One Identity Safeguard

Digital transformation is expanding organizational attack surfaces through initiatives like digital workplaces, DevOps, security automation, and IoT, increasing both exposure and the variety of digital risks. To remain competitive and compliant without disrupting operations, security leaders need stronger, continuously improving security postures that identify and implement appropriate controls. Privileged Access Management (PAM) is presented as a critical set of cybersecurity controls focused on the risks created by privileged access, which enables unrestricted and often unmonitored activity that violates least-privilege principles and weakens accountability.

Two privileged user categories drive PAM scope: privileged business users who access sensitive information assets via business roles and application accounts, and privileged IT users who administer infrastructure via system, software, or operational accounts. Standard IAM tools are positioned as insufficient for privileged scenarios such as shared accounts, monitoring privileged activity, and controlled elevation; PAM tools address these gaps through techniques like credential vaulting, password rotation, session establishment, delegation, and monitoring, with the market shifting toward analytics, risk-based monitoring, and advanced threat protection within integrated PAM suites.

Key drivers include shared credential abuse, unauthorized elevation, credential hijacking, third-party privilege misuse, and accidental misuse. Operational and regulatory requirements add needs such as discovering shared/service accounts, tracking ownership lifecycle, enabling SSO to target systems, recording sessions for compliance, and governing vendor/MSP and cloud administrative access. Platform-focused privilege management tools for Unix/Linux/Windows add “in-depth” protections (e.g., restricting commands and blocking unwanted elevation) as part of a broader PAM architecture.

One Identity expanded its PAM portfolio via acquiring Balabit (Q1 2018), strengthening session management, behavior analytics, and log management. The resulting Safeguard for Privileged Sessions and Safeguard for Privileged Passwords form the core, complemented by Unix Security and Privileged Account Analytics, delivered on a hardened appliance (and deployable images for AWS/Azure) with unified APIs, reporting, and an integration roadmap. Strengths include session and password management, 2FA integration, and unified capabilities; challenges include incomplete integration of analytics and lack of SaaS deployment.

• Emerging initiatives like digital workplace, DevOps, security automation, and IoT expand organizational attack surfaces and introduce new digital risks.
• Privileged business users access sensitive assets such as HR records, payroll details, financial information, and intellectual property through application accounts and business roles.
• Privileged IT users administer infrastructure using system accounts, software accounts, or operational accounts.
• Privileged accounts often enable unrestricted and unmonitored access, undermining least privilege and limiting individual accountability.
• IAM tools are designed for standard user identity and access management and do not provide key capabilities needed for privileged access scenarios.
• PAM capabilities commonly include credential vaulting, password rotation, controlled elevation and delegation, session establishment, and activity monitoring.
• Advanced PAM capabilities increasingly include privileged user analytics, risk-based session monitoring, and advanced threat protection.
• Balabit was acquired by One Identity in Q1 2018.
• One Identity Safeguard for Privileged Sessions is based on the former Balabit Privileged Session Management.
• One Identity Safeguard is delivered as a hardened appliance and also offered as deployable images in AWS and Azure.

• “To remain relevant, organizations must reinvent themselves by being agile and more innovative.”
• “To stay competitive and compliant, organizations must actively seek newer ways of assessing and managing the security risks without disrupting the business.”
• “Privileged Access Management (PAM) represents the set of critical cybersecurity controls that deal with management of security risks associated with use of privileged access in an organization.”
• “The privileged nature of these accounts provides their users an unrestricted and often unmonitored access across the organization’s IT assets.”
• “Privileged accounts pose a significant threat to the overall security posture of an organization because of their heightened level of access to sensitive data and critical operations.”
• “Privileged Access Management tools are designed to address these scenarios by offering specialized techniques and process controls.”
• “More advanced capabilities such as privileged user analytics, risk-based session monitoring and advanced threat protection are becoming the new norm.”
• “Such tools are an essential element in a holistic Privileged Access Management architecture, delivering the in-depth protection for defined target platforms.”
• “Thus, maintaining them in highly secure environments is a plus.”
• “This allows for implementing unified approaches for Identity Provisioning and Access Governance, covering not only standard user accounts but also the highly privileged and shared accounts.”