BeyondTrust Password Safe

Digital transformation is expanding organizations’ attack surfaces through initiatives like digital workplaces, DevOps, security automation, and IoT, creating new risks that must be assessed and managed without disrupting the business. Privileged Access Management (PAM) addresses the heightened risks created by privileged accounts, which often provide unrestricted, insufficiently monitored access and weaken least-privilege enforcement and individual accountability. Two privileged user categories are emphasized: privileged business users who access sensitive information assets (e.g., HR, payroll, finance, IP) via business roles and application accounts, and privileged IT users who administer infrastructure through administrative roles and system/software/operational accounts. Traditional IAM tools focus on standard identities and do not adequately handle shared accounts, controlled privilege elevation, or monitoring of privileged activities, driving demand for specialized PAM controls.

Core PAM capabilities include credential vaulting, password rotation, privilege elevation and delegation, session establishment, and activity monitoring, with advanced features such as privileged user analytics, risk-based session monitoring, and threat protection increasingly integrated into comprehensive suites. Key drivers include abuse of shared credentials, misuse of elevated privileges (intentional or accidental), credential hijacking, and third-party privilege abuse, along with governance needs like account discovery, ownership tracking, SSO to target systems, compliance auditing/recording, and controlling vendor/MSP and cloud administrative access. PAM solutions must also protect critical server platforms (Unix/Linux/Windows) and adapt to cloud and virtual infrastructure.

BeyondTrust, headquartered in Atlanta and originally founded in 1985 as Symark, is positioned as a leading PAM vendor. Its Password Safe product provides mature shared account password management, vaulting and rotation, SSH key rotation, self-service request/approval workflows including break-glass scenarios, API/CLI-based A2A/A2DB secret retrieval with certificate-based authentication, and DVR-style session recording with live search and policy controls. Integration with the BeyondInsight platform (included in licensing) and Vulnerability Management enables risk-based analytics and response actions, while connectors to SailPoint IdentityIQ and ITSM tools support governance and operational controls; high availability and scaling options are also highlighted alongside noted integration and product-overlap challenges.

• Emerging initiatives including digital workplace, DevOps, security automation, and IoT expand organizational attack surfaces and introduce new risks.
• Privileged business users are defined as users with access to sensitive information assets such as HR records, payroll details, financial information, and intellectual property.
• Privileged IT users are defined as users with access to IT infrastructure supporting the business through administrative roles using system, software, or operational accounts.
• Standard IAM tools are not designed to manage shared accounts, monitor privileged activities, or provide controlled elevation of privileges.
• Key PAM challenges include abuse of shared credentials, abuse of elevated privileges, hijacking of privileged credentials, third-party privilege abuse, and accidental misuse.
• BeyondTrust was founded in 1985 as Symark and is headquartered in Atlanta, Georgia.
• BeyondTrust was acquired by Bomgar in late 2018 and the combined entity retained the BeyondTrust brand.
• The company is privately held with nearly 800 employees and about 20,000 customers worldwide.
• Password Safe supports discovery and rotation of SSH keys alongside password vaulting and policy-based rotation.
• Password Safe can be configured in Active-Passive failover and also offers an Active-Active configuration for linear scaling and resilience.

• “To remain relevant, organizations must reinvent themselves by being agile and more innovative.”
• “Emerging technology initiatives such as the digital workplace, DevOps, security automation and the Internet of Things continue to expand the attack surface of organizations as well as introduce new digital risks.”
• “Privileged accounts pose a significant threat to the overall security posture of an organization because of their heightened level of access to sensitive data and critical operations.”
• “Available Identity and Access Management (IAM) tools are purposely designed to deal with management of standard users’ identity and access and do not offer the capabilities to manage privileged access scenarios such as the use of shared accounts, monitoring of privileged activities and controlled elevation of access privileges.”
• “While credential vaulting, password rotation, controlled elevation and delegation of privileges, session establishment and activity monitoring have been the focus of attention for PAM tools, more advanced capabilities such as privileged user analytics, risk-based session monitoring and advanced threat protection are becoming the new norm.”
• “A specific area is the in-depth protection of server platforms such as Unix, Linux, and Windows.”
• “Password Safe remains BeyondTrust’s flagship Shared Account Password Management (SAPM) product offering a mature password vaulting and credential management solution in addition to privileged session management features.”
• “Wherever a username/password combination is used in an application or script, it can be simply substituted by the API call to retrieve the password dynamically from the Password Safe.”
• “Offering session recording in DVR-style, Password Safe also supports live session search and role-based activity review and replay.”
• “The host-centric approach for privileged access management offers more granular control and better management of target platforms and resources than the proxy-based approach.”