PAM
Privileged Access Management — systems and procedures for controlling, monitoring, and securing the most powerful accounts (admins, root, service accounts). Since privileged accounts are attackers' main target, they get extra layers of protection.
Features: a password vault (admin passwords are stored centrally and fetched when needed, no one knows them by heart), automatic rotation (passwords are changed often/after each use), session brokering and recording (the admin logs in through the PAM system, which records what's done — for auditing and forensics), JIT access (elevate only temporarily), and approval flows. Use case: no one should know the root password, every privileged action should be traceable, and standing admin access should be minimized. It protects against both external attackers (who hunt admin accounts to take control) and insider threats. Examples: CyberArk, Delinea, HashiCorp Boundary/Vault. A cornerstone of identity security, tightly interwoven with JIT and least privilege. Related to JIT access and break-glass access.