Break-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a real incident.
Break-glass accounts fail in two directions. Untested, they do not work during the outage they exist for, usually because they depend on the SSO or MFA service that is down. Untested and unmonitored, they become a standing backdoor that nobody notices being used. The rule that survives audit is: excluded from conditional access, credentials split and vaulted, every use alerts immediately, and the whole path is exercised on a schedule.
See also: what is PAM, zero standing privileges, just-in-time access, PAM vendors
Related on Start with Identity
- GlossaryShared Account
A shared account is a single set of credentials used by more than one person, or by a function rather than a person, such as a team mailbox, a kiosk or front-de
- GlossaryIAM
IAM stands for Identity and Access Management. Workforce identity for employees, contractors, and partners. Covers authentication, authorization, lifecycle, and
- GlossaryInstance Metadata Service (IMDS)
The instance metadata service (IMDS) is an HTTP endpoint reachable only from inside a cloud virtual machine, at 169.254.169.254 on AWS EC2, that returns data ab
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M