Engagement for privileged access management
PAM Ready
Find out what actually holds power in your environment – and who shuts it down again.
Most organizations cannot produce the list of who holds privileged access, and even fewer can say who closes a privileged account once it is no longer needed. PAM Ready maps the privileged accounts and access, describes how they should be created, used, and removed, and delivers a staged plan that starts with the most security for the least disruption.
The challenge
Nobody knows the list, and nobody owns the clean-up
Privileged access is what attackers go for first, and what supervisors and auditors ask about first. Even so, few can say how many accounts hold elevated privileges today, and who removes them again.
- Standing privileges: access granted for a task three years ago that is still in place.
- Accounts without an owner: local administrators, service accounts with elevated rights, and old test accounts nobody dares to touch.
- Access outside the catalogue: hypervisors, network equipment, databases, and SaaS consoles that never made it into the IGA solution.
- Suppliers: external parties working with elevated rights, often through accounts you did not create yourself.
- Emergency access: break-glass accounts documented in one place and tested in another, if they have been tested at all.
- No process: accounts are created manually by whoever needs them, and removed by nobody.
How PAM differs from IGA
PAM changes the working day for the people under pressure
An IGA project changes how access is requested and approved. A PAM project changes how your administrators work, every single day, including at three in the morning during an incident. If the route through the PAM solution is slower than the incident, people go around it, and you are left with an expensive product and the same standing privileges.
That is why PAM Ready spends as much time on the way of working as on the technology. We talk to the people who actually use the privileged accounts and build a model they can live with, before any product is chosen.
What we settle with operations
- Speed: how quickly an elevation has to be in place, and who can approve it outside working hours.
- Emergency access: what break-glass looks like, where it is kept, and when it was last tried.
- Exceptions: the systems that cannot sit behind a PAM solution, and what you do about them instead.
- Resistance: where in the organization it will come from, and what it takes to get ahead of it.
Our strongest card
The PAM solution should be governed by IGA, not sit beside it
A PAM solution solves storage. It says nothing about who may hold a privileged account, why it was created, and who closes it when the person changes role or leaves. Without a process it becomes the very unmanageable catalogue it was meant to clean up.
We connect IGA and PAM so the privileged account gets the same lifecycle as everything else: requested, approved, created, used, and removed through a process that can be documented. We have built this for several Danish organizations across finance, critical infrastructure, and shared IT operations, and it is what we do best in the PAM space.
Our article on lifecycle management for privileged accounts explains the thinking in full.
See our IGA solutionsWhat we build
- Personal admin account: requested and approved in IGA, created automatically, and placed straight into the PAM solution. The owner uses it without ever knowing the password.
- Service accounts: the same pattern, with a named owner, a purpose, and an expiry date, so they do not outlive the project they were born for.
- Server lifecycle: when a new server is created, a safe is created automatically with the shared accounts the server needs, and the accounts other systems need, for example your CMDB.
- Removal: offboarding of people, service accounts, and servers. The role disappears in IGA and the account disappears in the PAM solution, without anyone having to remember.
Without a process
Who closes the privileged account?
The question sounds small and decides whether the PAM investment holds. With no process for removal, four things happen, and they happen slowly enough that nobody notices along the way.
- The numbers grow: accounts from finished projects, former employees, and decommissioned servers stay behind, because creating them was easy and removing them is somebody's extra work.
- The audit comes back: you bought the solution to document control of privileged access. If you cannot show when an access was removed, you are worse off than before, because the expectation is now higher.
- Recertification becomes a signature: when nobody can say why an account was created, it gets approved again, because that is the safe way out.
- The attack surface moves: a forgotten account still carries its privileges, and it now sits in one place alongside all the others.
How it works
Four phases, one basis for the decision
The engagement contains no market evaluation. Instead it goes deep into the technical environment and the processes around it. Scope is agreed before we start, so you know the frame.
- Mapping
We find the privileged accounts and access across the domain, clients, servers, cloud, network, databases, and the SaaS consoles that have administrators of their own. If you already have a PAM solution, we map that too.
