PAM is climbing the security charts, coming in at no. 4 in the latest CIS controls, up from no. 5 in the previous version. It has also piqued the interest of ‚ ‘the Board’ -the concept of a superuser and the potential impact on critical business systems is easy to grasp.Security teams now find themselves thrust into the spotlight, with the C-suite demanding answers while they grapple with this seemingly intractable problem. It’s uniquely challenging as some people need admin rights to do their job, so we can’t just lock everything down -but “who?”, “when?”, “how?”, “why?”. As one CISO put it, PAM is “at the intersection of human behaviour and technical controls and often brings IT and security into conflict” .There are many tools to administer privileged access but installing a vault to manage PAM is only the beginning.Once you’ve identified how people should be accessing assets, how do you clean up the tangled web of permissions that exists in most big orgs, without hindering BAU?In this talk, we’ll reframe PAM as a data science problem and explore what insight you can glean from your data about where the problem lies and how to fix it.