PAM

Controls and monitors elevated accounts, often with vaulting and just-in-time access.

Privileged Access Management controls and monitors elevated accounts such as administrator, root, and service accounts that attackers target for lateral movement and persistence. Typical features include credential vaulting, automatic password rotation, session recording, and just-in-time access that grants elevation only when needed. This enforces least privilege and provides accountability for who used a privileged credential and when. Note that this acronym is distinct from Pluggable Authentication Modules, a Linux authentication framework, despite sharing the same letters.