SearchContactBook a demo

SWOT PAM Beyond credentials. Beyond recording. True understanding

Privileged access management

Just-in-time privileged access to servers and databases, through a proxy that checks, records and can stop each session.

Access that switches itself off

Engineers ask for access when they need it, for as long as the job takes. When the time runs out the access ends on its own, so no one is left holding standing admin rights.

I need read-only access to the billing PostgreSQL database for 2 hours to investigate incident INC-902.

Target
Billing PostgreSQL
Access
Read-only
Duration
2 hours
Reason
Incident INC-902

Approved in Slack

Credentials added by the proxy, never shown

Time left2:00:00

Request sent

PAMGuard stops a command before it runs

Every SSH keystroke and SQL query passes through PAMGuard on its way to the target. A command that matches a blocking rule is dropped there, so the server or database never receives it.

prod-web-01through PAMGuard

    Admins write each rule as a pattern and choose what happens: block and alert, flag the session, or end it. Flags add to the session’s risk score: at 40 it is watched more closely, at 70 input freezes until an admin approves or ends it, and at 150 the session ends. On RDP, risky desktop actions such as opening regedit or Credential Manager are flagged too.

    Keep your own tools, or use the browser

    Engineers connect with the clients they already use, through the PAM proxy. Contractors and on-call staff get the same access in a browser tab, with nothing to install.

    Any SSH client, port 2222

    ssh -p 2222 alice#prod-web-01.corp@pam.mycompany.com

    Sign in with your SWOT PAM password and six-digit code, from macOS Terminal, Windows Terminal or PuTTY.

    Web terminal

    A terminal in the browser tab with copy and paste, Ctrl+C and full screen. No SSH keys and no VPN.

    Remote Desktop, port 33890

    mstsc.exe /edit:session-token-38910.rdp

    Download a single-use .rdp file when you need several monitors or local USB devices.

    HTML5 desktop

    The Windows session in the browser, with adaptive resolution, two-way audio and clipboard sync. RemoteApp works too.

    DBeaver, DataGrip, pgAdmin

    johndoe#prod_postgres_billing @ pam:5454

    Point your SQL client at the proxy: 5454 for PostgreSQL, 1521 for Oracle. Every query is checked and logged.

    SQL in the browser

    A visual SQL editor and schema browser, or a psql, sqlplus or mysql shell, for PostgreSQL, Oracle, MySQL and SQL Server.

    Passwords nobody has to remember

    The Central Vault holds passwords, SSH keys, cloud keys and API tokens. Check a credential out for a set time; when you check it back in, SWOT PAM can change it on the target so the copy you saw stops working.

    • AES-256-GCM encryption, with a unique IV for every record
    • The master key is kept outside the database
    • Rotation on a schedule you set, such as every 30 days, or as soon as a credential is checked back in
    • A second approver for your most sensitive systems
    Cloud accountsChecked in

    AWS root, production

    Password••••••••••••••••••••

    Checkout needs approval and lasts 2 hours.

    An audit trail that shows when it has been touched

    Each event is sealed with a SHA-256 hash of its contents and of the event before it. Change or delete one row and every hash after it stops matching, and the Audit Integrity Worker flags it.

    1. #1Loginalice, SSO and TOTP
      prev
      0000000000
      hash
      c298de61c7
    2. #2Access grantedbilling PostgreSQL, 2 hours
      prev
      c298de61c7
      hash
      50045c3fa4
    3. #3Vault revealAWS root, production
      prev
      50045c3fa4
      hash
      b7a9e3e1d5
    4. #4Commandsystemctl restart nginx
      prev
      b7a9e3e1d5
      hash
      e6d0af6f5f
    5. #5Policy editDB access: approval required
      prev
      e6d0af6f5f
      hash
      d8b97525c1

    Chain intact: all 5 events verified.

    Session recordings can be stored in S3 or MinIO with Object Lock, so nobody can overwrite them, and users can replay their own past sessions.

    It runs inside your network

    SWOT PAM sits between your people and your systems. No workstation connects straight to production: every session goes through a proxy that checks the policy, adds the credentials and records what happens.

