.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Use casePrivileged session monitoring
Watch a privileged session, and stop it if it goes wrong
Recording a session tells you what happened afterwards. SWOT PAM reads the session while it is live, scores what it sees, and can freeze or end it before the damage is done.
Why recording is not enough
- 01
Damage happens before review
If sessions are only replayed after an incident, the deleted table or disabled log is already gone.
- 02
Desktops leave no command text
A right-click delete on a Windows desktop never reaches a keystroke log, so text-only monitoring misses it.
- 03
Recordings can be questioned
An auditor needs to know a recording has not been edited since it was made.
See it work
Replay a session
Drag along a sample SSH session. Watch the risk score climb with each command until the session freezes and ends.
Input frozen. Waiting for an admin to approve or end the session.
Session ended by PAMGuard at score 150.
Risk score 0
Sample session and scores. Thresholds as in the SWOT PAM docs.
How it works
How SWOT watches a session
Every session through the proxy
SSH, RDP and database sessions pass through the PAM proxy, with nothing installed on the target.
SWOT PAMScore it live
PAMGuard scores commands, queries and desktop actions. At 40 the session is watched closely, at 70 input freezes for an admin, at 150 it ends.
SWOT PAMBlock before it runs
A command matching a blocking rule is dropped at the proxy; dangerous cloud API calls are denied at the Cloud PAM gateway.
SWOT Cloud PAMKeep a record you can trust
Recordings carry a SHA-256 hash and sit on a hash-chained audit trail, searchable by command and exportable.
SWOT PAM
The products
What each product does here
- SWOT PAMPrivileged access managementPAMGuard live inspection, freeze and end, recordings and replay for SSH, RDP and databasesExplore SWOT PAM
- SWOT Cloud PAMMulti-cloud PAM for AWS, Azure, GCPInline blocking and tamper-evident playback for cloud console, CLI and API sessionsExplore SWOT Cloud PAM
- SWOT DAMDatabase activity monitoringQuery-level activity from each database’s own audit trailExplore SWOT DAM
What is privileged session monitoring?
Privileged session monitoring watches what administrators do on servers, databases and cloud consoles during a session. SWOT PAM inspects the live protocol stream, scores risky activity, and can freeze or terminate the session, as well as recording it.
Does it cover Windows desktops?
Yes, without an agent. On RDP, SWOT PAM analyses keystrokes and clipboard content and catches mouse-driven actions such as a right-click delete, and window titles such as regedit or Credential Manager.
How do we know a recording has not been changed?
Each recording has its own SHA-256 hash and every event sits on a hash chain, with insert-only audit tables. Recordings can be stored in S3 or MinIO with Object Lock.
Can we search across sessions?
Yes. Command Search finds every command and query across recorded sessions, and cloud sessions can be searched and exported, with secrets redacted.
See it on your own systems
A walk-through of SWOT PAM, SWOT Cloud PAM and SWOT DAM with the team that builds them.