Skip to main content
qorionix
All four modules

PAM

Privileged access

Administrators do the work without ever holding the password.

Privileged access management is normally sold to organisations with a dedicated team and a six-figure budget, and it is priced accordingly — a mid-market quote runs to seven figures with a four-to-nine-month deployment. More than half of SMBs still keep privileged credentials in a spreadsheet, which is not stupidity; it is what is left when the alternative costs more than the company's IT budget. It comes included on Complete, and as a standalone add-on on Core or Protect at €15 per privileged person per month — a 15-person company can cover its 2 admins for €30/month on top of whichever plan it already has, without moving to a bigger one just for this.

Included from Complete · see the tiers

What it does

Capabilities, with their real status

  • Credential injection through a session proxy

    Shipping

    The operator authenticates to the gateway; the gateway pulls the credential from the vault and opens the upstream connection. The raw credential never reaches the person doing the work, so it cannot be reused, shared or pasted into a chat window.

  • Session recording with a keystroke index

    Shipping

    Recordings are envelope-encrypted and carry a millisecond-offset keystroke index, so a review can jump to the moment a command was typed instead of scrubbing through an hour of terminal.

  • Six credential rotation engines

    Shipping

    Active Directory service accounts, AWS IAM keys, generic databases, Linux SSH, RDS IAM tokens and Windows remote management, on a schedule. Postgres, SQL Server and Cisco IOS were verified against real targets: the new secret authenticates and the old one is rejected.

  • Just-in-time elevation with approvals

    Shipping

    Standing administrator rights are the thing being removed. Elevation is requested, approved, time-boxed and recorded, and it expires without anyone having to remember to revoke it.

  • Native RDP gateway

    Beta

    Credential injection for Windows sessions with a parsed event transcript. There is no pixel replay — you get a searchable record of what was done, not a video of it.

The limits

What this module does not do

Every module on this site carries this section. A product page without one is a product nobody has run against a real customer.

  • No pixel replay for RDP. The transcript is parsed events only, and we would rather say so than let you discover it during an investigation.
  • Rotating a domain controller, root or break-glass credential is never automated.
  • Granting, extending or elevating privileged access is never automated and is not exposed to the model at all.
  • Entra service-principal and Palo Alto rotation are tested against mocks only; no live tenant or appliance has confirmed them.

The rest of the platform

Also included

IAM

Identity and access

Every sign-in decided by a rule you can read, and a trace showing which one won.

ReadSIEM

Log collection and detection

Your logs in one place, matched against detections that carry their own false-positive guidance.

ReadXDR

Endpoint detection and response

What the suspicious process actually did, and a response you can take back.

Read

Find out what an attacker would see

Connect Microsoft 365 and read your own posture report. 82 checks against your real tenant, naming your real administrators, applications and devices. Free, complete, and yours to keep — not a sample with the findings blurred.

Start the free assessment

No card. No sales call before you have read the report.