Modern PAM flips the focus from ‘where are the credentials stored?’ to ‘who needs access to what, and when?’. It's less vault-centric and more identity-centric, aligning with Zero Trust principles.

The core principles of modern PAM are easy to understand if you have the right guide.

They include:

• Zero Standing Privileges (ZSP): No single identity keeps consistent elevated access. An individual receives privileges when they need them, and they're revoked when that access is no longer required.This is the direction the industry has been moving in for years, and for good reason. Standing privileges give attackers time to move laterally once they're in

• Just-in-Time (JIT) access: JIT is how you implement ZSP. Credentials or access rights are provisioned at the moment of need, for a specific duration. When that period of necessity runs out, access expires automatically. This dramatically shrinks the window an attacker has to exploit compromised credentials

• Continuous authorisation: Rather than a single check at login, access decisions are evaluated throughout the session. Device posture, location, and behaviour patterns are monitored in real time. If something looks off, access can be revoked or stepped up without waiting for the next login
• Least privilege: Access is scoped to the minimum needed for a specific task, both in breadth (which resources are needed) and depth (what level of access). Essentially, this means granting ‘read-only’ when ‘read-only’ suffices, and granting ‘standard user’ when admin isn't needed

Modern PAM also needs to work across cloud platforms, SaaS apps, containers, and ephemeral infrastructure without requiring agents at every point. A modernised PAM solution should integrate with secrets management, session management, and Identity Threat Detection and Response (ITDR). The lines between these disciplines are blurring.

For clarity, vaults aren't going anywhere.

There will always be accounts where standing privileges cannot be removed, such as local built-in administrator accounts, root accounts for cloud service providers, and break-glass accounts for emergency access. These still need to be vaulted, rotated, and protected. The difference is that in modern PAM, the vault is no longer the primary focus. It's one component of a broader identity-centric strategy.