Notifications
Clear all
Topic starter
21/08/2026 4:51 pm
TL;DR: Shared administrative credentials, insecure remote access, and weak auditability leave SMB privileged access exposed, according to Devolutions. The control gap is not just password storage but governance over who can use elevated access, when, and under what traceable conditions.
NHIMG editorial — based on content published by Devolutions: Exploring privileged access management for SMB
Questions worth separating out
Q: What breaks when SMBs rely on standing privilege for administrators?
A: Standing privilege creates persistent exposure that outlives the original task, especially in small teams where admins wear multiple hats.
Q: Why do remote administration tools increase fraud and lateral movement risk?
A: They concentrate privilege, reach, and persistence in one channel, which means compromise of the tool often equals compromise of the environment it can manage.
Q: How do organisations know if PAM is actually working?
A: PAM is working when elevated access is temporary, sessions are observable, and revoked rights do not reappear outside approved workflows.
Practitioner guidance
- Remove shared administrative credentials Replace common admin passwords with named accounts or brokered access so every privileged action can be tied to a specific operator and task.
- Broker privileged sessions instead of exposing passwords Use a vault or PAM workflow that injects credentials into the session and prevents users from seeing or reusing the secret.
- Record and review privileged sessions Enable session recording and event logs for remote administration so security teams can reconstruct changes, confirm authorisation, and investigate misuse.
What's in the full article
Devolutions' full white paper covers the operational detail this post intentionally leaves for the source:
- How Devolutions positions PAM for SMB-specific constraints around cost, deployment complexity, and management overhead.
- The product-level workflow for check-in, check-out, brokering, and session handling across remote access use cases.
- Deployment and integration details for Windows, SQL Server, Active Directory, and remote administration tooling.
- The vendor's implementation view of password rotation, role-based access, and alerting for privileged account use.
👉 Read Devolutions' white paper on privileged access management for SMBs →
Shared admin rights in SMBs: what PAM teams need to fix?
Explore further
21/08/2026 5:09 pm
Shared admin access is a governance failure, not just a password problem. Once multiple people can use the same privileged account, attribution collapses and access becomes impossible to certify cleanly. That undermines PAM, audit, and recertification workflows at the same time. The practitioner conclusion is simple: identity governance must be able to prove which person used which privilege for which task.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how thin the operational margin still is.
A question worth separating out:
Q: Who is accountable when privileged access is misused in a public service environment?
A: The organisation is accountable for proving that access was authorised, proportionate, and traceable at the time of use. That requires clear ownership for the business role, the access approver, and the system administrator who granted elevation. Without that chain of responsibility, incident response and compliance reporting both become much harder.
👉 Read our full editorial: Privileged access management for SMBs still breaks on shared admin rights
