Privileged Access (PAM) Executive Briefing

A small number of accounts can switch off security, delete backups, read every mailbox and change every payment, and in most organisations nobody at board level knows how many of those accounts exist or who holds them. Privileged access management (PAM) is the set of controls that decides who gets those powers, for how long, from which device and under what supervision. This briefing is for directors, chief executives, audit and risk committee members, CFOs and CISOs who need to judge privileged access risk in business terms, ask management the right questions and fund the right things in the right order. It deliberately stays above technology choices: the controls are explained in the Privileged Access Management Guide and the scoring in the PAM Maturity Model.

The risk in one paragraph

Privileged accounts are the administrator, root, domain administrator, cloud owner and "super admin" identities that run the business's systems, plus the service accounts, API keys and automation tokens that do the same job without a person behind them. An attacker who gets one does not need to break anything else: they can create new accounts, disable logging and endpoint protection, export data and deploy ransomware to every machine at once, all while appearing as a legitimate administrator. Privileged access is also where three other risks meet: insiders who abuse their rights, suppliers and managed service providers who hold administrator access into the estate, and the remote support and PAM tools themselves, which become prime targets because they hold the keys to everything else. The board's exposure is set by how many such powers exist, how long they stand, and whether their use is seen.

Why this is a board-level issue now

Attackers escalate by logging in, not by hacking. CISA's analysis of 143 risk and vulnerability assessments in fiscal year 2023 found Valid Accounts behind 45 per cent of privilege escalation instances, and the US Coast Guard reached Domain Administrator by cracking password hashes in 89 per cent of its assessments.
Excess privilege is a top-ten misconfiguration. The joint CISA and NSA advisory AA23-278A lists improper separation of user and administrator privilege as the second of its ten most common misconfigurations, citing privilege creep, service accounts with high privileges, and administrators using elevated accounts for routine work.
Basic controls are slipping. The UK Cyber Security Breaches Survey 2025 found 68 per cent of businesses restrict IT admin and access rights to specific users, down from 73 per cent in 2024.
The privileged tools are themselves targets. In December 2024 a stolen API key for a remote support product led to a major incident at the US Treasury. See the BeyondTrust breach analysis and Remote access and PAM vendors as tier-zero suppliers.
Machine accounts now outnumber people. Service accounts, cloud roles and automation tokens often hold permanent administrator rights, never prompt for MFA and are reviewed by nobody. See the Board Briefing: NHI Risk.

Where privileged access sits in the business

Boards do not need a list of systems, but they should know which categories of privilege would end the business's ability to operate if misused, and ask for each to be owned.

Privilege category	Examples	Worst-case business impact	What management should evidence
Identity control plane	Domain administrators, identity provider super administrators, cloud tenant global administrators	Attacker controls every login and can lock the business out	Single-digit standing count, phishing-resistant MFA, just-in-time elevation, alerts on every change
Infrastructure and cloud	Cloud subscription owners, hypervisor and storage administrators, root on servers	Mass encryption or deletion of systems and data	Separate admin accounts, dedicated admin devices, session recording for production
Backups and recovery	Backup console administrators, immutable storage settings	No way to recover after ransomware	Backup admin separated from domain admin, multi-person approval to delete
Business-critical applications	ERP, payments, trading, clinical or customer data administrators	Fraud, regulatory breach, data theft	Segregation of duties, dual control for high-value changes
Machine and automation	Service accounts, CI/CD tokens, API keys, AI agent credentials	Quiet, long-lived access that survives password resets	Inventory with owners, vaulted and rotated credentials, scoped permissions
Third parties	Managed service providers, vendors' remote support, outsourced IT	A supplier's breach becomes yours	Brokered, time-limited, recorded access; contractual controls

In MITRE ATT&CK terms, the techniques boards should expect management to cover include Valid Accounts (T1078), Account Manipulation (T1098) and Abuse Elevation Control Mechanism (T1548).

What PAM actually buys

PAM is often presented as a product purchase. Microsoft's own privileged access strategy warns that a PIM or PAM solution alone is not sufficient: the aim is to limit privileged actions to a few authorised pathways and then protect and closely monitor those pathways. The UK NCSC's secure system administration guidance makes the same point through five principles: trusted management devices, protected administration interfaces, tiered administration, privileged access management, and logging and auditing of administration.

Capability	Risk it reduces	Typical cost driver	Board view
Discovery and inventory of privileged accounts	Unknown administrators and forgotten service accounts	Effort to find owners	Precondition for everything else
Credential vaulting and rotation	Shared, never-changed administrator and service passwords	Onboarding each system and fixing dependent scripts	Essential; measure coverage, not licences
Just-in-time elevation and approval	Standing privilege available to anyone who steals an account	Process change for administrators	Highest value per pound once inventory exists
Session brokering and recording	Unsupervised use, especially by suppliers	Infrastructure and storage; review time	Required for third parties and production
Privileged access workstations and tiering	Admin credentials stolen from everyday laptops	Devices and operating discipline	Mandatory for the identity control plane
Detection on privileged activity	Misuse going unnoticed	SOC integration and responders	Only valuable if someone acts at 3am

Smaller organisations can get most of the value from their cloud identity provider's built-in just-in-time role activation, separate admin accounts and a managed detection service. Larger and regulated organisations usually need a dedicated PAM platform for on-premises systems, databases and supplier access, and must then protect that platform as one of their most sensitive assets. See Securing the PAM Vault Itself.

