# session-recording

Source: https://startwithidentity.com/glossary/session-recording/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Session recording is the capture of what happens inside a privileged session (terminal output, commands, screen and mouse activity, database queries) so that it can be watched live, replayed later and searched during an investigation; in [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) it is control AU-14, Session Audit. It is a core feature of [PAM](https://startwithidentity.com/glossary/pam/) and [privileged remote access](https://startwithidentity.com/glossary/privileged-remote-access/) tools.

How it works depends on where the recorder sits. A proxy or bastion in the connection path records every session that passes through it, which is why PAM products broker sessions instead of handing out passwords. An agent on the target host records locally. [Teleport's architecture documentation](https://goteleport.com/docs/reference/architecture/session-recording/) is a useful concrete reference: it captures the full pseudo-terminal output of SSH and `kubectl exec` sessions, records screen and mouse input but not keystrokes for remote desktop sessions, and offers synchronous modes where a failed recording event ends the session and asynchronous modes that buffer locally and upload later.

| Session recording is | Session recording is not |
|---|---|
| Evidence of what a privileged user did | A control that stops the action as it happens |
| A deterrent and an audit artifact | A replacement for removing [standing privilege](https://startwithidentity.com/glossary/standing-privilege/) |
| Searchable replay, often with command indexing | Complete: encoded commands and scripts can hide intent in terminal output |

It matters because auditors and incident responders ask the same question after a breach: what did the admin account actually do. The limits are real. Recordings are large, so retention and storage cost need a decision up front; recordings contain secrets and personal data, so access to them is itself privileged; and a recording reviewed by nobody is only a log. Pair it with [just-in-time access](https://startwithidentity.com/glossary/jit-access/) so there are fewer privileged sessions to record in the first place.

See also: [PAM](https://startwithidentity.com/glossary/pam/), [what is PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/), [implementing privileged access management](https://startwithidentity.com/guides/architecture/implementing-privileged-access-management/), [best PAM tools](https://startwithidentity.com/rankings/best-pam-tools/), [Teleport](https://startwithidentity.com/vendors/pam/teleport/), [privileged access workstation](https://startwithidentity.com/glossary/privileged-access-workstation/)