Privileged access management, by ear

Why PAM matters, how to sell a PAM program to management, how to choose PAM products, and ways to shrink the privileged attack surface.

What the federal GSA and CISA privileged identity playbook covers, explained by two government practitioners involved with it.

How the PAM market is changing, including the role of cloud infrastructure entitlement management (CIEM), mergers, and new vendors.

Common PAM program challenges and the move toward zero standing privilege, just-in-time access, CIEM, and lower user friction in PAM adoption.

What is driving change in privileged access management, predictions for where PAM is heading, and how it relates to the identity governance market.

How vendor consolidation is bringing PAM and IGA together and why identity systems need tighter integration with the wider security stack.

How just-in-time access works, how it relates to zero standing privileges, and where it fits across cloud, on-prem, Snowflake, and DevOps automation.

Why role-based access falls short, how event-time data can support dynamic access decisions, and what it takes to move toward zero standing privilege.

How cloud IAM differs between GCP and AWS, why resource hierarchy and policy inheritance matter, and the tradeoff between least privilege and zero standing privilege.

A firsthand account of how NotPetya spread through Merck via one overprivileged service account, which identity weaknesses were exploited, and how recovery went.

How a prototype uses Azure Functions, Key Vault, and Entra ABAC so developers can impersonate service principals under four-eyes approval and least privilege.

How privilege shifted from admin accounts to runtime capabilities, PAM convergence with IGA, CIEM and ITDR, machine privilege, just-in-time gaps, and deployment sovereignty.

Why PAM models built for human admins fall short for AI agents, service accounts, and APIs, and how privilege management must change to cover both.

How to design a Bastion Forest PAM setup for on-prem Active Directory using Entra PIM for Groups, group write-back, phish-resistant credentials, and privileged access workstations.

What Tier 0 assets are, how attack paths through Active Directory lead to them, and how to manage those paths in hybrid AD environments.