PAM for Managed Service Providers as an Added Value and Security Option

Privileged Access Management (PAM) has traditionally been deployed on-premises, but expanding identity sprawl across cloud and digital services is driving cloud-based PAM and, increasingly, PAM delivered “as a service” by Managed Service Providers (MSPs). This shift promises client benefits—reduced deployment burden, scalability, flexibility, and automatic updates under strict contracts—but it also introduces high risk because clients must entrust credential security and authentication to a third party. PAM is positioned as a critical cybersecurity control because most successful cyberattacks involve misuse of privileged accounts, often enabled by weak tools, policies, or processes. Privileged risks include shared credential abuse, unauthorized privilege elevation, credential theft, and third-party system misuse, all intensified by decentralized IT, remote endpoints, and multi-cloud architectures.

MSPs face unique complexity: hosting thousands of tenants while ensuring strict segregation of each client’s data and networks. Their ability to govern privileged access directly impacts SLAs and market competitiveness. Ransomware targeting MSPs amplifies urgency because attackers can compromise an MSP and then pivot into its clients; a June 2021 Sweden incident leveraged a malicious Kaseya update to breach at least 20 MSPs and encrypt data across roughly 1,000 client organizations, forcing Coop to close most of its 500 stores due to payment outages. In parallel, proliferating privacy and cybersecurity regulations (e.g., GDPR, EU NIS 2.0, US executive order, UK GDPR, and fragmented US state laws) increase both compliance pressure and reputational stakes.

The document outlines capabilities required for PAMaaS, including strong multi-tenant administration, broad authentication support, lean cloud-native architecture, and advanced functions such as PADLM, AAPM, CPEDM, remote privileged access, JIT privileges, SSO integration, behavioral analytics, and account discovery. ARCON’s modular PAM suite is presented as supporting SaaS/PAMaaS models with secure tunneling or TLS-based application streaming, centralized or regionalized deployments, multi-tenant partitioning, extensive integrations, high availability, discovery, session monitoring, and JIT controls.

• Potentially malicious privileged access from an unknown host accounted for 74% of all privileged access anomaly behavior detections in a 2020 RSA Conference report.
• PAM platforms have been in the market for around 20 years.
• MSPs are being targeted by ransomware gangs to both disrupt MSP operations and use MSP access to reach client networks.
• A June 2021 attack in Sweden affected more than 1,000 companies, including the Coop grocery chain.
• Attackers abused a malicious update associated with Kaseya, an IT management software provider used by MSPs and enterprises.
• At least 20 MSPs were breached in the Sweden incident, with about 1,000 clients having data encrypted.
• Coop was forced to close all but five of its 500 stores after payment systems stopped working when its MSP, Visma EssCom, was impacted.
• Under GDPR, the Data Controller is liable for privacy breaches, while the MSP is classified as the Data Processor.
• ARCON was founded in 2006 and is based in Mumbai, India.
• ARCON PAM SaaS reports more than 300 integrations available through a GUI.

• “The message is clear: hackers are actively targeting privileged accounts as the best way to get inside an organization.”
• “MSPs can be hosting thousands of tenants on clouds and data centres and this complexity demands rigorous security to ensure that individual client data and networks are protected and sequestered.”
• “Handing over responsibility for Privileged Access Management to a third party is a big deal and involves high levels of trust.”
• “Put service before profit.”
• “A single incident that shows the vulnerability inherent in our multi-connected IT landscapes where an attack on one company can affect so many others.”
• “Implementing JIT within PAM can ensure that identities have only the appropriate privileges, when necessary, as quickly as possible and for the least time necessary.”
• “Do not enter this market blind or list PAM capabilities without a full understanding of the market for PAM and the security risks inherent in unprotected privilege accounts.”
• “Survey the PAM vendor landscape and choose the technology that is most suited to your operations and that of your clients.”
• “While the client may have to pay the fines, the MSP is not going to dine out on a damaged reputation and will probably lose business.”
• “The world is moving to ensure that all businesses take greater responsibility for data governance, whether they be Data Controllers or Data Processors.”