    No direct path to production

    • Engineers
    • DBAs
    • Contractors

    SWOT PAM

    • Web console:443
    • SSH proxy:2222
    • RDP gateway:33890
    • Database proxy:5454 · 1521

    Checks policy · adds credentials · records

    • Linux servers:22
    • Windows servers:3389
    • Databases:5432 · 1521

    See SWOT PAM at work

    Live dashboardActive connections, host health and threat level in one radial view. Admins can end any live session from here.

    Access HubRequest time-bound access, follow approvals and see your active grants.

    AI access assistantAsk for access, check a request or find a target in plain English.

    Database accessEvery database target you may use, in the browser or your own client. Each session gets a temporary database account that is revoked when you disconnect.

    Central VaultCredentials, active checkouts, expiries and rotation status.

    Password rotationRotation schedules, upcoming expiries and verification checks.

    Access policiesWho can reach which targets, for how long, and with which approvals.

    SWOT PAM, answered

    What security teams ask before they choose a PAM

    Short, sourced answers about how SWOT PAM controls privileged access. Ask us anything that is not here.

    Evaluate SWOT PAM

    Watch the tour

    Two minutes of SWOT PAM at work: requests, PAMGuard, the vault and replay.

    Read the documentation

    The same guides our customers use.

    See it on your systems

    A walk-through on the servers, databases and identity provider you run.

    Book a demo

    Related:Just-in-time accessZero standing privilegesPrivileged session monitoring

    Q01What is SWOT PAM?

    SWOT PAM is a self-hosted privileged access management (PAM) platform. It brokers every privileged SSH, RDP and database session through a proxy, so users never receive the target credential. Access is granted just in time and expires on its own, and PAMGuard can freeze or end a risky session while it is live.

    Q02Do we have to install agents on our servers?

    No. All inspection happens at the proxy layer, for SSH, RDP (native clients or HTML5 in the browser), PostgreSQL and Oracle Net. Nothing is installed on the target servers, so there is no agent to deploy, patch or keep running.

    Q03How does just-in-time access work?

    An engineer asks for a server or database, says how long and why, or links the change ticket; they can also ask the AI assistant in plain English. Approvers are told in Slack, Microsoft Teams or email. The proxy injects the credential, and the grant ends on its own when the window closes. Break-glass overrides are logged and alerted at high priority.

    Q04Can SWOT PAM stop a risky command, or only record it?

    It stops it. PAMGuard reads the live protocol stream and scores commands, queries and desktop actions against rules for Linux, Windows, SQL and GUI activity. A blocking rule drops the command before the target receives it. A risk score of 40 puts the session under closer watch, 70 freezes input until an admin approves or ends it, and 150 ends it.

    Q05Does it watch Windows desktop sessions too?

    Yes, without an agent. On RDP it analyses keystrokes and clipboard content, and catches mouse-driven actions that leave no command text, such as a right-click delete, as well as window titles like regedit, Credential Manager or Wireshark.

    Q06Which identity providers does it work with?

    Single sign-on over SAML 2.0 or OIDC with Microsoft Entra ID, Okta, Google, OneLogin and PingFederate, plus TOTP multi-factor authentication. LDAP and Active Directory groups sync and map to SWOT PAM roles when users are provisioned.

    Q07How can an auditor tell the audit trail has not been changed?

    Every event is sealed with a SHA-256 hash of itself and the event before it, audit tables are insert-only and enforced by database triggers, and an integrity worker flags any break in the chain. Each recording carries its own SHA-256 hash and can be stored in S3 or MinIO with Object Lock.

    Q08Where does SWOT PAM run?

    In the cloud, on-premises or hybrid, as seven containers on Docker Compose or Kubernetes. An offline release bundle installs on air-gapped sites with no internet connection, and the API server, SSH proxy and RDP gateway are stateless, so they scale out behind a load balancer.

    Q09Does it help with PCI DSS, SOX, HIPAA or ISO 27001?

    The Compliance Hub maps controls in ISO 27001, SOX, PCI DSS and HIPAA to the SWOT PAM evidence behind each one, such as session records, approvals and audit events. That evidence supports your programme; whether a control is met is decided by your configuration, scope and assessor.

    Compliance support
    Ask us anything

    SWOT PAM. Beyond credentials. Beyond recording. True understanding

    SWOT PAM is a just-in-time privileged access platform for cloud and on-premises environments.

    info@rudratic.com