Service — Privileged Access Management
A stolen admin password shouldn't be a master key
PAM secures, controls and monitors the accounts that can do the most damage: administrators, root, domain admins and service accounts. Kommando vaults and rotates the credentials, records privileged sessions, and moves you toward zero standing privilege, delivered on CyberArk across the Nordics.
Start with a discovery: see every privileged account before you change anything.
- One admin account can reach every machine
- Standing access is a target 24/7, used or not
- Stolen admin credentials sell for double
What is PAM?
Securing the accounts that hold the keys to the kingdom
Privileged Access Management (PAM) secures, controls and monitors the accounts that hold elevated access: administrators, root, domain admins, service accounts and emergency access. It vaults those credentials, rotates them automatically, brokers and records privileged sessions, and grants elevated access only when it’s needed.
Every environment has a small number of accounts that can do enormous damage. A domain admin can reach every machine. A database admin can read every record. A service account tied to a backup job might have standing access to half the estate, known to nobody.
PAM has two jobs. First, secure the credentials: put them in a hardened vault, rotate them automatically, so no human ever needs to handle the actual password. Second, control what happens when privilege is used: broker the session, record it, and grant elevated access only for as long as the task takes.
Done well, PAM changes the economics of an attack. Steal an ordinary password, get ordinary access. Steal an admin password, get everything, which is why admin access sells for roughly double a standard account. PAM removes the standing password that makes that possible.
- Administrators & root
- Domain admins
- Service accounts
- Emergency (break-glass) access
- Endpoint admin rights
Standing vs just-in-time
Standing privilege vs just-in-time
The old model gives administrators permanent, always-on access, whether they’re using it or not. The modern model grants privilege only when it’s needed, for only as long as the task takes. That’s just-in-time (JIT), and its end state is zero standing privilege.
| Standing privilege | Just-in-time (JIT) | |
|---|---|---|
| Access model | Permanent, always-on admin rights | Time-limited, granted on request |
| Attack window | 24/7, whether used or not | Only during the task |
| A stolen credential gets | Full standing access | Nothing, once the window closes |
| End state | Standing accounts everywhere | Zero standing privilege |
The platform
The six capabilities of a working PAM programme
Privilege discovery
You can’t protect privileged accounts you don’t know about, and there are always more than the list says. The first step is finding every privileged and service account across the estate, including the ones created years ago and never removed.
Credential vaulting & rotation
Privileged credentials go into a hardened, encrypted vault. Passwords rotate automatically, and administrators check out access without ever seeing the underlying credential. A password that changes on every use is useless once stolen.
Session management & monitoring
Privileged sessions are brokered through the platform, isolated from the endpoint, and recorded. When something goes wrong, or an auditor asks, there’s a full recording of exactly what was done, by whom, and when.
Just-in-time privileges
Instead of standing admin rights, access is granted on request, for a set window, and revoked automatically. This is the single biggest reduction in privileged risk available, and the direction every mature PAM programme is heading.
Least privilege & endpoint control
Removing local admin rights from endpoints and elevating only specific applications closes one of the most common paths from a single clicked link to a compromised machine. This is where PAM meets everyday user security.
Audit & compliance
Every checkout, session and elevation is logged. The evidence auditors and regulators want, who accessed which system, when, and with what approval, is a report rather than a scramble.
Why now
Why PAM matters now
Privileged accounts have always been the prize. What’s changed is how routinely they’re targeted, and how much standing privilege most organisations are still carrying.
Credentials are the way in. Verizon’s Data Breach Investigations Report has for years found that the majority of breaches involve credential misuse, and privileged credentials are the ones that turn a foothold into a full compromise.
Regulators expect it. NIS2, implemented in Norway as the Digitalsikkerhetsloven, and DORA for financial entities both require controlled, auditable access to critical systems. Privileged access is precisely the access these regulations care about most.
of breaches involve credential misuse (Verizon DBIR)
admin access sells for roughly double a standard account
smaller privileged attack surface with just-in-time access
By sector
PAM by sector
The risk is universal, but the pressure lands hardest where privileged accounts are most concentrated.
Financial services
BFSI carries the largest share of privileged accounts and the strictest obligations (DORA, internal audit). This is where session recording, vaulting and Segregation of Duties around privileged access are non-negotiable.
