Privileged access management (PAM)

Privileged access management is the set of tools and practices used to control, monitor and limit accounts that have administrator or other powerful rights over systems and data.

Privileged accounts can install software, change security settings, read everyone's files or delete backups. PAM covers who gets those rights, how they are protected and how their use is recorded. Common practices include separate administrator accounts, just-in-time access that expires automatically, strong multi-factor authentication and logging of administrative actions.

Attackers who break into an ordinary account usually try to escalate to administrator access, because that lets them disable security tools and spread ransomware across the whole network. In many small businesses, everyday users still have local administrator rights on their computers, or the owner's email account doubles as the global administrator for Microsoft 365.

Practical tip: remove administrator rights from daily-use accounts, give IT staff separate admin accounts used only for administrative tasks, and review the list of privileged users at least every quarter. Store shared admin credentials in a business password manager rather than a spreadsheet.