Who can still administer critical systems after the maintenance window closes? For CISOs and IAM leaders reviewing privileged identity management, that question goes beyond credential protection. The greater risk is elevated access remaining available when nobody needs it.
What is privileged identity management?
Privileged identity management (PIM) governs who is eligible for elevated permissions, when those permissions can be activated and how long they remain available.
Privileged access management (PAM) covers the wider controls used to secure, monitor and manage privileged access.
Vendor terminology varies, so the practical comparison is capability rather than product label. Both sit within identity and access management (IAM), but privileged access requires additional controls because administrators can change security settings, manage accounts and alter critical systems.
Why standing privilege deserves attention
Standing privileges remain available between administrative tasks.
A contractor who needs access for occasional maintenance, for example, may retain elevated permissions throughout the month. If their credentials are compromised, those permissions are already available to an attacker.
IBM reported that 32% of incidents handled by X-Force in 2025 involved abuse of valid accounts.
That makes persistent access the first area to review: which employees and third parties retain powerful roles when no administrative task is underway?
Three controls that need to work together
Reducing privileged-access risk requires more than protecting passwords. Credential vaulting, session management and just-in-time access address different parts of the access lifecycle.
Credential vaulting: protect the credential
Credential vaulting stores privileged passwords, keys and other secrets in a controlled repository.
Where supported, session brokering allows administrators to connect without seeing the password, while automated rotation reduces the value of previously obtained credentials.
But protecting a credential does not remove the permissions attached to the account. The control therefore needs to establish:
- Whether access is restricted or the underlying permission is removed
- What happens when credential rotation fails
- Which systems depend on the credential
Session management: make activity accountable
Privileged session management links administrative activity to an identifiable user and session.
Depending on the platform and connection method, evidence may include event logs, commands or session recordings. Recording alone is not enough; the operating model also needs to define who receives alerts, who investigates suspicious activity and who can terminate access.
Coverage matters as well. Browser consoles, command-line tools and remote administration routes should all be included where they provide privileged access.
Those records should feed the security function responsible for investigation and response, rather than remain isolated inside the PAM platform.
Just-in-time access: limit the permission window
Just-in-time (JIT) access replaces persistent permissions with temporary elevation.
An administrator requests access to a defined resource for a defined period. Policy or approval determines whether access is granted, and the permission is removed when the task or access window ends.
The audit trail should record the request, approval, access and revocation.
JIT is strongest when combined with just-enough access. Thirty minutes of unrestricted administration can still provide more privilege than the task requires.
Approval also needs to work outside normal office hours. A control that cannot support urgent administration will quickly accumulate exceptions.
Together, the three controls answer different questions: how is privileged access obtained, what happens while it is used, and what remains afterwards?
Moving towards zero standing privilege
Zero standing privilege (ZSP) removes elevated permissions by default and grants them only when required.
JIT can support that model, but temporary access for one application does not create organisation-wide ZSP. Progress depends on replacing persistent assignments across a defined environment and expanding coverage as the process proves reliable.
Useful measures include:
- Remaining standing assignments: Shows where persistent privilege still exists.
- Failed revocations: Identifies access that was expected to end but remained active.
- Time to obtain legitimate access: Tests whether stronger controls are creating unacceptable operational delay.
- Emergency-access exceptions: Shows where normal approval or provisioning routes are being bypassed.
Exceptions need named owners and review dates so temporary workarounds do not become permanent access paths.
The PAM platform itself also becomes critical infrastructure. Its own administrative access, availability and recovery route need equivalent protection.
A practical test: remote maintenance
A supplier engineer who needs to repair one production server provides a useful end-to-end test.
The engineer requests a defined maintenance window, completes verification and receives only the permissions required. Where a password is needed, the broker supplies it without disclosure, while session monitoring records the activity.
When the window closes, the engineer should no longer be able to reconnect or continue privileged actions.
The evidence should link the original request, approval, session and removal of access. That provides stronger assurance than a portal simply displaying the status as “expired”.
Connect access decisions to identity governance
Temporary access does not mean permanent eligibility should remain unchecked.
Privileged roles need named owners, with eligibility reviewed when responsibilities change, supplier engagements end or administrative duties move elsewhere.
The audit trail should connect the full decision:
- Identity: Who received the access.
- Business reason: Why elevation was required.
- Approval: Who authorised it.
- Permissions: What access was granted.
- Revocation: When and how it was removed.
Governance should also cover who can approve privileged access and change approval policies. Those permissions can be as consequential as the privileged roles themselves.
What to compare in PIM software and PAM solutions
A representative administrative task provides a stronger comparison than a generic product demonstration.
| Capability | What to test |
| Credential vaulting | Can administrators connect without seeing passwords? What happens when rotation fails? |
| Session management | Which sessions are recorded, who receives alerts, and can authorised staff terminate access? |
| JIT and ZSP support | Are permissions removed at the target system after expiry? Which accounts retain standing access? |
| Cloud and remote administration | Do controls cover your cloud roles, browser consoles, command-line tools and contractor access routes? |
| Endpoint privilege management | Can users perform approved tasks without unrestricted local administrator rights? |
| Existing IAM integration | Do role changes and departures remove eligibility? Can audit events reach your security-monitoring tools? |
Failure scenarios should form part of the same assessment.
An unavailable approver, disconnected target or identity-provider outage tests how the platform behaves when the normal access path breaks. Supplier responsibilities should also be clear for failed revocations, integration issues and out-of-hours administration.
Where secrets management fits
PIM and PAM for human administrators do not remove the need to manage machine credentials.
Application passwords, API keys and other secrets need separate ownership, rotation and revocation controls.
Removing standing access for people therefore addresses only part of the privileged-access problem. Applications and services can retain persistent permissions too.
Take a defined privileged-access requirement into provider conversations
Privileged access controls should reduce standing privilege without making legitimate administration harder to complete.
A strong requirement defines which access should be temporary, which actions need monitoring, how approvals work and what evidence proves permissions have been removed after use.
The Cyber Secure Forum brings security decision-makers together with relevant identity and access providers through pre-arranged one-to-one meetings.
Organisations reviewing PIM, PAM or zero-standing-privilege approaches can meet providers against their privileged-access requirements and use those requirements to guide supplier conversations.
Frequently asked questions
What is the difference between PAM and PIM?
Here, PIM governs privileged identities and role eligibility; PAM covers the broader controls over access and activity. Vendors overlap, so specify the capabilities required rather than relying on the category name.
What is zero standing privilege?
It is a state where elevated permissions are absent by default and granted only when needed. Assess any ZSP claim against its declared systems, identities and exceptions.
Do we need PAM if we already have IAM?
You need appropriate privileged-access controls, but not necessarily another product. Assess what your existing IAM arrangements cover and identify gaps in credential protection, elevation, session oversight and revocation.
What is endpoint privilege management?
It controls elevated activity on devices such as workstations. Users can complete approved administrative tasks while remaining standard users, rather than holding unrestricted local administrator rights. Check operating-system and application coverage separately from cloud-role management.
Image credit: https://unsplash.com/photos/a-group-of-people-sitting-around-a-laptop-computer-m29D0DvAhF0
