CyberArk PAM-SEN key terms

A logical container in the Vault that holds accounts or files and carries its own access control list. Authorized users and groups receive permissions on the Safe rather than on individual objects inside it.

The hardened, encrypted repository that stores privileged credentials, connection components, policies, and audit data. It is the central server component that clients such as the Password Vault Web Access and CPM connect to.

A user or group that has been granted a permission set on a Safe, such as retrieve, use, list, add, update, delete, or manage. Permissions are cumulative and can be time-limited or require approval.

The component that automatically rotates, verifies, and reconciles passwords on managed target systems according to platform policy. It executes change and verify tasks on a schedule or on demand.

A configuration template that defines how the CPM connects to a target system, which password policy applies, how rotation is performed, and which connection components are used. Accounts inherit behavior from their assigned platform.

A Vault-wide set of rules governing privileged access behavior, including dual control, exclusive access, one-time passwords, and session recording. It applies to all Safes unless a platform-level exception overrides it.

A control requiring two authorized users to approve an action, such as retrieving a password or authorizing a change, before it proceeds. It reduces the risk of a single insider acting alone.

A policy that locks an account to a single user for the duration of a session so no other user can retrieve or use it concurrently. It prevents conflicting administrative actions on the same target.

A policy setting that changes a password immediately after each retrieval or use, so the credential the user saw is no longer valid. It limits reuse of a revealed secret.

The browser-based interface users employ to request, retrieve, and manage accounts, launch connections, and review audit information. It also provides administrative screens for Safes, users, and policies.

The component that proxies and isolates privileged connections to target systems, injecting credentials without exposing them to the user. It records sessions and enforces policy during the connection.

A packaged client or plugin that PSM uses to launch a specific type of session, such as RDP, SSH, or database tools. It runs on the PSM server and mediates access to the target.

The capture of a privileged session's activity, typically as a video and keystroke log stored for audit and investigation. Recordings can be reviewed and searched to reconstruct exactly what an administrator did.

The chronological record of actions performed in the Vault, including retrievals, changes, approvals, and administrative edits. It supports compliance reporting and forensic reconstruction of who did what and when.

A privileged account, usually local administrator on a target, that the CPM uses to reset a managed account's password when the normal rotation fails. It restores control after a credential drift or lockout.

The scheduled or triggered replacement of a managed credential with a new value generated according to platform policy. Rotation limits the useful life of a leaked password.

A configured process in which a user's request to access an account is routed to designated approvers who confirm or deny it, optionally with a time window. It provides documented justification for access.

A scan that finds privileged accounts on target systems and imports them into the Vault for onboarding and management. It surfaces unmanaged local administrators, service accounts, and orphaned credentials.

The process of adding a discovered or manually created account to a Safe and assigning it a platform so the CPM can manage it. It typically includes setting a password policy and an initial rotation.

Any credential that grants elevated or administrative access to a system, application, or device, such as root, domain administrator, or a database superuser. These accounts are the primary target of PAM controls.

The principle of granting users and accounts only the permissions needed for their current task and no more. In PAM it is enforced through scoped roles, just-in-time access, and removal of standing administrative rights.

Granting elevated rights only for a defined period or task and revoking them automatically afterward. It replaces standing administrator membership with temporary, auditable elevation.

A non-human account or credential used by software, scripts, or services to authenticate to other systems. These identities need lifecycle management because they often carry broad access and are rarely rotated.

The component that centrally stores, rotates, and distributes secrets such as API keys, database credentials, and certificates to applications at runtime. It removes hard-coded secrets from code and configuration files.

Any sensitive value an application or machine uses to authenticate or encrypt, such as a password, token, key, or certificate. In Secrets Manager, secrets are stored in Safes and accessed through controlled APIs.

A credential generated on demand for a specific consumer and valid only for a limited time, then revoked. It avoids distributing long-lived static secrets to applications.

A plugin or integration that lets an application or platform fetch secrets from the Vault at runtime without embedding them in code. It authenticates to the Vault and requests the specific secret it needs.

The method by which a non-human consumer proves its identity to the Vault before retrieving secrets, using mechanisms such as certificates, hashes, or cloud identity tokens. It replaces storing a password in the application.

A component that supplies credentials to an application or operating system on demand, often through an API, so the secret never lives in plaintext on the endpoint. It is central to eliminating hard-coded credentials.

The process of requesting, issuing, renewing, and revoking TLS and other certificates before they expire. Automated management prevents outages caused by expired certificates and reduces manual key handling.

The component that controls and monitors administrative activity on Windows and macOS endpoints. It removes standing local administrator rights and applies policy to elevation requests and application execution.

An EPM policy that allows or blocks execution of applications on endpoints based on rules such as publisher, hash, or path. It stops untrusted or malicious binaries from running even for privileged users.

The act of raising a standard user's rights to perform a specific administrative task, such as installing software. EPM grants elevation per request under policy rather than through permanent administrator membership.

A set of explicitly trusted applications or publishers permitted to run on an endpoint, with everything else denied by default. It is the core enforcement model of application control.

A deployment state in which EPM records what its policies would have blocked or allowed without enforcing them. It lets administrators tune rules before turning on blocking to avoid disrupting users.

The discipline and tooling for managing the full lifecycle of identities and their access, including joiner-mover-leaver processes, access requests, certifications, and segregation-of-duties checks. It answers who should have access and proves it.

A periodic review in which managers or resource owners confirm that each user's access is still appropriate and revoke what is not. The results provide auditable evidence for compliance requirements.

A control that prevents one person from holding conflicting combinations of access that would allow fraud or undetected error, such as both creating a vendor and approving its payment. IGA tools detect and remediate these conflicts.

The analysis of existing access assignments to discover natural groupings of entitlements that can become reusable roles. It reduces manual role design and highlights outlier or excessive permissions.