PAM Fundamentals: — Privileged Accounts, the Attack Chain & Why Hackers Just Log In

① What a privileged account is — the keys to the kingdom

Every account can do something. A privileged account can do the dangerous things: install software, read every file, reset other people's passwords, stop security tools, or wipe a server. If a normal user is a guest with a room key, a privileged account is the hotel's master key — and the register of who holds those master keys is what keeps the hotel safe.

There are six places these keys live, and a PAM engineer learns to spot all of them: local admin (full control of one box), domain admin (control of the whole Active Directory forest), root on Unix/Linux, service accounts that quietly run backups and databases, application and API keys baked into code, and cloud entitlements — the AWS, Azure and GCP roles that can create or destroy whole environments.

Here is the part that surprises new engineers: enterprises hold far more privileged accounts than employees. A firm with 1,200 staff can easily run 4,000+ privileged accounts, because most of them are not human at all. Every scheduled task, every microservice, every database connection, every CI/CD pipeline and every cloud function carries its own credential. These machine identities multiply silently, and a credential nobody owns is a credential nobody rotates.

Four families of privileged identity

Tap each card — group the six types into the four families you will actually manage.

② The privileged attack chain — why a valid login beats your firewall

Real intrusions almost never look like the movies. They follow a quiet five-stage chain: compromise (steal or phish one valid credential), escalate (find a more powerful account — often a service account in a script), move laterally (reuse that credential across more systems), persist (create a back door so a reboot does not lock them out), and exfiltrate (quietly pull data out as a trusted user).

The uncomfortable truth is in stage one. A stolen login is authorised traffic. Antivirus hunts for malware signatures — a real password has none. The firewall blocks unexpected ports — but a login over 443, RDP or SSH rides ports that must stay open. The tools that watch for "bad" see nothing bad. That is why hackers do not break in; they log in.

Notice where PAM cut the chain in that walkthrough: the lateral-movement stage. If the harvested admin password had been vaulted, handed out just-in-time and rotated after use, the stolen copy would already be useless. No reusable key means no lateral movement — the breach stalls at one box instead of spreading to the whole estate.

The irony hook for this whole series: even PAM vendors get hit through credentials. In December 2024, BeyondTrust disclosed that attackers obtained a Remote Support SaaS API key and used it to reset local application passwords across a small set of cloud tenants — 17 Remote Support SaaS customers in total, including the US Treasury. The intrusion was later attributed to the China-linked group Silk Typhoon, and a critical command-injection flaw (CVE-2024-12356, CVSS 9.8, unauthenticated) was patched in the same window.

Two lessons sit inside that story. First, the entry was a stolen machine key, not a phishing email or the CVE alone — which is why MFA on the human login path would not have stopped it. Second, the flaw rode TCP 443, the port the product needs to function, so "we firewalled it" was never an option. Machine credentials need their own controls: short rotation, tight scoping, vaulting, and anomaly monitoring on key use.

③ The PAM control set — vault, rotate, isolate, time-box

If the problem is "a stolen privileged credential is invisible and reusable," PAM is the set of controls that makes each credential hard to steal, useless once stolen, and impossible to use unseen. Six controls do the work, and they stack.

Vaulting takes the password out of scripts and sticky notes and locks it in an encrypted store. Rotation changes it on a schedule and after every use, so a leaked copy expires fast. Just-in-time (JIT) access grants the privilege only at request time and revokes it automatically — the opposite of standing privilege. Least privilege gives each identity the minimum rights it needs. Session isolation proxies the connection so the user never sees the real password, and records what they do. Dual control requires a second person to approve — two keys to open the locker.

The four control pillars you will configure

Tap each — every PAM platform, BeyondTrust included, is built from these.

String these together and you reach the end-state goal: zero standing privilege. Nobody has always-on admin. Every powerful action is requested, approved, time-boxed, recorded and then rotated away. There is simply nothing left lying around for an attacker to steal.

Now the vocabulary that trips up every interview. IAM (Identity & Access Management) governs all identities — who gets a gate pass to what. PAM is the high-risk subset for privileged identities — who gets the strong-room key, for how long, on camera. Gartner then splits PAM into PASM (Privileged Account & Session Management — vault, checkout, rotation, session proxy/recording) and PEDM (Privileged Elevation & Delegation Management — removing standing admin rights and elevating individual commands or apps). PIM (Privileged Identity Management) is Microsoft's term for time-bound role activation in Entra ID — treat it as PAM's identity-side cousin.

④ The PAM market & where BeyondTrust sits

Three names dominate PAM, and all three are Gartner Leaders — the choice is about fit, not a "best." CyberArk has the largest mindshare and the most job ads, with per-user licensing and the furthest "Completeness of Vision" in the 2025 Gartner Magic Quadrant. BeyondTrust is a Leader positioned highest in "Ability to Execute," is licensed per asset (unlimited users), and ships remote-support/remote-access as a first-class product alongside the vault. Delinea (Secret Server) is the fastest to deploy and popular in smaller and cloud-first shops.

BeyondTrust's family is worth memorising, including the old names interviewers still use. Password Safe (managed through the BeyondInsight console) is the vault + rotation + session product. Privileged Remote Access (PRA) — the old Bomgar line — brokers recorded vendor/admin sessions without a VPN. Endpoint Privilege Management (EPM) — formerly Avecto Defendpoint — removes local admin on Windows and Mac. PMUL (Privilege Management for Unix & Linux, the old PowerBroker) and AD Bridge (ex-Likewise/PBIS) cover Linux elevation and Active Directory logon for Unix hosts.

What does a PAM engineer actually do day-to-day? Onboard new systems and accounts, build discovery scans and the rules that auto-classify what they find, configure rotation and access policies, troubleshoot failed rotations, set up recorded sessions for vendors, and answer auditors with searchable session evidence. Much of it is console work, but the API is right there too — here is the first call you make against Password Safe to start an automated workflow.

POST https://pam.lab.local/BeyondTrust/api/public/v3/Auth/SignAppIn
Authorization: PS-Auth key=c479a66f...c9484d; runas=lab\sneha; pwd=[un1qu3];
Content-Type: application/json

HTTP/1.1 200 OK
{
  "UserId": 42,
  "Name": "lab\\sneha",
  "EmailAddress": "sneha@infosys.lab",
  "SignAppInTime": "2026-06-10T09:14:22Z"
}

And the job market in India is real. Postings for PAM/BeyondTrust run into the hundreds on Naukri and Indeed, and firms like Wipro and UST hire for it. Typical ranges (not guarantees): an L1 PAM/IAM analyst lands around ₹3.5–6 LPA, an L2 admin with 2–4 years ₹6–12 LPA, and senior engineers ₹12–22 LPA, with architects higher. A recurring theme in JDs: they want two PAM tools on your resume — BeyondTrust plus CyberArk or Delinea — because the core skills transfer.