Why a Vault Alone Changes Little

The most common deployment is a vault, onboarded to a subset of systems, with everything else unchanged. It is worth being clear about what that achieves.

What a vault genuinely delivers

Attribution. Checkout records tie a use of a shared credential to a person.

Rotation. Passwords change on a schedule rather than never.

Removal of the spreadsheet, which is a real risk reduction.

A single revocation point when someone leaves.

Recording, where session brokering is used.

These are worth having and they are not the same as reducing privilege.

What it does not deliver

Fewer people able to obtain administrative rights. If a hundred people can check out the domain administrator password, the exposure is a hundred people with a slightly better audit trail.

Protection against the paths around it. A local administrator account not onboarded, an SSH key on a jump host, a service account in a config file.

Reduction of standing rights held directly by named accounts, which the vault never touches.

Protection when the endpoint is compromised. A credential checked out onto a workstation an attacker controls is a credential the attacker has.

The gap that remains

Worth enumerating, because deployments declare success without checking it.

Systems not onboarded, which is always some and usually the awkward ones.

Named administrative accounts that hold rights directly rather than through a shared credential.

Service accounts running as themselves.

Local accounts on workstations and appliances.

SSH keys distributed to hosts.

Cloud roles, assigned to identities rather than to vaulted credentials.

Emergency accounts, which exist precisely to bypass the vault.

The order that works

Reduce the population first. Fewer people with access is simpler and cheaper than better controls on the same number.

Separate administrative identities from daily-use ones.

Then vault, which now covers a smaller and better-defined set.

Then broker sessions, so the credential never reaches the endpoint.

Then move to just-in-time, which removes the standing grant entirely.

Then record, and build a review process before you build a storage bill.

Deployments frequently run this backwards, starting with recording because it is what the auditor asked about.

Testing whether it worked

Pick a sensitive system. Count the ways to obtain administrative access to it.

Through the vault, which you expect.

Through a named account with standing rights.

Through a service account whose credential is in a file.

Through group membership that grants it indirectly.

Through a backup or restore path.

Through the hypervisor or the cloud console beneath it.

A vault deployment that leaves five of six paths open has improved one path. That is progress, and it should not be reported as the system being protected.

The path count test

A short exercise that shows real coverage better than any onboarding percentage.

Pick five systems across tiers.

For each, enumerate every route to administrative access: the broker, named accounts with standing rights, service accounts, indirect group membership, backup and restore, the hypervisor, the cloud console beneath it.

Mark which are controlled.

The ratio is your coverage on that system.

Repeat annually, and after any architecture change.

A vault deployment covering one route in six has improved one route, which is progress and should not be reported as the system being protected.

Reporting coverage honestly

Three numbers, and the first is the one usually reported alone.

Systems onboarded against systems in the inventory. Measures the project.

Privileged accounts vaulted against privileged accounts discovered. Better.

Sessions brokered against sessions occurring, measured from target-side authentication logs. This is the one that measures the estate, and it requires a denominator the PAM system does not hold.

Report all three, with the denominator stated for each.

Where the third is materially below the first, the path is not enforced, which is a specific and fixable finding rather than a general shortfall.