cyber.hendryadrian.com
Security Report · github.com

KuppingerCole Report Examines PAM Shift Toward Machine Identities and Just-in-Time Access

· Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

KuppingerCole’s PAM report describes a shift from account vaulting toward governing privileged actions across human, machine and AI identities, comparing vendors’ just-in-time access, secrets protection and session controls.

Key points

  • The report frames privilege around what an identity can do, extending PAM beyond administrator accounts to service accounts, APIs, automation pipelines and AI agents.
  • KuppingerCole identifies securing non-human identities, discovering privileged access, managing cloud entitlements and implementing just-in-time access as major enterprise challenges.
  • PAM is converging with identity governance, threat detection, secrets management and cloud entitlement controls, with greater emphasis on real-time access enforcement.
  • Vendor evaluations identify material differences in ephemeral credentials, endpoint privilege management, DevOps integration and OT/ICS coverage; these capabilities are not universal.
  • The report distinguishes SaaS access governance from full PAM: time-bound application access and access reviews do not replace credential vaulting, session controls or secrets protection.
  • Deployment flexibility remains important for regulated and data-sensitive organizations, while simpler modular offerings address smaller organizations’ operational constraints.

Article Details

Publisher
KuppingerCole
Scope
Leadership Compass assessment of PAM vendors, product capabilities, innovation, market presence, and deployment models across human, non-human, and AI identities.
Recommendations
  • Do not treat CloudEagle.ai as a substitute for credential vaulting, session control, or secrets protection.
  • Use Pathlock Cloud as a complementary application-layer governance control rather than a replacement for traditional PAM.
  • Align PAM deployment models with organizational regulatory, data sovereignty, and sensitive-data requirements.

Vendors

BroadcomBroadcom – Symantec PAMCloudEagleCloudEagle – CloudEagle.aiDelineaDelinea – Delinea PlatformKeeper SecurityKeeper Security – KeeperPAMManageEngineManageEngine – PAM360OktaBroadcom integrates with IdPs such as Okta and MicrosoftOne IdentityBroadcom SiteMinder, IBM Security Verify, Microsoft Entra ID, Okta, One Identity, and Ping Identity.Palo Alto NetworksPalo Alto Networks (formerly CyberArk) – The Idira Identity PlatformPathlockPathlock – Pathlock CloudPing IdentityCross Identity integrates with multiple IdPs, such as Microsoft Entra ID, Ping Identity, Okta, Keycloak, OneLogin,SaviyntSaviynt – Saviynt Identity CloudSectonaSectona – Sectona Security PlatformSeguraSegura – Segura 360° Privilege PlatformSSHThe platform protects privileged human accounts, application-to-application access, SSH keys, and a growing set of

Products

CloudEagle.aiCloudEagle – CloudEagle.aiDelinea PlatformDelinea – Delinea PlatformIdira Identity PlatformPalo Alto Networks (formerly CyberArk) – The Idira Identity PlatformKeeperPAMKeeper Security – KeeperPAMOkta Privileged AccessOkta – Okta Privileged Access (OPA)One Identity Safeguard SuiteOne Identity – One Identity Safeguard SuitePAM360ManageEngine – PAM360Pathlock CloudPathlock – Pathlock CloudPingOne PrivilegeIts PAM offering, PingOne Privilege, reflects this broader identity focus and operates less as a traditional vaultPrivXSSH – PrivXSaviynt Identity CloudSaviynt – Saviynt Identity CloudSectona Security PlatformSectona – Sectona Security PlatformSegura 360° Privilege PlatformSegura – Segura 360° Privilege PlatformSymantec PAMBroadcom – Symantec PAM