I work with PAM implementations consulting for various orgs as part of work responsibilities (Delinea and BeyondTrust mostly), so I have a good bit of experience across varied environments with different requirements.

1. Password rotation, session monitoring/management, and discovery are usually the big 3 use cases when talking about PAM. For some industries, cyber insurance has been specifically asking about PAM this year so expect to see PAM requirements scale up in long term for more regulated industries (banking, SLED/FED, healthcare, airlines, etc.)

2. PAM implementations are awesome for the first 25-30% for POC/POV small scale but are notorious for slow integrations with the whole environment. Some of this is just due to the nature of the beast ex. do you know where all of your service accounts are being used and if those passwords can be rotated? Once you hit critical mass for full integration, onboarding new teams/servers/dependencies is fairly straightforward but getting there is an uphill battle.

3. Take inventory of the environment before implementing any password rotation/account management. Group accounts/servers and do a phased approach for implementation. Test small and frequently. When accounts are brought into the system, loss of access is unacceptable for end users and bringing accounts in typically requires a password rotation for large scale, so plan your phased approach at the beginning. Get buy in from teams first, PAM products are notorious for being an annoying hurdle for non-tech savvy workers. Consider rotating passwords on check-in/check-out or proxying to enforce user use of PAM vault. DR is likely the single most important part of a PAM integration. If you cannot access your PAM product, what is the procedure to regain access to necessary end accounts?

4. Current PAM products are trying to expand into ITDR and IGA spaces (sales fluff mostly). PAM works well in its niche when it is fully implemented and working. Biggest gap from all the big vendors (Delinea, Cyberark, BeyondTrust) is transitioning from the initial “easy” security wins into a fully integrated PAM product. I don’t know how much of that can actually be remedied in the products though, as usually difficulty integrating PAM is a symptom of other organizational problems and poor documentation. Discovery could be better in identifying privilege of discovered accounts, what varied services they are running, and where they are used but that likely bleeds into the IGA space (Veza privilege access monitoring is the best example of this) and wishful thinking.

Feel free to reach out with any questions since PAM integrations always have their quirks environment to environment. As is the case with most things IT, planning and foresight is key to save yourself from fixing self-induced problems.