PAM · Secrets · Identity · Cloud · Integration
Five solution areas on one platform, module by module — components, architecture, integrations and what each engagement leaves behind.
Same six phases, every time
Privileged Access Management
Control the accounts attackers want most. Privileged accounts are the target in almost every serious breach. We design and run PAM programmes on Idira Self-Hosted and Privilege Cloud that bring those accounts under management and keep them there.
Hardened, isolated credential store with its own OS baseline, firewall and proprietary protocol. Clustered or DR-paired for continuity.
- Cluster Vault or DR Vault with PAReplicate
- Vault hardening and network isolation
- Safe design by ownership and sensitivity
- Master and DR key handling procedures
Rotates, verifies and reconciles credentials on schedule or on event across every platform type, with dependency-aware change for service accounts.
- Platform policies and exception handling
- Reconcile with reconciliation accounts
- Dual-account and dependency rotation
- Custom plugins for unsupported targets
Portal and REST API for requests, approvals, connections and administration; SSO and MFA in front of every privileged action.
- SAML / OIDC SSO with step-up MFA
- Dual control and exclusive access
- REST API automation and PACLI
- Load-balanced, hardened IIS
Isolates and records RDP, SSH, database and web sessions so the credential never touches the endpoint; PSMP for native SSH, HTML5 Gateway for browser-only access.
- Session recording, keystroke and SQL audit
- Live monitoring and termination
- Universal and custom connection components
- HTML5 Gateway for clientless access
Baselines privileged behaviour and raises risk on anomalies — unmanaged access, suspicious commands, Kerberos attacks — with automatic response into the vault.
- Unmanaged privileged access detection
- Golden ticket and pass-the-hash indicators
- Auto-suspend and credential rotation on risk
- SIEM forwarding and correlation
VPN-less, agent-less privileged access for vendors and contractors through the platform, time-bound, approved and fully recorded.
- Biometric mobile authentication
- Zero-standing vendor accounts
- Recorded, isolated sessions
- Automatic revocation on expiry
Topology
- Primary, DR and satellite vaults
- Component HA behind load balancers
- Segmented networks and firewall rules
- Privilege Cloud: connector servers + Secure Tunnel
Integrations
- Active Directory and Entra ID for auth and directory mapping
- SIEM — Splunk, Sentinel (syslog / CEF)
- ITSM — ServiceNow ticket validation on request
- MFA — Idira Identity, RADIUS, SAML providers
Operations
- Discovery-led onboarding waves by account owner
- Break-glass and emergency procedures
- Backup, restore and DR failover testing
- Version currency inside vendor support
Secrets Management
Machines outnumber humans. Secure them the same way.. Static credentials in code, config and CI/CD pipelines are the quiet majority of privileged access. We deploy Idira Secrets Hub, Secrets Manager and the Central Credential Provider so applications retrieve secrets at runtime instead of storing them.
Policy-as-code secrets store for applications, containers and pipelines, with machine identity authenticated by platform-native methods rather than by another secret.
- Policy-as-code (YAML) and RBAC
- Authenticators: Kubernetes, AWS IAM, Azure, JWT, OIDC
- Followers for read scale and HA
- Audit trail per secret and host
Syncs vault-managed secrets into AWS Secrets Manager, Azure Key Vault and GCP Secret Manager so cloud-native apps use native SDKs while rotation and ownership stay central.
- One-way sync from Privilege Cloud safes
- Per-account, per-region sync policies
- Native SDK consumption, no app change
- Rotation reflected in cloud stores
Runtime credential retrieval for applications and scripts over REST, agent or SDK, with app authentication by path, hash, OS user, certificate or address.
- AIM web service with client-certificate auth
- Credential Provider agent and ASCP for app servers
- Application onboarding patterns and libraries
- Removal of hard-coded credentials
Native retrieval in Jenkins, GitLab, GitHub Actions, Kubernetes (Secrets Provider, sidecar, ESO) and Terraform so secrets never land in code, images or logs.
- Kubernetes Secrets Provider and Summon
- Terraform and Ansible integration
- Short-lived credentials for CI runners
- Secretless patterns where supported
Find hard-coded and unmanaged secrets across repositories, configuration and images before an attacker does, then bring them under management.
- Repository and config scanning
- Prioritised remediation backlog
- Rotation of exposed secrets
- Guardrails to prevent regression
Dual-account and dependency-aware rotation so credential change never breaks the application that depends on it.
