BeyondTrust Cloud Privilege Broker

Many successful cyber-attacks exploit an organization’s own privileged accounts, often enabled by weak access management software, policies, and processes. As organizations accelerate digital transformation by moving to cloud infrastructures, insufficient control over cloud access has introduced new vulnerabilities. Key risks include abuse of shared credentials, unauthorized use of elevated privileges, theft of privileged credentials, and misuse of privileges on third-party systems accessed via the cloud.

Privileged access is no longer limited to a small group of administrators working mainly on on-premises networks. Modern privilege management now spans entire organizations, supporting task-based access to data, services, and applications across legacy systems and multi-cloud environments while still enabling traditional administrative work. This expansion has driven rapid evolution in Privileged Access Management (PAM) platforms and growing interest in Least Privilege architectures. Modern PAM must extend beyond traditional designs to support cloud environments and SaaS services.

The text describes an emerging “Dynamic Resource Entitlement and Access Management (DREAM)” paradigm, where ultra-hybrid IT blends multiple clouds with on-premises networks, partner networks, and sometimes mainframes. This environment demands solutions that can deliver controlled, rapid access to dynamic and ephemeral resources, supported by advanced monitoring and unified cross-cloud control. As a step toward DREAM, PAM vendors are adding Cloud Infrastructure Entitlement Management (CIEM) capabilities.

BeyondTrust’s Cloud Privilege Broker is presented as a foundational CIEM capability within BeyondTrust’s Universal Privilege Management Portfolio. Built on the BeyondInsight console, it offers continuous entitlement discovery, centralized dashboards, risk scoring, and actionable recommendations to enforce least privilege across multi-cloud IaaS. It currently monitors AWS and Azure (with a third provider planned), offering strong value for BeyondTrust customers while facing challenges in broader cloud-provider coverage and standalone CIEM positioning.

• Many successful cyber-attacks involve misuse of an organization’s own privileged accounts.
• Malicious activities of concern include abuse of shared credentials, misuse of elevated privileges by unauthorized users, theft of privileged credentials, and abuse of privileges on third-party systems accessed via the cloud.
• Privileged accounts were traditionally assigned mainly to a small set of administrators for maintenance and upgrades on on-premises networks.
• Privilege management use cases now extend across entire organizations, including task-based access across legacy systems and multi-cloud infrastructures.
• BeyondTrust is a US-based Privileged Access Management vendor and was named a Leader in the 2021 KuppingerCole PAM Leadership Compass.
• BeyondTrust’s PAM portfolio includes Password Safe, DevOps Secrets Safe, Endpoint Privileged Management products, Remote Support, Privileged Remote Access, and Cloud Privilege Broker.
• Cloud Privilege Broker is built on the BeyondTrust BeyondInsight console used for administration of other BeyondTrust PAM products.
• Cloud Privilege Broker can monitor activity across AWS and Azure, with a third cloud provider on the roadmap.
• Licensing and pricing are based on the number of AWS accounts or Azure subscriptions used by the customer.
• The discovery process can find users, groups, roles, and service principals, and auto-classifies permission risk as high, medium, or low.

• “Interest in Least Privilege architecture and policies has also grown as organizations look to secure the cloud.”
• “The future of business operations will revolve around a new paradigm of a highly dynamic IT architecture that melds multiple cloud platforms with legacy networks on premises, partner networks, and even, in some cases, mainframe installations.”
• “These new, ultra-hybrid networks will push existing identity and security frameworks to their limit and call for solutions that provide controlled, rapid access to dynamic, often ephemeral resources, wherever they exist.”
• “Much of the development around Cloud Privilege Broker is focused on providing much more granular control of privilege in high-risk environments, such as multi-cloud.”
• “BeyondTrust has applied its longstanding expertise in PAM to create a single tool that provides continuous discovery of entitlements and centralized management and reporting from a familiar dashboard interface.”
• “The dashboard helps administrators detect and review anomalies in account permissions, ensure access from only trusted sources, and provide easily deployable recommendations for enforcement of least privilege policies.”
• “The discovery process is comprehensive.”
• “The user interface of BeyondTrust Cloud Privilege Broker is easy to understand and meets the demands of delivering data quickly to enable better decision-making.”
• “Any product that can work around these standards, streamlining access, and providing risk-based insight into what’s happening in the cloud is welcome.”
• “Given AWS and Azure’s dominance of the cloud market, the initial release of Cloud Privilege Broker is a robust and well-designed cloud entitlements management solution.”