A PAM security tool should include the following capabilities: Discovery of privileged workloads, accounts and entitlements across infrastructure, clouds and applications in real time. This helps make sure privileged access is appropriately managed, reducing the risk of misuse. Credential management for privileged accounts. The system should include a vault to store and obscure privileged account passwords. A PAM vault should also offer the ability to rotate credentials manually or automatically, as required by the organization.To increase your odds of success, it’s best to start off with a policy of using strong passwords. Privileged session management, which provides the ability to establish and monitor privileged sessions. Tools should allow administrators to monitor privileged user activity in real time and enable them to remediate risks by blocking risky activity or terminating the session to mitigate a potential threat. Privileged session recording is an important function for compliance purposes and can be used for digital forensics if a breach occurs. Intelligence and analytics provides dashboards and reporting for administrators to view privileged accounts and entitlements, understand the attack surface, review access logs and privileged user activity. It provides security analysts with insights into usage patterns to preempt or mitigate breaches and gives certifiers insight as to whether users have appropriate access and permissions. Enabling Just-in-time privileged access is perhaps the most critical capability to pursuing a zero standing privilege (ZSP) approach. ZSP is an PAM access management strategy that allows organizations to reduce the attack surface associated with standing privileges. PAM tools should make it easier for administrators to provide privileged access to users for only enough time to complete the task with the least possible privilege given, thus giving attackers a smaller window to act. Finally, a privileged access management solution should offer role-based access control (RBAC). By establishing role-based elevation of privileged access, you can eradicate standing privilege and move towards an ephemeral privilege or ZSP model.