Privileged Access Management (PAM) controls identities and sessions with authority to administer systems, applications, databases, networks, or cloud resources. It limits who can use elevated rights, which actions they can perform, and how long access remains active. This includes administrator accounts, service accounts, emergency access, and cloud roles. PAM matters because stolen credentials or excessive standing privileges can let an attacker disable controls, move between systems, alter configurations, or access sensitive data.
Key practices include separate administrative identities, least privilege, multifactor authentication, secure credential storage and rotation, and just-in-time access that expires when the task is complete. Approval workflows and session or command recording provide accountability and help investigators distinguish authorized administration from misuse. PAM can reduce the blast radius of a vulnerability or compromised account, but it does not replace endpoint security or correct an overly permissive role; its effectiveness depends on accurate inventory, appropriate access policies, and useful monitoring.