Five questions for the board to ask

How many people and machine accounts hold standing administrator rights over our identity systems, cloud tenants and backups, and what is the trend? A credible answer is a number per category, falling, with just-in-time elevation for the rest, not "IT manages it".
Could one stolen administrator password, on its own, let an attacker delete our backups? Expect a clear no, backed by separate backup administration, phishing-resistant MFA and multi-person approval for deletion.
Which suppliers have administrator access into our environment, and can we see and stop what they do in real time? Look for a list, brokered and recorded sessions, and access that expires.
Do we know every service account and API key with administrator rights, who owns it, and when its credential last changed? A good answer includes an inventory, owners and a rotation date for each.
When did we last test detection and response to a compromised administrator account, and how long did containment take? Look for a dated exercise and a measured time to revoke sessions and credentials.

Red flags in management answers

"We bought a PAM tool": ask what share of privileged accounts and systems are actually onboarded. Partial onboarding is the most common state and leaves the riskiest accounts outside.
"Admins use their normal account with elevated rights": this is the non-essential use of elevated accounts that CISA and NSA flag; administrators need separate accounts.
"Service accounts are exempt": they cannot use MFA, which is exactly why they need vaulting, scoping and monitoring.
"Our MSP handles that": the supplier's administrators are your administrators; ask how their access is controlled and recorded.
Break-glass accounts nobody tests: emergency accounts with old passwords and no alerting are a standing back door. See the Break-Glass Account Guide.

What good looks like

Area	Good practice
Governance	A named executive owner for privileged access; privileged compromise on the risk register; board review at least annually
Inventory	All human and machine privileged accounts known, with owners, reconciled at least quarterly
Standing privilege	Near-zero permanent administrators for identity, cloud and backup; elevation just in time with approval for the most sensitive roles
Authentication	Phishing-resistant MFA and dedicated, hardened devices for all control-plane administration
Credentials	Administrator and service credentials vaulted, rotated after use or on schedule, never shared
Supervision	Supplier and production sessions brokered and recorded; high-risk actions under dual control
Detection and recovery	Alerts on new privileged assignments and unusual admin activity, tested playbooks, and a rehearsed plan to rebuild identity and PAM systems after compromise

Where to invest first

Know the privileged estate: discover and inventory privileged human and machine accounts, starting with identity, cloud and backup. See the Privileged Account Discovery and Onboarding Guide.
Protect the control plane: separate admin accounts, phishing-resistant MFA and dedicated admin devices for the handful of identities that control everything. See the Tiered Administration and Enterprise Access Model Guide.
Remove standing privilege: move permanent administrator roles to just-in-time elevation with approval and time limits. See the JIT Access Guide.
Control supplier access: broker, time-limit and record all third-party administration. See the Vendor Privileged Access Management (VPAM) Guide.
Vault and rotate machine credentials: service accounts, API keys and automation tokens with administrator rights first.

Metrics to track

Number of standing privileged accounts in identity, cloud and backup systems, human and machine, and the quarter-on-quarter trend.
Percentage of privileged accounts onboarded to vaulting or just-in-time elevation.
Percentage of administrators using phishing-resistant MFA and dedicated admin devices.
Number of suppliers with administrator access, and the share whose sessions are brokered and recorded.
Percentage of privileged service accounts with a named owner and a credential rotated in the last 12 months.
Mean time from a high-severity privileged alert to revoked access.

A 90-day plan

Days 1 to 30: name the executive owner; obtain counts of standing administrators in identity, cloud and backup systems and of suppliers with admin access; confirm whether backup deletion requires more than one person.
Days 31 to 60: require separate admin accounts and phishing-resistant MFA for all control-plane administrators, with dated exceptions; move the most sensitive roles to just-in-time elevation; start the service account inventory with owners.
Days 61 to 90: run an exercise simulating a compromised administrator and a compromised supplier; measure containment time; baseline with the PAM Maturity Model and agree a 12-month target with the board. The Privileged Access Management Policy Template gives a starting policy.

Common failure patterns

Tool bought, estate not onboarded: the vault holds the easy accounts while the critical ones remain outside it.
Help desk resets privileged accounts: strong admin MFA undone by a phone call. The MGM Resorts breach began, by the attackers' account, with a help desk call and led to Okta administrator access.
Admins on everyday laptops: privileged credentials used from devices that browse the web and open email are stolen with them.
Machine accounts ignored: human admins move to just-in-time while service accounts keep permanent domain or owner rights.
Single PAM platform, no recovery plan: if the vault is compromised or encrypted, nobody can administer anything. See Recovering IAM and PAM After Ransomware or Domain Compromise.

Practitioner checklist

Report standing privileged accounts to the board by category, human and machine, every quarter.
Require separate admin accounts, phishing-resistant MFA and dedicated devices for identity, cloud and backup administration.
Move the most sensitive roles to just-in-time elevation with approval and time limits.
Broker, time-limit and record all supplier administrative access.
Vault and rotate privileged service account and API credentials, with named owners.
Require multi-person approval to delete backups or change immutability settings.
Protect and monitor the PAM platform as a tier-zero asset with its own recovery plan.
Exercise a compromised administrator scenario every year and report closed actions.

Standards and references

How NHI Mgmt Group can help

We provide independent privileged access and non-human identity risk assessments, board briefings and programme initiation support covering human administrators, service accounts and AI agents alike. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.

Privileged Access (PAM) Executive Briefing: Board Questions, Priorities and a 90-Day Plan