Privileged Remote Access (PRA)
Privileged remote access (PRA) is the brokering of administrative sessions to servers, network devices, databases and OT systems for remote employees, vendors and contractors through a gateway that authenticates the user, injects or hides the credential, limits the session to named systems and records it, without giving the user a VPN connection to the network. It is a component of PAM, sold separately by some vendors.
| VPN | ZTNA | Privileged remote access | |
|---|---|---|---|
| What the user reaches | A network segment | Specific applications | Specific privileged sessions (SSH, RDP, database, web console) |
| Credential handling | User holds their own | User holds their own | Vaulted credential injected; the user never sees it |
| Session recording | No | Usually logs, not recordings | Yes, a core feature |
| Approval and time limits | Rare | Policy-based | Per-session approval, just-in-time windows |
The pattern grew out of vendor and remote-support access, which is still the strongest use case: a third-party engineer needs two hours on one controller, not standing VPN access. BeyondTrust, whose roots are in remote support, is the PAM vendor most associated with the category, and it covers employee and third-party sessions alongside password and session management; infrastructure access tools such as Teleport and StrongDM (acquired by Delinea in March 2026) apply the same model to engineers. Teleport's documentation, for instance, records full terminal output for SSH and screen activity for remote desktop.
It matters because remote access tools are a favored entry point: a vendor account with a VPN and a shared password is standing privilege held by someone outside your directory. PRA replaces that with an identity-bound, time-boxed, recorded session. The tools themselves are targets too: pre-authentication command injection in BeyondTrust Remote Support (CVE-2026-1731), technician-to-admin escalation in SimpleHelp (CVE-2024-57726), an authentication bypass in N-able N-central (CVE-2026-18556), unconfirmed file execution through ScreenConnect sessions (CVE-2026-84869) and a password-free login to macOS Screen Sharing (CVE-2026-65400) are all in CISA's Known Exploited Vulnerabilities catalog, as is an Ivanti Endpoint Manager bypass that exposed stored credential data (CVE-2026-1603). Keep the remote access server itself patched and off the open internet where you can. Check that vendor users authenticate with phishing-resistant MFA, ideally federated from their own employer, and that sessions end when the approval window closes.
See also: third-party access management practices, privileged access workstation, standing privilege, best PAM tools, what is PAM
Related on Start with Identity
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryCredential Brokering
Credential brokering is the pattern in which an intermediary fetches a credential from a vault or credential store at the moment of access and hands it to an al
- GlossaryIAM
IAM stands for identity and access management: the policies, processes and technology an organization uses to make sure the right identities (people and machine
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a