Many successful cyber-attacks involve the misuse of privileged accounts, and misuse is enabled by inadequate Privileged Access Management (PAM) software, policies, or processes. Some of the malicious activities that must be detected and controlled are abuse of shared privileged credentials, misuse of elevated privileges by unauthorized users, theft of privileged credentials by cyber-criminals, and abuse of privileges on third-party systems accessed via the cloud.

Privileged accounts have traditionally given to a small set of administrators who needed access to perform maintenance and upgrade tasks, mostly on networks on-premises or local area networks (LAN). In some cases, senior employees may have also been given elevated access rights for specific tasks. It’s fair to say that this is no longer the case. Privilege management use cases now extend across entire organizations, with users and machines requiring task-based access to data, services, and applications held on legacy systems and multi-cloud-based infrastructures. All the while, admins still need to perform traditional privileged tasks.

PAM has evolved into a stronger and wider risk management discipline as digitalization has increased the attack surface to include cloud, multiple endpoints, home working, and no secure perimeters. It brings significant benefits to almost every major digital business initiative, including securing applications and data in the cloud, privileged user behaviour analytics to detect anomalous privileged behaviour and supporting endpoint threat protection More recently, several PAM vendors have started to accommodate capabilities that support Cloud Infrastructure Entitlement Management (CIEM) for cloud-based resources, and critical cloud-based workflows such as DevOps and CI/CD projects.

While there is overlap here, the demand for traditional PAM capabilities (vaulting, credential management, analytics, admin access, Endpoint Privilege Management etc.) remains robust and vendor efforts to improve on those capabilities continues to drive competition.

Support for the demands of digital organizations offered by the PAM tools is becoming a competitive differentiator in the PAM market.

Both new and traditional vendors have responded well to demands for more advanced PAM capabilities suitable for the modern computing era. Interest in Least Privilege and Zero Trust informed architectures and policies has also grown as organizations look to secure the multi-cloud environments. Buyers are increasingly aware that a well-configured and up-to-date PAM platform can be an integral part of any such architecture and that the traditional architecture of PAM must be extended to support cloud environments and SaaS applications and services.