Public sector
NIS2, legacy systems and long-standing admin accounts combine into significant privileged debt. PAM brings it under control without ripping everything out at once.
Energy & utilities
OT/IT convergence means privileged access now spans both corporate systems and critical infrastructure, where a compromised admin account has physical consequences.
Healthcare
Privileged access to systems holding patient data under GDPR has to be controlled and provable, across a workforce that includes many rotating and temporary staff.
Our approach
How Kommando delivers PAM
Discovery
We find every privileged and service account across your estate before touching a vault. The list is always longer than the one you had, and the inventory alone is usually worth the engagement.
Design
Vault architecture, rotation policy, session controls and the just-in-time model, sequenced so you reduce the highest risks first.
Implementation
Certified consultants deploy the platform and onboard privileged accounts in controlled waves, starting with domain admins, service accounts and the highest-risk systems.
Managed services
We run, tune and extend the platform after go-live, and help you move from standing privilege toward just-in-time over time.
The hardest part is rarely the vault. It's the discovery that surfaces the accounts nobody owns, and the discipline to move away from standing privilege once the platform is in.
A note on what PAM doesn't fix
PAM secures privileged access; it doesn't govern ordinary access, and it won't fix a privileged account nobody agreed should exist. The hardest part is rarely the vault. It's the discovery that surfaces accounts nobody owns, and the discipline to move away from standing privilege once the platform is in. A vault full of permanent admin accounts is safer than none, but it isn't the goal.
Frequently asked questions
Questions we actually get
What is Privileged Access Management (PAM)?
PAM is the practice of securing, controlling and monitoring accounts with elevated access, such as administrators, root, domain admins and service accounts. It vaults privileged credentials, rotates them automatically, brokers and records privileged sessions, and grants elevated access only when it’s needed, so a stolen admin password stops being a master key.
How does privileged access management work?
PAM puts privileged credentials in a hardened vault and rotates them automatically, so administrators check out access without ever handling the real password. Privileged sessions are brokered through the platform, isolated and recorded. Increasingly, access is granted just-in-time: elevated rights are issued on request for a set window and revoked afterwards, leaving nothing standing for an attacker to steal.
What is the difference between PAM and IAM?
IAM (Identity and Access Management) governs authentication and access for the general population of users. PAM focuses on the small, high-risk subset of accounts with elevated privileges. IAM lets the right people in; PAM makes sure the most dangerous accounts are vaulted, monitored and used only when needed. Most organisations need both.
What is just-in-time (JIT) access and zero standing privilege?
Just-in-time access grants privileged rights only when they’re needed, for a limited window, and revokes them automatically. Zero standing privilege is the end state: no permanent admin rights for anyone to steal. Together they can shrink the privileged attack surface by more than 90%, because there’s far less standing access exposed at any moment.
What is vaultless PAM?
Vaultless PAM issues short-lived, just-in-time credentials instead of storing long-lived privileged passwords in a vault, which suits cloud-native and ephemeral environments. In practice most organisations use both models: a vault for long-lived privileged accounts and just-in-time issuance where infrastructure is short-lived. We help you find the right balance.
Which PAM platform should we use?
The right platform depends on your environment, but CyberArk is the platform we most often implement for enterprise PAM in the Nordics, and Kommando is CyberArk’s 2024 Certification Partner of the Year in EMEA. More important than the product is the design: the discovery, the vault architecture, the session controls and the path toward just-in-time access.
Do you offer PAM in the Nordics?
Yes. Kommando delivers Privileged Access Management across Norway, Sweden and Denmark, with certified consultants in Oslo, Gothenburg, Stockholm and Copenhagen. You get local delivery, in your language and time zone, from people who have implemented PAM in regulated Nordic environments.
Do you offer managed services for PAM?
Yes. Many organisations stand up a vault and then struggle to keep rotation healthy, onboard new accounts, and move toward just-in-time. We run and extend the platform after go-live, which is often more realistic than staffing a dedicated PAM team in-house.
Next step
Find out what your privileged accounts are actually doing
A discovery engagement maps every privileged and service account across your estate, usually surfacing more than anyone expected, and shows where the standing privilege and biggest risks sit. If you want to talk through where you’re at, we’re happy to help.
- Full inventory of privileged and service accounts
- A path from standing privilege toward just-in-time
- Delivered locally in Norway, Sweden and Denmark
Oslo · Gothenburg · Stockholm · Copenhagen
