Privileged Access Management

The KuppingerCole Leadership Compass on Privileged Access Management (PAM) frames PAM as a core IAM-linked cybersecurity control set that has shifted from simple credential vaulting toward breach prevention, credential-theft resistance, and automated mitigation. Digital transformation initiatives (digital workplace, DevOps, security automation, IoT) expand attack surfaces and force security leaders to improve posture without disrupting operations. PAM addresses risks created by privileged business users (access to sensitive data via business roles) and privileged IT users (administrative access to infrastructure), whose broad, often shared and weakly monitored access undermines least privilege and accountability.

The document defines PAM as a market containing multiple functions: Shared Account Password Management, Privileged Session Management, Application-to-Application Password Management, Session Recording and Monitoring, Controlled Privilege Elevation and Delegation, Privileged User Behavior Analytics, Privileged Account Discovery and Lifecycle Management, Endpoint Privilege Management, and Privileged Access Governance. Evaluation emphasizes integrated suites, strong reporting/audit/compliance, and integration into existing security stacks (SIEM/SOC, IAM, governance, ITSM). Architectural considerations include target-system breadth, cloud support, multi-tenancy, high availability, deployment models (appliance, SaaS, managed), and usability.

Leadership ratings are split into Product, Innovation, and Market Leadership, plus an Overall view, and correlated matrices show weak correlation between market presence and product strength in an evolving, increasingly crowded market. Overall Leaders are BeyondTrust, CA Technologies, Centrify, CyberArk, One Identity, and Thycotic, with CyberArk consistently leading and BeyondTrust close behind. Vendor analyses highlight differentiation such as database command control (ARCON), merged-platform breadth with integration challenges (BeyondTrust), machine-learning threat analytics and Unix-AD bridging (CA, Centrify), DevOps secrets management (CyberArk), SMB value positioning (ManageEngine), task-based privilege execution (Osirium), and strong suite evolution with limited cloud/analytics gaps (WALLIX).

• The PAM market segment evaluated includes on-premises and cloud-delivered Privileged Access Management solutions.
• Two primary privileged user types are privileged business users and privileged IT users.
• Key PAM challenges include abuse of shared credentials, abuse of elevated privileges by authorized users, hijacking of privileged credentials, abuse on third-party systems, and accidental misuse of elevated privileges.
• KuppingerCole classifies PAM into SAPM, PSM, AAPM, SRM, CPEDM, PUBA, PADLM, EPM, and PAG functions.
• The market is described as getting crowded, with about 3–4 new vendors entering in the last year.
• About 20 vendors are represented in the Leadership Compass, with 10 other notable vendors listed as “vendors to watch.”
• Overall Leaders listed are BeyondTrust, CA Technologies, Centrify, CyberArk, One Identity, and Thycotic.
• CyberArk retains the leadership position in the Overall Leadership evaluation, with BeyondTrust following closely.
• ManageEngine Password Manager Pro is launched in 2007 and is positioned as popular in the SMB segment with large customer count and smaller deal sizes.
• CyberArk is described as originating in Israel in 1999.

• “PAM has emerged as one of the most crucial IAM technologies that has a direct relevance and impact on an organization’s cybersecurity program.”
• “Once considered a technology option for optimizing administrative efficiency by managing passwords and other secrets, PAM has evolved into a set of crucial technologies for preventing security breaches and credential thefts.”
• “A successful attack can be conducted in minutes; therefore, a PAM solution must be capable of thwarting this attack without human intervention.”
• “Providing tightly integrated offerings that cover all major features is one of the criteria we have high on our list, given that customers prefer such integrated approaches over a variety of disparate, non-integrated or only loosely coupled offerings.”
• “Vendors are taking different approaches to solve the underlying problem of restricting, monitoring, and analyzing privileged access and the use of shared accounts.”
• “Innovation is what customers require for keeping up with the constant evolution and emerging requirements they are facing.”
• “The matrix shows a picture that is typical for evolving market segments… and a weak correlation between Market Leadership and Product Leadership.”
• “Privileged accounts pose significant threat to the overall security posture of an organization because of their heightened level of access to sensitive data and critical operations.”
• “Available Identity and Access Management (IAM) tools… do not offer the capabilities to manage privileged access scenarios such as managing access to shared accounts, monitoring of privileged activities and controlled elevation of access privileges.”
• “A strong focus will be put on integration into existing security infrastructures to provide consolidated monitoring, analytics, governance or compliance across multiple types of information stores and applications.”