# What is privileged access management (PAM), and do we need it?

Privileged access management (PAM) is a set of tools and practices for controlling the most powerful accounts: administrators, root, service accounts and emergency accounts. Typical features are a vault that stores and rotates admin passwords, check-out of credentials for a limited time, session recording, approval before access, and just-in-time rights that exist only while a task is done. Full PAM products suit larger companies and regulated environments. A small company can cover the essentials without one: an inventory of privileged accounts, separate admin accounts with phishing-resistant MFA, unique local administrator passwords managed by a tool, a bastion host for remote admin access, and a quarterly review. Choose a PAM product when the number of administrators, suppliers or audit demands makes that manual work unreliable. NetSenX is not a PAM tool. It complements one by showing where privileged sessions happen on the network and flagging those that do not match a host's normal as lateral movement, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/what-is-privileged-access-management

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can network monitoring see attacks on accounts and the directory?](https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks)
- [Does NIS2 require zero trust?](https://netsenx.com/en/faq/does-nis2-require-zero-trust)
- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)
- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)
- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)