Privileged Access Management, Without the Vault Theatre

Privileged access is where a breach stops being an incident and becomes a catastrophe. Domain admins, root on the hypervisor, the cloud organisation's management account, the break-glass key — these identities can rewrite the environment, disable logging and delete the backups. Privileged Access Management exists to make those identities the hardest, most watched, most tightly scoped thing in the estate. Too often it is reduced to a vault that stores the very passwords it was meant to eliminate.

The failure pattern is worth stating first, because it is so common. An organisation buys a PAM product, imports its admin passwords into the vault, and declares victory. The credentials still exist. They are still long-lived. Admins still check them out and paste them into a session that no one records. The vault has become a shared password manager with an audit log of checkouts — not of what was actually done. That is vault theatre, and an attacker who compromises an admin workstation walks straight past it.

What a real PAM programme controls

The goal is to attack three properties of privileged credentials at once: that they are standing (always valid), shared (used by many, attributable to none), and unaccountable (no record of the session itself). Address all three and the admin credential stops being a durable prize. Address only storage and you have moved the prize into a slightly better box. Each property is what an attacker relies on: standing means the stolen credential still works, shared means no one can tell it was them, unaccountable means no one can reconstruct what they did.

• Just-in-time elevation. No one is a standing admin. Elevated rights are requested, approved and granted for a bounded window, then automatically removed — so a stolen identity is usually a non-admin identity.
• Session brokering and recording. Privileged sessions run through a broker that injects the credential the human never sees, and records the session. The audit trail is of actions, not checkouts.
• Credential rotation. Vaulted secrets rotate automatically — ideally on every use — so a captured password is worthless within the hour.
• A tiered admin model. Identities that manage tier-zero systems (domain controllers, the cloud root, the PAM system itself) never log in to lower tiers, breaking the workstation-to-domain-admin path attackers rely on.
• Privileged workstations. Admin actions originate from hardened, isolated machines, not the same laptop that reads email.

The identity everyone forgets

Human admins get the attention; the dangerous gap is usually non-human. Service accounts with domain-admin rights and a password last changed in 2019, CI/CD roles that can deploy to production, automation identities whose secrets sit in a config file — these are privileged identities with none of the ceremony. A PAM programme that governs people while ignoring machines is guarding the front door and leaving the loading dock open. Machine privilege belongs in the same vault-rotate-broker discipline, and it is usually where the real standing risk lives.

The measure that matters

A useful PAM programme can answer, for any moment, a short list of questions: who holds elevated rights right now, why, until when, and what did they do with them. If the honest answer is 'a static group whose membership we last reviewed a year ago', the programme is nominal. The whole value of PAM is compressing the window in which privilege exists and expanding the record of how it was used.

You cannot vault, rotate or broker a privileged account you did not know existed — and the forgotten service account with admin rights is the one attackers count on. Privileged access management starts, like everything else, with discovery.