VAULTS™ · Privileged access review method
Six checks for every privileged account. Three decisions. Any PAM tool.
VAULTS™ is Third Party Threat Hunting™’s method for the privileged access review: six checks for every privileged account, human, machine or third-party, each ending in a decision you can record and defend to an auditor.
Free on-demand training
Watch the free VAULTS™ training
A 31-minute video with a worked review. Watch the trailer, then get the full training free.
Why a method
Most organizations own a PAM tool. Fewer run a PAM program.
The difference shows up in the access review, when someone has to decide, account by account, what stays, what goes and what gets fixed. Without a method, that decision becomes an owner clicking “approve” down a spreadsheet.
In the research cited in Privileged Access Management, 74% of breaches involved access to a privileged account. VAULTS gives every review the same six questions, the same evidence and the same three possible outcomes, so the result means something the next time an examiner asks.
The method
Six checks, one key question each
Every privileged account runs through all six letters. Record the evidence for each: a check with no evidence behind it is a fail.
V · Verified identity
“Is the login strong, unique and protected?”
A pass looks like: MFA enforced, phishing-resistant for the highest risk. No default names or passwords, no shared or embedded credentials, secrets vaulted and rotated.
Red flags: Password only, or SMS for a high-risk account. A default “Administrator”. One credential shared by many people or bots. Passwords in scripts, config files or spreadsheets.
A · Accountable owner
“Is there a named, current person who answers for this account?”
A pass looks like: A named owner still in role, including for service, bot, cloud and vendor accounts.
Red flags: “None listed.” An owner or sponsor who has left. A shared team mailbox as the owner.
U · Usage window
“Is elevated access time-bound, or standing 24/7/365?”
A pass looks like: Temporary elevated access that revokes itself, with a shorter window for riskier systems. Break-glass access is released only under dual control.
Red flags: Standing, always-on admin rights. A privileged account used for everyday work. A single approver for break glass.
L · Least privilege
“Do the rights match what the current role actually needs?”
A pass looks like: Role-based rights, separate admin and everyday accounts, and no rights left over from a previous role. No one person completes a critical function alone.
Red flags: Rights carried over from previous roles. Domain admin “because it was easier”. Full administrator rights on an automation account.
T · Trail
“Is activity logged, monitored and actually watched?”
A pass looks like: Sessions recorded and sent to the SIEM, with alerts on default and break-glass use.
Red flags: No session recording. Logins nobody can explain. Interactive use of a service account. Logs that nobody reviews.
S · Sunset
“Should this access still exist at all?”
A pass looks like: A confirmed business need, and end dates on temporary and vendor access. Role changes and departures trigger removal.
Red flags: Inactive for 30 days or more. A contract that has ended. Rights left over after a promotion. An emergency account that was never deactivated.
The decision
Every account ends in one of three outcomes
Certify
Passes all six letters. Record the evidence and the reviewer.
Revoke
Fails Sunset: the access, or part of it, has no current business need. Remove it now.
Remediate
Passes Sunset but fails any of V, A, U, L or T. The access stays, with a named fix, a fix owner and a due date.
No one reviews their own access. Reviewers are assigned, and urgent findings such as exposed credentials or unexplained logins are escalated the same day, not held for the report.
How a review runs
Scope it, decide it, close the loop
Before
Write down what “privileged” means. Run discovery with a tool and cross-check it against the CMDB. Include vendor, cloud, service and machine accounts and embedded credentials, then risk-rank so high-risk accounts are reviewed first.
During
Run every account through all six checks. Owners attest to their accounts, and an account with no owner gets one before the review closes.
After
Execute and verify revocations in the target system, track remediation to closure, and fix the root cause of repeat findings in the process, not just the account.
| Activity | Cadence |
|---|---|
| Privileged access review | At least quarterly |
| Event-driven review | Every role change, departure or contract end |
| Privileged account discovery | Twice a year at least; ideally continuous |
| Inactive accounts | Notify at 30 days; disable 15 days later |
| Break-glass accounts | Deactivate within 24 hours of use |
Where it fits
Your PAM tool holds the keys. VAULTS decides who should.
The tool
Your PAM platform
Vaults and rotates credentials, brokers elevation and records sessions. It enforces a decision; it does not make one.
The decision
VAULTS™
Decides, account by account, whether each access should exist, on what terms and with what evidence. It works whether your accounts sit in a vault or a spreadsheet.
Produces evidence for
Third parties
Vendor accounts are where reviews break
A vendor controls its own leaver event, so nobody tells you when their engineer leaves. VAULTS asks for an internal owner for every vendor account (A), no standing vendor access (U), and an end date that matches the contract (S).
Get the toolkit
Four sheets: the method card, a single-account worksheet, a review tracker and a review program checklist with cadences. Free to download.
Learn it live
The free Privileged Access Review class
One hour, live online, one Wednesday a quarter: the essentials of privileged access management, then thirty minutes running a real review with VAULTS on ten accounts, from domain admins to bots and vendor DBAs. Free, registration required.
| Course | Date | Time | Format | |
|---|---|---|---|---|
| VAULTS Privileged Access Review: Free 1-Hour Class | Feb 24, 2027 | 12pm–1pm ET | Live online | Enquire → |
| VAULTS Privileged Access Review: Free 1-Hour Class | May 19, 2027 | 12pm–1pm ET | Live online | Enquire → |
| VAULTS Privileged Access Review: Free 1-Hour Class | Aug 18, 2027 | 12pm–1pm ET | Live online | Enquire → |
Have us run it for you
Privileged access review
Third-party privileged access: who holds it, what it reaches and how it is governed, reviewed with VAULTS against your own environment. Ranked findings, evidence references and a remediation plan with dates. From $9,500.
FAQ
Questions about VAULTS
What does VAULTS stand for?
Does VAULTS replace our PAM tool?
Which accounts does it cover?
How often should we run it?
Can our team run VAULTS without you?
Where does it come from?
VAULTS™ is a method of Third Party Threat Hunting LLC.
Related
Pairs with
Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →