The Measures Worth Reporting

PAM programmes generate a great deal of countable activity. Only some of it indicates that the organisation is less exposed.

The measures that matter

Accounts with standing administrative rights, by tier. The headline. It should fall.

Privilege paths to tier zero, from graph analysis. Objective and responsive to work.

Proportion of privileged sessions brokered, measured against target-side authentication logs rather than against the broker's own record.

Credential age distribution for privileged accounts, particularly service accounts.

Time to rotate a tier one credential, measured by drill.

Unowned privileged accounts.

Systems in the residual-risk list that cannot be onboarded.

Third-party accounts past their end date, which should be zero.

Eight measures. Each names a specific failure when it moves the wrong way.

The measures that mislead

Systems onboarded. Measures project activity, not coverage, unless reported against a denominator from an independent inventory.

Credentials vaulted, for the same reason.

Sessions recorded, without the proportion.

Hours of recording stored, which measures the storage bill.

Alerts generated, without the finding rate.

Percentage complete, against a plan the programme wrote itself.

Reading them together

Standing accounts falling and brokered proportion rising: the programme is working.

Onboarding rising while standing accounts hold steady: a vault has been deployed and nothing has changed, which is the most common outcome.

Brokered proportion below onboarded proportion: the path is not enforced, and administrators are going around it.

Credential age rising: rotation has stalled, usually on service account dependencies.

Paths to tier zero not falling: the account work is happening and the permission work is not.

Reporting to different audiences

Executive: standing tier zero accounts, paths to tier zero, time to rotate under drill, and the residual-risk list. Four numbers.

Security: the full set, segmented by tier.

Infrastructure teams: their own coverage and their own outstanding items, which is what makes them act.

Audit: coverage against an independent denominator, review activity, and testing results.

The coverage denominator

The single most important reporting discipline.

Measure coverage against the asset inventory, not against the PAM system's own list of onboarded systems.

A programme that has onboarded ninety percent of the systems it knows about may cover half the estate.

State the denominator explicitly in every coverage figure.

Where the denominator is uncertain, say so and give a range.

The annual view

What the exposure looked like a year ago and looks like now, using the same measures.

What was found by testing and what was closed.

What remains uncontrolled, which is the honest section and the one that justifies the next investment.

What the drill showed, particularly rotation time, which is the number an executive understands immediately.

The one-page monthly report

Eight numbers, a sentence on each, nothing else.

Standing privileged accounts by tier.

Privilege paths to tier zero.

Proportion of sessions brokered, against target-side logs.

Credential age distribution.

Rotation time from the last drill.

Unowned accounts.

Systems on the residual-risk list.

Third-party accounts past end date.

A sentence per number naming what moved and why. Trends matter more than levels, and a number without a comment is ignored within three months.

Stating the denominator

The single most important reporting discipline in this field.

Every coverage figure names what it is measured against.

"Ninety percent of systems onboarded" is meaningless without saying onboarded out of what.

Use an independent asset register rather than the PAM system's own list, which is circular.

Where the denominator is uncertain, give a range and say why.

A programme caught reporting coverage against its own scope loses credibility on every subsequent number, and the correction is far more expensive than the honesty would have been.