What you are evaluating
This profile covers privileged account and session management plus endpoint privilege. Cloud entitlement and identity-threat capabilities are adjacent offerings. Confirm the selected module, deployment and target support rather than treating the whole portfolio as one product.
A useful evaluation context
This can be evaluated by Windows and Unix least privilege plus vendor remote access to jump hosts, including operational-technology-adjacent administration.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Password Safe vaults and rotates privileged credentials instead of sharing local administrator passwords.
- Privileged Remote Access brokers vendor and operator sessions, including jump-host patterns used near operational technology.
- Endpoint privilege management and Entitle just-in-time elevation reduce standing local admin on Windows and Unix endpoints.
Where it fits in the work
- Inventory Windows, Unix, and vendor jump-host targets in a lab, including one shared workstation pattern if that is your risk.
- Enroll a synthetic vendor in Privileged Remote Access, require checkout or just-in-time elevation, and record the session.
- Remove the vendor at the end of a change window and confirm the endpoint no longer has standing local administrator rights.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized lab, grant a synthetic vendor time-boxed remote access to a jump host through the privileged-access broker, capture the session, and expire the window.
Evidence to look for
The vendor reaches only the jump host during the window, a session record exists, and a connection attempt after expiry is denied.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which modules in the Pathfinder quote are Password Safe, Privileged Remote Access, endpoint privilege, or just-in-time elevation, and which are optional?
- Can the lab prove session brokering to the jump host you actually use, not only a vendor demo appliance?
- Where do cloud infrastructure entitlement or identity-threat detection claims begin, and are they in this SKU?