Privileged access programmes rarely fail at procurement. They fail at scope. A vault gets bought, admin passwords move out of spreadsheets, and the project is quietly declared finished — while laptops keep local admin rights, contractors still arrive through a flat VPN, and nobody has counted the finance accounts that can move money. The measure of a working programme is not how many credentials are stored. It is how many standing privileges were removed, and how many sessions you can replay.
What Does a Credential Vault Actually Fix?
A vault solves a real problem. Shared administrator passwords stop living in spreadsheets and browser profiles, credentials rotate on a schedule, and access can be attributed to an individual rather than to a login that eleven people know.
What it does not do is reduce the number of people who hold administrative power. That distinction gets lost because both things feel like progress, and only one of them shows up in a dashboard.
| Control layer | What it fixes | What stays open |
| Credential vaulting | Shared passwords, unattributed logins, manual rotation | Everyone who needed admin still has admin |
| Session brokering | Users act without ever seeing the password | Nothing recorded outside brokered sessions |
| Just-in-time elevation | Standing rights become time-bound requests | Requires policy design, not just installation |
| Endpoint privilege management | Local admin on laptops and workstations | Server and cloud access, if scoped separately |
| Vendor access control | Third parties reach systems without a flat VPN | Often bought last, if at all |
Read down the right-hand column and the pattern is clear. Each layer closes one gap and exposes the next.
A programme that buys only the first row has improved its password hygiene and left its blast radius almost unchanged. That is not a criticism of vaulting — it is the necessary foundation, and nothing above it works without it. The failure is treating the foundation as the finished building.
Why Is Standing Privilege the Number That Matters?
Standing privilege is access that exists all the time, whether anyone needs it today or not. A domain-admin password five people know. A local admin account on every laptop. A service account nobody has rotated in two years.
It is the quantity that determines how far an intruder travels after the first compromise. It is also, conveniently, countable — which makes it a far better programme metric than licences deployed or accounts onboarded.
Just-in-time access is what reduces it. The user requests a role, a policy or a person approves it, the privilege exists for a defined window, then it lapses. Session recording supplies the other half: the ability to answer, after an incident, who did what on which system and when.
Those two things — time-limited privilege and replayable evidence — are what auditors and incident responders ask for. They are also what regulators increasingly assume you already have. Access control, logging and supplier access all sit inside NIS2 and DORA obligations, and they connect to the wider governance failure described in EBR’s analysis of why most identity programmes secure the wrong identities.
What Should a Complete PAM Platform Cover?
Whatever the vendor, a programme that actually reduces risk has to do six things rather than one:
- Discover privileged and service accounts, including the undocumented ones
- Vault and rotate credentials on a schedule and again after each use
- Inject credentials into sessions so users never see the password
- Record privileged sessions, and allow a live session to be terminated
- Replace standing rights with just-in-time and just-enough elevation
- Broker vendor access without a blanket VPN into the network
Those controls also have to produce evidence an auditor accepts, whether the framework is ISO 27001, PCI-DSS, NIST, or — for European operators — NIS2 and DORA.
The practical question is whether to assemble that from separately licensed modules or buy it consolidated. Teams without a dedicated privileged-access function increasingly favour a unified Privileged Access Management platform — one licence covering vaulting, session control, just-in-time elevation, endpoint privilege management and vendor access, rather than four purchases sequenced across three budget years. Securden is built on that model; the larger enterprise suites cover similar ground with greater depth and correspondingly heavier implementation.
Neither approach is automatically correct. Modular buying suits organisations with the staff to integrate it. Consolidation suits everyone else.
Where Do These Programmes Stop Too Early?
Three places, consistently.
Endpoints. Local administrator rights on workstations remain one of the most reliable initial-access routes available to an attacker. A vault sitting in the data centre does nothing about them, and removing them is political work as much as technical work — which is why it slips.
Vendors and contractors. Third parties are frequently handed broad network access because brokering it properly was scoped as phase two, and phase two rarely arrives. Supplier access is the same exposure examined in EBR’s work on cyber risk in Europe’s global supply chains.
Finance systems. A scope that counts only domain admins misses accounts that can change billing records, export customer files, or approve payments. Those are privileged in practice, whatever the org chart says. In a group finance function that usually means ERP roles and shared accounting logins; in a subsidiary or an MSP-managed client, the same work may run through a much simpler billing workflow, sometimes an invoice generator used to raise and send customer invoices.
The tool can be lightweight. The access question is not. Who can create, edit, download or void an invoice deserves the same treatment as a server admin session: named, time-limited, reviewable.
How Should Teams Test a Platform Before Buying?
Start with the environment rather than a feature grid. Count privileged users, service accounts, and the systems they touch — including finance and billing, not only infrastructure. Decide whether removing local admin is year-one work or year-three work, because that single answer reshapes the shortlist more than any feature comparison will.
Then ask every vendor for two demonstrations:
- Discovery against a non-production slice of your own network. Can the product find privileged accounts you had not already documented? Most organisations find considerably more than they expected.
- A recorded session on a system you actually run. Can an administrator complete a genuine task without ever seeing the password?
A demo built on the vendor’s clean lab answers neither question. The deciding factor, in the end, is usually not capability at all — it is whether anyone will still be administering the platform properly in eighteen months.
What Should Leaders Take From This?
A privileged access programme is not finished when the vault goes live. It is finished when standing privileges have been counted and reduced, when endpoints and vendors and finance systems sit inside the same policy, and when a session from six weeks ago can be replayed on request.
Expect the scope to keep widening. As machine and AI identities come to outnumber human ones inside most enterprises, a growing share of the accounts worth governing will not belong to a person at all.
