Admin rights that exist when someone needs them. Not for the rest of the week.
Domain admin passwords that haven't changed since 2019. Cloud owner roles granted for one weekend migration and never removed. We find privileged accounts, put them under CyberArk, BeyondTrust, Delinea or Entra PIM, and replace standing access with elevation that expires.
Tier-0 systemsDCs · hypervisors · backupServers and databasesWindows · Linux · SQLCloud admin rolesAzure · AWS
04 · Oversight
Session recordingsRDP · SSH · web consolesSIEMprivileged activity alerts
CyberArkBeyondTrustDelineaMicrosoft Entra ID
in short·15-second read
Privileged access management (PAM) controls the accounts that can change systems, such as domain admins, root, database owners, cloud administrators and the service accounts behind applications.
Cohash discovers those accounts, vaults and rotates their credentials, records privileged sessions and moves administrators to just-in-time elevation. We implement CyberArk, BeyondTrust, Delinea and Microsoft Entra PIM, and we migrate self-hosted vaults to SaaS.
you probably need this if
Domain admin passwords haven't changed in years because nobody knows what would break.
Cloud owner roles granted for one migration weekend are still assigned.
Vendors share a single VPN account to reach production servers.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Privileged Access Management, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · privileged access management3 open
openDomain admin passwords haven't changed in years because nobody knows what would break.
recurringCloud owner roles granted for one migration weekend are still assigned.
blockedVendors share a single VPN account to reach production servers.
exposure
Privileged account discoveryVaulting and rotationSession managementJust-in-time elevationEndpoint privilege managementSelf-hosted to SaaS migration
startrehearsehandover
Find
Prioritize
Onboard and rotate
Remove standing access
we are here
ready to hand over
Passwords rotate on schedule again.
Production Owner exists only during an activation with a reason attached.
Privileged account inventory with owners and dependency map
Safe, platform and policy design for your PAM product
chapter 01 · where it hurts
Why teams reach out
Domain admin passwords haven't changed in years because nobody knows what would break.
Cloud owner roles granted for one migration weekend are still assigned.
Vendors share a single VPN account to reach production servers.
chapter 02 · what we change
How we solve it
Privileged account discovery
Vaulting and rotation
Session management
Just-in-time elevation
Endpoint privilege management
Self-hosted to SaaS migration
chapter 03 · how it runs
Our approach
Find
Prioritize
Onboard and rotate
Remove standing access
chapter 04 · where you end up
What changes
Passwords rotate on schedule again.
Production Owner exists only during an activation with a reason attached.
Privileged account inventory with owners and dependency map
Safe, platform and policy design for your PAM product
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
Scans of domains, servers, databases and cloud accounts to find every account with admin rights, who uses it, and what would break if its password changed tomorrow.
Credentials onboarded in waves, with rotation switched on only after dependencies such as scheduled tasks, IIS app pools and connection strings are mapped. This is where most PAM rollouts stall.
We broker RDP, SSH and web console sessions. On the systems your auditors name, sessions are recorded with searchable keystrokes. Production needs an approval step.
In Entra PIM or your PAM platform, admins activate a role for a few hours and give a reason and a ticket number. Permanent group membership goes away.
Local admin removed from workstations, with an allow-list for the installers and tools people genuinely need, so the help desk survives the Monday after.
Moving a self-hosted CyberArk vault to its SaaS service, or consolidating two PAM products after a merger. Safes, platforms and connectors are rebuilt deliberately, not copied across wholesale.
capability 01 / 06in production
Privileged account discovery
Scans of domains, servers, databases and cloud accounts to find every account with admin rights, who uses it, and what would break if its password changed tomorrow.
Credentials onboarded in waves, with rotation switched on only after dependencies such as scheduled tasks, IIS app pools and connection strings are mapped. This is where most PAM rollouts stall.
We broker RDP, SSH and web console sessions. On the systems your auditors name, sessions are recorded with searchable keystrokes. Production needs an approval step.
Local admin removed from workstations, with an allow-list for the installers and tools people genuinely need, so the help desk survives the Monday after.
Moving a self-hosted CyberArk vault to its SaaS service, or consolidating two PAM products after a merger. Safes, platforms and connectors are rebuilt deliberately, not copied across wholesale.
We pieced these together from Privileged Access Management situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
A CyberArk vault where rotation was switched off after one bad night
composite · not a client story
Beforethe situation
Self-hosted CyberArk holds a few thousand accounts, but CPM rotation is disabled for most Windows service accounts since a rotation broke a payroll batch job. The passwords are vaulted, and they haven't changed since.
What we dothe work
Pull logon events and scheduled task and IIS app pool inventories to map where each service account runs. Configure CyberArk usages for those dependencies, then re-enable rotation by platform in waves, tested in a lower environment with each app owner present.