- Dual-account rotation patterns
- Dependency mapping
- Rotation windows and rollback
- Service account governance
Deployment
- Secrets Manager SaaS or self-hosted leader/follower
- Secrets Hub connected to Privilege Cloud
- CCP behind load balancers with client certificates
- Network paths from clusters and pipelines
Identity for machines
- Kubernetes service accounts and JWT
- AWS IAM roles and Azure managed identities
- Certificate-based app authentication
- Host factory and enrolment
Governance
- Policy-as-code in source control
- Ownership per application and team
- Audit to SIEM
- Break-glass for pipelines
Identity & Access
One identity, every application, the right level of trust. Idira Identity gives the workforce a single front door with adaptive multi-factor authentication and automated lifecycle. We integrate it with your directories, your applications and your privileged access layer so identity and privilege are governed together.
SAML, OIDC and WS-Fed federation for SaaS and internal apps, with app catalog, user portal and legacy app support through browser extension and secure web sessions.
- SAML / OIDC / WS-Fed app integration
- App catalog and user portal
- Legacy app SSO patterns
- Federation with Entra ID and AD
Risk-based step-up using device, location, behaviour and threat signals; FIDO2 passkeys, hardware tokens, biometrics and passwordless flows across the workforce.
- Risk engine and policy-driven challenges
- FIDO2 / WebAuthn passkeys
- Step-up on privileged access (PVWA, SCA)
- Offline and Windows logon MFA
Business application credentials vaulted, shared and auto-filled for every employee — closing the gap between IT privilege and the SaaS logins outside PAM.
- Personal and shared credential vaults
- Browser extension auto-fill
- Secure sharing and ownership
- Reporting on weak and reused passwords
Joiner, mover and leaver automation from HR data with low-code flows for provisioning, deprovisioning and approvals across connected apps.
- HR-driven provisioning (SCIM and connectors)
- Identity Flows workflows and approvals
- Group and role automation
- Deprovisioning evidence
Access certification, segregation-of-duties and role review inside Idira, or through SailPoint Identity Security Cloud where the estate already runs it.
- Certification campaigns
- SoD rules and remediation
- Role mining and review
- SailPoint ISC integration
Detection across the identity fabric — session hijack, risky configuration, privilege drift, misuse — with response actions tied back into the platform.
- Identity posture and configuration risk
- Session and token risk signals
- Automated response playbooks
- PTA correlation and SIEM
Directories
- Active Directory and Entra ID sync with attribute mapping
- employeeID, UPN and mail hygiene
- Conditional access alignment
- Group strategy for app assignment
Endpoints
- Endpoint Privilege Manager for least privilege
- Windows and Mac MFA at logon
- Device trust signals into MFA policy
- Secure Browser for SaaS access
Privilege
- Identity as the auth layer for PVWA and Privilege Cloud
- Step-up on request and approval
- SCA and SIA using the same identity
- Audit and evidence in one place
Cloud Identity Security
Privilege in the cloud should not persist. Cloud consoles are where permanent administrator access accumulates fastest. Idira Secure Cloud Access grants time-bound, task-scoped elevation into AWS, Azure and GCP, and the wider ISPSS platform ties it to the rest of your identity estate.
Just-in-time, zero-standing-privilege elevation into AWS, Azure and GCP consoles and CLIs with approval workflow, session recording and automatic expiry.
- JIT roles across accounts and subscriptions
- Approval and justification workflow
- Console and CLI session capture
- Automated role and policy lifecycle
Brokered, recorded access to Linux, Windows and Kubernetes infrastructure without standing accounts or VPN, using short-lived certificates and native tools.
- Ephemeral access, no standing accounts
- Native RDP / SSH clients
- Kubernetes access brokering
- Recorded and auditable
Isolated, recorded browser sessions for privileged SaaS consoles and admin portals, with data controls and step-up MFA in the session.
- Session recording for SaaS admin
- Copy, paste and download controls
- Step-up MFA in session
- Secure Browser for workforce
Visibility into who can do what across cloud accounts, excess permissions ranked by risk, and least-privilege policy recommendations before privilege is removed.
- Effective permission analysis
- Risk-ranked excess entitlements
- Least-privilege policy generation
- Continuous drift detection
Idira or Entra ID as identity source for multi-account AWS organisations, with permission set design and assignment strategy that SCA elevates on top of.