- Risk ranking
Each access is assessed on what it can reach, how many people hold it, and how long it has been open. The result is a ranked list rather than an alarm.
- Lifecycle and target model
How privileged accounts should be created, approved, used, and removed going forward, who owns each step, and what can be automated from IGA.
- Staged plan
What you do in the first three months without buying anything, what requires a product, and what it will cost to get all the way.
The deliverables
What you are left with
The account inventory
A documented picture of the privileged accounts and access with owner, purpose, and last use, in a format your auditor can work with.
The lifecycle model
How a privileged account comes into being and disappears again, who approves it, and what can be automated from your IGA solution.
The staged plan
A prioritized order with the early wins first, and a basis for deciding whether to buy a product now.
Without buying anything
A lot can be closed before any product is chosen
For a Microsoft-heavy organization the first steps are rarely a new platform. Removing local administrator rights on the clients, adopting Windows LAPS, and setting up Entra ID PIM on the roles that matter most closes a large share of the risk with what you already pay for.
We say so in the staged plan. When a proper PAM solution does become necessary, the decision rests on ground you can explain yourself, and you have cleaned up first, so you are not paying to systematize a mess.
See our Microsoft solutionTypical early wins
- Local rights: administrator rights removed on the clients.
- Rotation: passwords for local administrators rotated automatically.
- Time limits: the most critical roles in Entra ID granted only when they are needed.
- Supplier access: collected in one place with a named owner behind each one.
- Emergency access: documented and tested.
Our view
The most dangerous account in your environment is the one nobody remembers owning.
Privileged accounts are rarely created by mistake. They are forgotten, and they remain long after the task is done.
Before you record sessions
Monitoring privileged work is an employment matter
Session recording is one of the strongest tools in PAM and also the thing that most often derails a project late in the process. Recording an administrator's screen is processing of personal data about the employee and has to be handled accordingly.
- A legitimate purpose: there has to be a justification that can be written down and hold up, and the scope has to match the purpose.
- Duty to inform: employees have to know what is recorded, why, and who can see it.
- Consultation: in many companies it has to go through the works council, and that takes time you should plan for from the start.
- Retention: how long recordings are kept, and who has access to them, is decided by someone other than the people running the system.
Why IAM Group
We come at PAM from the governance side
- We connect PAM to IGA. Lifecycle management for privileged accounts has been built at several of our customers, and it is the part most PAM projects are missing.
- Vendor-neutral in the engagement. The staged plan is built on your risk, not on what we would prefer to deliver.
- We say so when you should not buy anything yet. If there is low-hanging fruit in what you already have, it goes first in the plan.
- Deliverables that stand on their own. The account inventory has value for your next audit, whether or not a project follows.
FAQ
Frequently asked questions
How long does an engagement take?
It varies a great deal with how many systems have to be mapped and how available the data is. That is precisely why we agree the scope first and give a concrete estimate before you say yes.
Do we need a PAM solution already?
No. The engagement is built both for those who have none and for those who have one that covers only part of the environment.
We already have a PAM solution. What do we get out of this?
Often the most of anyone. If it was set up without a process for creation and removal, there are usually accounts nobody can account for, and no link to your IGA solution.
Does it end with you recommending a particular product?
No. It ends with a staged plan and a basis for the decision. If that basis points to a product, we are happy to help with the selection afterwards.
What do you need from us?
Access to a system administrator, someone from security, and someone from operations, plus the ability to extract data from the systems we map.
Can you deliver the implementation as well?
We build the lifecycle management between IGA and PAM, and we implement One Identity Safeguard with certified specialists. On other platforms we work alongside your own supplier.
How does this fit with an IGA project?
Closely. The privileged accounts belong in the same governance as everything else, and requesting them is best done in IGA. If you are already running an IGA engagement, the account inventory is reused directly.
What does it cost?
Billing is time and materials. We give a concrete estimate after an initial conversation, so you know the frame before you start.
Do you know what holds power in your environment?
A no-obligation meeting is the fastest way to find out how large the mapping job is, and what can be closed straight away.