.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Use caseThird-party and vendor access
Let contractors in to one system, for one job, on the record
Vendors and contractors need access to fix things, but a VPN account opens the whole network. With SWOT PAM they reach only the system they were approved for, in a browser, for a set time, and every session is recorded.
Why vendor access is a weak spot
- 01
VPNs open the whole network
A VPN account usually reaches far more than the one system the contractor came to fix.
- 02
Shared vendor passwords
Credentials handed to a supplier are reused, written down and rarely changed.
- 03
No record of what they did
Once connected, third parties often work unobserved.
See it work
VPN or SWOT PAM
Switch between a VPN account and a SWOT PAM grant and see how much of the network a contractor can reach.
- 11 of 12 systems reachable
- Shared vendor password
- No session record
- 1 approved system: pos-db
- 4 hours, then access ends
- Recorded, password never shown
Sample network.
How it works
How vendor access works with SWOT PAM
Scoped to one system
The grant names the server or database and the time window; nothing else is reachable.
SWOT PAMIn a browser tab
Contractors and on-call staff use the web terminal, HTML5 desktop or browser SQL, with nothing to install and no VPN.
SWOT PAMNever see the password
The proxy injects the credential, which can be rotated after the session.
SWOT PAMRecorded and scored
Every session is recorded and scored live by PAMGuard, and can be frozen or ended.
SWOT PAM
How do vendors connect without a VPN?
Through SWOT PAM in a browser tab: a web terminal for Linux, an HTML5 desktop for Windows, or browser SQL for databases. Only the approved system is reachable, and nothing is installed on their machine.
Do contractors get the password?
No. The proxy injects the credential into the session, so it never reaches the contractor’s device, and it can be rotated afterwards.
Can we watch what a vendor does?
Yes. Every session is recorded and scored live; risky activity can freeze the session until an admin approves or ends it.
How long does a vendor’s access last?
For the window in the approved request. When it closes the access ends on its own.
See it on your own systems
A walk-through of SWOT PAM and SWOT Cloud PAM with the team that builds them.