- SAML federation and SCIM provisioning
- Permission set and group design
- Multi-account assignment strategy
- No "change identity source" surprises
Roles, policies and entitlements for SCA provisioned by pipeline — new accounts arrive ready, drift is corrected automatically.
- AWS and Azure IAM role lifecycle
- Packaged as containers and Lambda functions
- Terraform and CI/CD hooks
- Drift detection and correction
Identity source
- Entra ID or Idira Identity federated to AWS, Azure, GCP
- SCIM provisioning of users and groups
- MFA and conditional access upstream
- Single audit trail
Access path
- SCA for consoles and CLIs
- SIA for servers and clusters
- SWS for SaaS admin portals
- No VPN, no standing admin
Governance
- CEM for entitlement visibility
- Approval and justification records
- Session evidence retained to policy
- Pipeline-provisioned roles
Platform Integration
The platform is only as good as what it connects to. Identity security lives in the seams between products. We build and maintain the integrations that make Idira, your governance platform, your directory and your cloud identity provider behave as one system.
Provisioning, certification and access requests between SailPoint and Idira, with connector credentials retrieved from Secrets Manager rather than stored in the connector.
- AD and app provisioning with vaulted credentials
- Certification feeds from PAM entitlements
- Access request into privileged safes
- Correlation of identities across platforms
Tenant design, hybrid sync and conditional access; Entra as identity source for Idira and AWS, with attribute and UPN hygiene that survives audits.
- Entra Connect and attribute mapping
- Conditional access alignment
- SAML / OIDC to Idira and PVWA
- Tenant and domain strategy
Federation and SCIM from Entra or Idira, permission set design and multi-account assignment strategy.
- SAML and SCIM configuration
- Permission set and group design
- Assignment strategy by OU
- Identity source stability
Privileged and identity events into Splunk or Sentinel with correlation content; ServiceNow ticket validation and approval workflows on privileged requests.
- Syslog / CEF forwarding and dashboards
- PTA and ITDR correlation rules
- ServiceNow ticket validation on request
- Approval workflows and evidence
CPM plugins with change, verify and reconcile flows and PSM connection components for applications with no supported platform; REST and PACLI automation.
- Plugin framework, terminal and web plugins
- PSM universal and custom connectors
- REST API and PACLI automation
- Testing and hardening of plugins
employeeID mapping, UPN strategy and attribute sync so every platform agrees on identity — the unglamorous work that makes the integrations hold.
- Attribute flow design
- employeeID and UPN alignment
- Group strategy for assignment
- Sync monitoring
Governance
- SailPoint ISC sources and provisioning plans
- Vaulted connector credentials
- Certification and SoD feeds
- Access request routing
Directory & cloud
- Entra ID as identity source
- AWS IAM Identity Center SAML / SCIM
- Attribute mapping and hygiene
- Conditional access
Operations
- SIEM correlation content
- ServiceNow workflows
- Plugin and connector maintenance
- Monitoring and alerting
Ready to secure your privileged access?
Tell us about your environment and what you are looking to achieve — we respond within one business day.
Have questions? Let's talk.
We own modules we never rolled out. Can you help?
That is one of the most common engagements we run. We assess what is licensed against what is deployed, design the rollout for your estate, and implement it — then train your team to operate it.
Do you work on Self-Hosted, Privilege Cloud, or both?
Both, including migrations between them. Wave-based cutover by account owner with rollback points and session history preserved.
Can you build connectors for applications with no supported platform?
Yes. Custom CPM plugins with change, verify and reconcile flows, and PSM connection components for thick-client and web applications.
How do you handle secrets in CI/CD?
Secrets Manager (Conjur) and Secrets Hub with native retrieval in Jenkins, GitLab, GitHub Actions, Kubernetes and Terraform — so secrets never land in code, images or logs.
These principles guide every engagement
They define how we design, deliver and operate identity security for our customers.
Certified, not just familiar
Guardian-led, with CDE credentials across PAM, Privilege Cloud, EPM and Secrets Manager, kept current on every release.
Architect-led delivery
Design is reviewed and signed off before anything is built, so what goes live is what was agreed.
Written scope, fixed price
Deliverables, timeline and price in writing before work starts. No open-ended retainers.
Enablement built in
Your team is trained during delivery, so what we build does not depend on us to keep running.
Sound familiar?
The situations that start most of our engagements — in the words we hear them.
Need identity security you can trust?
Talk to a certified architect about protecting privileged access, identities and critical systems. The first call is technical, not a sales pitch.