Afterwhere you end up
Passwords rotate on schedule again. Any dependent tasks are updated in the same change, and the payroll job runs on a documented usage instead of a permanent exception.
case file 02
Forty engineers with permanent Owner on production subscriptions
composite · not a client story
Beforethe situation
Owner on production Azure subscriptions was granted to forty engineers during a data center exit and never removed. Entra PIM is already licensed, but no Azure role is configured as eligible.
What we dothe work
Export current assignments and compare them with Azure activity logs to see who actually used Owner recently. Convert those to eligible assignments with a ticket field and an activation limit. Move everyone else to Contributor or narrower roles, and alert on any new permanent assignment.
Afterwhere you end up
Production Owner exists only during an activation with a reason attached. A permanent assignment now raises an alert instead of passing unnoticed.
How admins reach critical systems through a PAM platform
Instead of holding standing rights, administrators and vendors ask for access through the PAM platform or Entra PIM. We broker and record the sessions. Credentials rotate after use, and the SIEM receives privileged activity.
01 · Requesters
IT administratorsnamed admin accounts → PAM platform · request session→ Just-in-time roles · activate role
Vendors and contractorstime-limited access → PAM platform · brokered login
02 · Access control
PAM platformCyberArk · BeyondTrust · Delinea → Tier-0 systems · RDP session→ Servers and databases · SSH and rotation→ Session recordings · recording
Vendors and contractors → PAM platform: brokered login
IT administrators → Just-in-time roles: activate role
Change tickets → PAM platform: approval
PAM platform → Tier-0 systems: RDP session
PAM platform → Servers and databases: SSH and rotation
Just-in-time roles → Cloud admin roles: time-bound role
PAM platform → Session recordings: recording
Session recordings → SIEM: session events
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Find
We build the privileged account inventory from discovery scans and interviews, and tag each account by system, owner and dependency.
step 02
Prioritize
Tier-0 first, meaning identity systems, hypervisors and backup. Then production databases and cloud roles.
step 03
Onboard and rotate
We vault accounts in waves and only turn rotation on once dependencies have been tested. Sessions to in-scope systems go through the broker.
step 04
Remove standing access
Permanent admin memberships converted to eligible assignments with approval.
you keep
What you're left with
We write these for your Privileged Access Management setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
inventory01
Privileged account inventory with owners and dependency map
yours to keep
design02
Safe, platform and policy design for your PAM product
yours to keep
tests03
Rotation plan with tested dependency fixes
yours to keep
evidence04
Session recording scope agreed with internal audit
yours to keep
report05
Standing-privilege reduction report by tier
yours to keep
runbook06
Operator runbooks for onboarding and break-glass access
talent and delivery · privileged access management
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Privileged Access Management work. The ones who've done it answer differently from the ones who've read about it.
Q1
Before you turn rotation on, how will you find every place a service account password is used?
Rotation breaks scheduled tasks, app pools, connection strings and scripts that keep a copy of the password. Ask for the discovery method. A complete CMDB is rarely a safe assumption.
Q2
Which systems go in Tier-0, and who signs off on that list?
Domain controllers, AD CS, Entra Connect servers, hypervisors and backup consoles can each hand an attacker the domain. If Entra Connect or the backup admins aren't in the tiering, it isn't finished.
Q3
How does break-glass access work if the PAM platform itself is down?
A vault outage during an incident can lock out the people who need to fix it. Ask for the offline procedure, who holds it, and when it was last tested.
Q4
What does Palo Alto Networks owning CyberArk change in our contract or roadmap?
The acquisition closed in February 2026 and the platform is now marketed as Idira. Licensing and support terms can shift at renewal, so get commitments for your deployment model in writing.
Q5
Which sessions will be recorded, and who reviews the recordings?
Recording everything fills storage that nobody watches. Scope should follow audit requirements and risk, with a named reviewer and a retention period.
Not overnight. Palo Alto Networks completed the acquisition on 11 February 2026 and said CyberArk's identity products would remain available as a standalone platform. It now markets that platform as Idira. We'd keep your roadmap, watch licensing terms at renewal, and get support commitments in writing before starting a major migration.
02Should we vault everything or go straight to just-in-time access?
Most estates need both. Shared and service credentials still need a vault and rotation. Human admins are better served by elevation that expires, which removes their rights from the target between uses. We usually vault Tier-0 accounts first, then convert human admin access to just-in-time.
03How long does a PAM rollout take?
It depends on account count and how many of those accounts are embedded in applications. Vaulting human admin accounts moves quickly. Service accounts take longer because every rotation has to be tested against whatever uses the credential. We size the plan after discovery.
04Is Entra PIM enough on its own?
For Entra roles and Azure resources it often is. What it won't do is vault on-premises server passwords, broker SSH sessions or rotate database credentials. If you have a big on-premises or Linux estate, you'll probably want a PAM platform alongside it.
05Will rotating service account passwords break production?
It can, which is why we never rotate on day one. We map where each credential is used, test rotation in a lower environment, and schedule production rotation with the application owner available.
related
Often paired with
Projects on Privileged Access Management usually end up touching one of these, so they're worth a look.
