.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Use caseZero standing privileges
Admin rights only while the work is happening
Standing admin access is a door that never closes. With SWOT, privileged access is requested for one task, approved, used through a recorded session, and removed on its own when the time runs out.
Why standing access is the risk
- 01
Rights granted once, kept for ever
Admin access added for a project or an incident is rarely taken back, so accounts collect privileges over time.
- 02
Shared and service accounts
Passwords that several people know, or that never change, leave no trail of who actually used them.
- 03
Cloud roles that outlive the job
Long-lived keys and roles stay valid after the work is done, waiting to be found.
See it work
A day of admin access, before and after
Switch between standing access and zero standing privileges. Each row is an admin account; lit hours are when it can reach production.
144 privileged hours open todaySample accounts
- dba_adminJust-in-time grants: 2 hours for INC-902
- root@prod-webJust-in-time grants: 1 hours for CHG-311
- svc_backupJust-in-time grants: 2 hours for Nightly job
- aws:AdministratorAccessJust-in-time grants: 1 hours for CHG-318
- helpdesk_t2No access needed today
- contractor.aliJust-in-time grants: 3 hours for Vendor fix
How it works
Getting to zero standing privileges
Find standing access
SWOT Radar records the local admins, sudo members and nested AD groups on every host, and SWOT DAM scores every database identity.
SWOT RadarTake the passwords away
Credentials move into the SWOT PAM Central Vault, encrypted with AES-256-GCM and rotated on a schedule or after each use.
SWOT PAMGrant access just in time
Engineers ask for a server, database or cloud role for a set time; approvers answer in Slack, Teams or email; access ends on its own.
SWOT Cloud PAMProve it
Every request, approval, session and command lands on a hash-chained, tamper-evident audit trail.
SWOT PAM
The products
What each product does here
- SWOT PAMPrivileged access managementJust-in-time access to servers and databases, the Central Vault and recorded sessionsExplore SWOT PAM
- SWOT Cloud PAMMulti-cloud PAM for AWS, Azure, GCPJust-in-time roles for AWS, Azure and GCP with short-lived credentialsExplore SWOT Cloud PAM
- SWOT RadarAsset, identity and access discoveryFinds who can log in to each host, including through nested groupsExplore SWOT Radar
- SWOT DAMDatabase activity monitoringScores every database identity against its own 30-day baselineExplore SWOT DAM
What are zero standing privileges?
Zero standing privileges (ZSP) means no account keeps privileged access by default. Access is granted for a specific task and time window, then removed automatically, so there is nothing for an attacker to borrow between tasks.
How is it different from least privilege?
Least privilege limits how much access an account has. Zero standing privileges also limits when it has it: even the right amount of access exists only while the approved work is happening.
What happens in an emergency?
Break-glass access is available for outages. In SWOT PAM it is logged and alerted at high priority; in SWOT Cloud PAM it needs two people and every action is logged for review.
How long does a grant last?
As long as the request and policy allow, for example two hours to investigate an incident. When the window closes the grant ends on its own; in the cloud, a revoked grant stops working within 60 seconds.
See it on your own systems
A walk-through of SWOT PAM, SWOT Cloud PAM, SWOT Radar and SWOT DAM with the team that builds them.