What is the difference between a privileged access workstation and a jump server?

What a privileged access workstation is, and what a jump server is not

A privileged access workstation is the trusted endpoint where an administrator starts a sensitive session. Its job is to keep the initial credential entry, browser use, and management tooling away from an ordinary laptop. A jump server is different: it is the intermediary hop that forwards that session onward to Tier 0 or other protected systems.

The distinction matters because the workstation and the hop solve different problems. The workstation reduces the chance that the admin’s starting point is compromised. The jump server reduces direct network exposure to the target system. Treating them as interchangeable usually produces a partial design, not a complete one.

Why the control boundary matters in practice

The privileged access workstation is about protecting the point of origin. If an attacker can keylog, steal tokens, browser-session data, or tamper with the admin desktop, they can compromise the session before the jump server ever becomes relevant. The jump server cannot fix a compromised starting device.

The jump server is about brokering reachability. It gives you a controlled path, often with logging, filtering, and tighter network rules, but it is still only a middle layer. If the admin authenticates from an unmanaged endpoint, the security boundary has already been weakened. That is why the two controls are complementary rather than competing options.

A practical way to think about it is source versus transit: the workstation protects the source of the session, while the jump server constrains the transit path. The wrong assumption is that hardening the transit path alone is enough to protect privileged credentials and high-value administrative actions.

When to use each control, and how they work together

Use a privileged access workstation when the admin session itself is high risk, especially for Tier 0 administration, domain management, cloud control planes, and other tasks where stolen credentials would have immediate blast radius. Use a jump server when you need a tightly governed route into protected networks, legacy segments, or systems that should not be directly reachable from user networks.

In stronger designs, the workstation is hardened for admin use only, and the jump server becomes just one part of the access path. That gives you device hardening at the start, then session brokering, logging, and network restriction in the middle. The Privileged Access Workstations Guide is the most direct reference for how to design that trusted admin endpoint.

If the environment already has a jump server, do not assume the model is complete. You still need device trust, session hygiene, and credential protection at the source. Conversely, if you deploy only a privileged access workstation but still allow direct admin reachability everywhere, you have improved the endpoint but not the access path.

Risk and Threat Considerations

The main risk is false confidence from a single control. A jump server can reduce exposure, but if the admin laptop is infected or unmanaged, the attacker can capture the session before the broker adds value. A privileged access workstation can protect the starting point, but if it can still reach too many targets or is used for everyday work, its trust boundary erodes.

Failure mechanism: The attacker compromises the source device, steals the administrator’s session material, or abuses the jump host as a trusted conduit into protected systems. In that model, the weakest point is whichever control is treated as sufficient on its own.

Impact: Privileged credentials, administrative sessions, and Tier 0 access can be exposed or abused, which can turn a single endpoint compromise into domain-wide or environment-wide control loss.

Practitioner Guidance

What to verify: Confirm that the privileged access workstation is dedicated to admin work, hardened to a stricter baseline than standard user devices, and blocked from casual browsing, email, and general productivity use. Verify that the jump server is not being treated as the primary security boundary just because it is logged and network-restricted.

Decision rule: If the risk is credential theft or session hijack, prioritise workstation hardening and dedicated admin-device controls first. If the risk is uncontrolled network reach, add a jump server or brokered path as the next layer, not the only layer.

Practitioner takeaway: The architectural question is not “which one is better”, it is “where does trust begin, and where is it constrained”. A strong design protects both the endpoint where the credential is entered and the intermediary that carries the session onward.

Related resources from NHI Mgmt Group

• Guide: Secure Remote Access Beyond VPN Guide
• What do teams get wrong about VPNs and jump hosts for privileged web access?
• Who should own privileged access governance for server estates?
• How should security teams extend privileged access controls as they modernise server and identity platforms?
• What breaks when privileged access is managed globally instead of per server group?