Privileged Access Management (PAM) platforms control, monitor, and audit the use of elevated credentials — administrator, root, service account, cloud-privileged, and database-privileged access. Core capabilities include credential vaulting with rotation, just-in-time privilege elevation (eliminating standing admin rights), session brokering and recording for compliance and forensics, secrets management for applications and service accounts, certificate lifecycle management, and cloud infrastructure entitlement management (CIEM) for the major cloud providers. PAM is distinct from IdP (which handles workforce SSO) and from IGA (which governs access lifecycle) — it specifically addresses the outsized risk posed by privileged credentials, which attackers prize above all others.