human never sees the raw credential.
2. Session proxy / broker
Instead of connecting directly to the target with the credential, the admin connects through a broker that injects the credential on their behalf. This means the connection can be recorded, monitored in real time, and terminated mid-session if something looks wrong — without the admin ever holding the actual password.
3. Automatic rotation
Credentials are rotated on a schedule (or after every use, for the highest-risk accounts) so that even if one leaks, it's only valid for a short window.
4. Just-in-time (JIT) elevation
Rather than granting standing privileged access, PAM systems increasingly pair with just-in-time activation — access is granted only when needed, for a bounded time, then automatically revoked.
5. Session recording and audit
Every privileged session — commands run, screens shown — is logged, and often recorded for replay. This is what actually satisfies auditors for SOC 2, ISO 27001, PCI-DSS, and similar frameworks, not just a policy document saying access is "controlled."
How to tell real PAM from relabeled RBAC
A lot of products describe themselves as having "PAM" when what they actually offer is role-based access control (RBAC) with a privileged-sounding role name. The questions that separate the two:
- Is there an actual credential vault, or does the admin still know the real password/key?
- Are sessions proxied and recordable, or does the admin connect directly to the target?
- Is rotation automatic, or does someone have to remember to change the password?
If the answer to all three is "no," it's access control, not PAM — which is fine, but it's a different tool for a different problem, and won't satisfy an auditor asking specifically about privileged-account controls.
Where PAM fits next to IAM, PIM, and SIEM
PAM doesn't replace general identity and access management (IAM) — it's the specialized layer for the highest-risk accounts. It works alongside PIM's time-bound eligibility model and feeds session/command data into a SIEM for correlation with the rest of your security telemetry.