Privileged access management (PAM) is the set of policies, processes and tools that control accounts with elevated rights. These include domain administrators, root accounts, cloud owner roles and service accounts. NIST defines a privileged account as a system account with the authorizations of a privileged user. Because such accounts can change security settings and reach sensitive data, they are a prime target.

How it works

• Privileged accounts are discovered, listed and given clear owners.
• Credentials are stored in a vault and rotated, often after each use.
• Rights are granted only when needed and only for a set time, following least privilege.
• Admin sessions are protected with strong MFA, and they are logged and sometimes recorded.

MITRE ATT&CK lists Privileged Account Management (M1026) as a mitigation against many techniques, covering how privileged accounts are created, changed, used and granted permissions.

Why it matters for defenders

Attackers who gain admin rights can turn off defenses, move freely across the network and deploy ransomware everywhere at once. PAM limits that reach and makes misuse easier to spot, and it supports a zero trust approach. It also reduces the damage when credentials leak: if an admin password from stealer logs has already been rotated or needs vault approval, it is of little use to the buyer.

Sources: MITRE ATT&CK M1026: Privileged Account Management, NIST CSRC Glossary: privileged account