Training · Free live class
Privileged Access Review
One hour, live and free. You review the essentials of privileged access management, then spend half the hour running a real privileged access review with the VAULTS™ method, on ten accounts ranging from domain admins to bots and vendor DBAs.
Can’t wait for the live class?
Take the free on-demand version now
The same VAULTS™ method as a 31-minute video, free, any time. Watch the trailer, then get the full training.
Why this class
Privileged accounts are what attackers want most.
In the research the book cites, 74% of breaches involved access to a privileged account, and credential breaches took the longest to find and contain: 328 days on average.
Most organizations own a PAM tool. Fewer run a PAM program. The difference shows up in the access review, when someone has to decide, account by account, what stays, what goes and what gets fixed.
- The six types of privileged accounts, and why machine and vendor accounts are the blind spot
- The four implementation steps and the four-stage account life cycle
- The Magnificent Seven PAM best practices
- How PAM powers Zero Trust, and how to write a context-aware access policy
- How to review any privileged account with six checks
The method
VAULTS™: six checks for every privileged account
Pass all six and the account is certified. Fail Sunset and the access is revoked. Fail any other letter and the access stays, with a named fix, an owner and a due date.
V · Verified identity
“Is the login strong, unique and protected?”
A pass looks like: MFA enforced, phishing-resistant for the highest risk. No default names or passwords, no shared or embedded credentials, secrets vaulted and rotated.
A · Accountable owner
“Is there a named, current person who answers for this account?”
A pass looks like: A named owner still in role, including for service, bot, cloud and vendor accounts.
U · Usage window
“Is elevated access time-bound, or standing 24/7/365?”
A pass looks like: Temporary elevated access that revokes itself, with a shorter window for riskier systems. Break-glass access is released only under dual control.
L · Least privilege
“Do the rights match what the current role actually needs?”
A pass looks like: Role-based rights, separate admin and everyday accounts, and no rights left over from a previous role. No one person completes a critical function alone.
T · Trail
“Is activity logged, monitored and actually watched?”
A pass looks like: Sessions recorded and sent to the SIEM, with alerts on default and break-glass use.
S · Sunset
“Should this access still exist at all?”
A pass looks like: A confirmed business need, and end dates on temporary and vendor access. Role changes and departures trigger removal.
The workshop
Thirty minutes as a review board
Teams take the role of the access review board at Widget Conglomerates, the case company from the book, and work through three timed sprints.
01
Discover & classify
Ten privileged accounts, from a model domain admin to an RPA bot with a shared password and a vendor DBA with round-the-clock access. Name each account’s type, rate its risk and list the red flags.
02
Review & decide
Run every account through VAULTS™ and decide whether to certify, revoke or remediate it. The team’s skeptic argues for certify every time.
03
Write the policy
Replace the vendor’s standing access with a Zero Trust policy, then test it against who, what, when, where, why and how.
Who should attend
Security, risk, GRC, third-party risk, audit and IT professionals. Mixed experience levels are welcome, and no PAM tool knowledge is needed.
What you take home
- The VAULTS™ Review Toolkit: method card, single-account worksheet, review tracker and review program checklist
- A workbook with a quick-reference guide to the book’s frameworks
- A Magnificent Seven self-assessment and a 30-day action plan
Dates
2027 dates
Live online, noon to 1pm Eastern, one Wednesday a quarter. Registration is free: send the form with the date you want and we will send you the joining link and the workbook.
The class on one page
Agenda, the workshop, what you take home and the 2027 dates. Written to be forwarded.
FAQ
Questions about the class
Is it really free?
What is VAULTS™?
Do I need a PAM tool, or experience with one?
Can you run it for our team?
Where does the content come from?
VAULTS™ is a method of Third Party Threat Hunting LLC.