CyberArk PAM-DEF key terms

A user or machine identity with elevated rights beyond those of a standard user, such as root, domain administrator, or a service account that can modify systems or data.

A logical container in CyberArk that holds accounts and their stored credentials, with its own membership list and authorization rules controlling who can retrieve or manage the contents.

An identity granted a role on a specific Safe, such as Safe Owner, Safe Admin, or Safe User, that determines which actions it may perform on accounts inside that Safe.

The global rule set that governs account behavior across the vault, including dual control, one-time passwords, exclusive access, and required justification for retrieval.

A policy requiring a second authorized user to approve an action, such as viewing or changing a password, before the request is fulfilled, preventing unilateral misuse of high-risk accounts.

A retrieval mode in which the vault changes the account password after each check-out so the credential a user receives is valid only for that single session.

The Central Policy Manager component that automatically rotates, verifies, and reconciles passwords on managed accounts according to schedules and platform settings stored in the vault.

A configuration template that defines how the CPM manages a particular account type, including connection details, password change method, and rotation settings.

The scheduled or on-demand replacement of a managed account's credential by the vault, reducing exposure from credentials that may have been shared or captured.

The Privileged Session Manager component that brokers remote connections to target systems and records the session, providing isolation between the user's desktop and the privileged target.

The capture of a privileged session's screen and keystrokes by PSM, stored for audit and review so investigators can reconstruct exactly what a user did on a target.

A PSM mode in which the user never holds the target credential; the PSM server injects it into the remote session so the password is never exposed to the endpoint.

A component installed on a target server that enables PSM to broker and record sessions for protocols or platforms that do not support direct remote connection brokering.

The hardened, encrypted repository where CyberArk stores account credentials, files, and policy data, protected so that even administrators cannot read stored secrets directly.

The server tier of the CyberArk solution that persists encrypted data, enforces authorization, and exposes the Vault API used by other components and clients.

The REST interface exposed by the Digital Vault that lets applications and administrators authenticate, retrieve accounts, and manage objects programmatically.

The Application Identity Manager capability that lets applications retrieve privileged credentials at runtime without storing them in code or configuration files.

An account object in the vault that represents an application's identity, used by AIM or API clients to authenticate and obtain the credentials they are authorized to consume.

A software component that intercepts a password request on behalf of an application and fetches the credential from the vault, shielding the application from secret storage.

The discipline of storing, distributing, rotating, and auditing non-human secrets such as API keys, tokens, and certificates so applications never embed them in code.

The principle that an identity receives only the permissions needed for its task and no more, limiting the blast radius if that identity is compromised.

An authorization model that assigns permissions to roles rather than individuals, so users inherit capabilities through their assigned role membership.

The process of verifying that an identity is who it claims to be, typically through passwords, certificates, or multi-factor methods before any authorization decision is made.

The process of deciding which actions an authenticated identity may perform on which resources, enforced by policy such as Safe membership and Master Policy rules.

Requiring two or more independent evidence types, such as a password plus a hardware token or push approval, before granting access to the vault or a privileged target.

A configuration that links vault users and groups to identities in an external directory, so directory membership drives who can log in and which Safes they can reach.

The connection between the vault and a directory service that allows authentication and group synchronization, letting organizations manage vault identities from a central directory.

A workflow in which a user asks for temporary access to an account or Safe, which an approver reviews before the vault grants time-bound permission.

The CyberArk component that controls application execution and privilege elevation on endpoints, letting standard users run approved tasks without full administrative rights.

An EPM policy that decides whether a given executable may run on an endpoint, blocking unapproved software while allowing trusted applications.

A security approach in which only explicitly approved applications may execute, with everything else blocked by default, the inverse of a denylist model.

Temporarily granting an application or user higher rights on an endpoint for a specific task, then removing those rights, instead of assigning permanent administrator status.

The EPM client installed on an endpoint that enforces application control and elevation policies and reports events back to the central management server.

A reason a user must supply when requesting a credential or elevation, recorded for audit so reviewers can see why privileged access was needed.

A tamper-evident record of vault activity such as logins, retrievals, and policy changes, used for compliance reporting and incident investigation.

The CPM process that detects and corrects drift when a managed account's actual password on the target no longer matches the value stored in the vault.

A CPM check that confirms the stored credential still works on the target system, flagging accounts whose passwords have been changed outside the vault.

The process of adding an existing privileged account to vault management, including defining its platform, Safe, and rotation schedule.

A non-human identity used by an application or operating system component to run processes and access resources, often holding broad rights that make it a high-value target.