Loading...
Loading...
You own the vault and the policy. We run the day-to-day — JIT approvals, session monitoring, quarterly access reviews, and SLA-backed emergency provisioning — so PAM stays disciplined past the 18-month mark.
The Verizon Data Breach Investigations Report has, year after year, identified credential abuse as a feature of the majority of breaches it analyses. The 2024 edition continued the pattern. Privileged credentials — domain admins, root, cloud root accounts, the secrets stored carelessly in CI/CD pipelines — are the difference between a contained incident and a full-environment ransomware event.
Privileged Access Management is the well-established control answer: vault the credential so the human (or the script) never sees it, gate every use behind a request-approval workflow, record the session for forensic replay, and review who has what on a defined cadence.
The challenge is operational. PAM platforms are easy to deploy and hard to keep disciplined. Our co-managed model exists to solve that — the platform you own, the operations we run.
The PAM platform licensing. The policy framework. The Tier-0 boundary definition. The list of who can request which credential. Audit-trail data ownership and retention. The SOC integrations.
Day-to-day vault administration. JIT credential request approval workflow. Session monitoring and replay sampling. Quarterly access reviews with the customer's identity team. SLA-backed emergency credential provisioning. Integration health monitoring.
Monthly operations review. Quarterly access review with sign-off. Annual control attestation aligned to RMiT, ISO 27001 Annex A.5.15-A.5.18 and your internal risk taxonomy.
We document every operational runbook in your wiki. If you choose to in-source operations after 24 months, the transition is documented, contractual and clean.
We have no exclusive reseller relationship with any PAM vendor. We deliver against:
The enterprise default for Malaysian FSI. Strongest on Tier-0 isolation and session management at scale.
Strong session-management lineage, broad endpoint privilege management coverage, mature integrations.
Faster time-to-value, popular with mid-market and growing enterprises. Lower operational overhead.
The secrets-management standard for cloud-native and DevOps-heavy estates. Often deployed alongside an enterprise PAM for human accounts.
Selection is driven by your existing identity stack, regulatory scope and integration footprint. We will run a structured shoot-out at scoping if you do not already have a platform in place.
Co-managed PAM directly addresses three RMiT paragraphs that examiners test consistently:
Vault-based credential storage. Just-in-time elevation. No standing privileged access for human users. Documented approval workflow with audit trail.
Approver cannot self-approve. Policy enforces dual-control on Tier-0 emergency access. Quarterly review of who has what reach.
Every privileged action logged centrally. Session recordings retained per regulatory schedule. Anomaly detection on out-of-pattern privileged activity, integrated to the SOC.
Co-managed PAM is most valuable where it covers your Tier-0 boundary — the small population of accounts whose compromise is forest-ending:
Initial deployment runs 4-6 weeks: platform stand-up (or take-over of an existing deployment), policy framework, Tier-0 inventory, first 50-100 privileged identities vaulted, SOC integration. From week seven onwards we are in business-as-usual operations.
Reporting cadence:
IAM (Identity & Access Management) governs the everyday workforce — joiners, movers, leavers, SSO, MFA, the standard-user lifecycle. PAM (Privileged Access Management) governs the small but extremely high-impact population of accounts that can change infrastructure: domain admins, root, kubernetes admins, vault admins, cloud root accounts, database superusers, network device privileged credentials. PAM adds vault-based credential storage, just-in-time access requests, session recording, and continuous access review on top of standard IAM. They are complementary; an enterprise needs both.
PAM platforms are notoriously easy to buy and very hard to operate well. The vault is deployed, integrations are wired, and within 18 months the operations discipline has decayed: emergency access requests pile up, session recordings are not reviewed, integrations break silently, access reviews lapse. Co-managed PAM keeps the customer in ownership of the platform and policy while nCrypt operates the day-to-day discipline — vault admin, JIT approval workflow, session monitoring, quarterly access reviews, SLA-backed emergency provisioning. The customer gets the benefit of PAM without the staffing burden of a 24x7 vault team.
We are deliberately vendor-neutral. nCrypt has delivery experience across CyberArk (the enterprise default for FSI), BeyondTrust (strong on session management), Delinea formerly Thycotic (faster time-to-value, popular with mid-market), and HashiCorp Vault (the secrets-management standard for cloud-native estates). Selection is driven by your existing identity stack, regulatory scope, integration footprint and operational maturity — not by a vendor relationship. We will run a structured shoot-out as part of scoping.
Yes — co-managed PAM directly addresses RMiT paragraphs 10.49 (privileged access controls), 10.50 (segregation of duties), and 10.55 (logging and monitoring of privileged activity). The deliverables — vault inventory, JIT approval audit trail, session recordings, quarterly access review attestation — are designed to be examiner-ready. Our quarterly board summary maps each RMiT clause to operational evidence.
Co-managed PAM typically prices in two layers — the platform licensing (per privileged identity, paid to the PAM vendor) and the nCrypt operations subscription (tiered by number of vaults, integration count and SLA). For a mid-sized Malaysian FI with 200-500 privileged identities, total cost lands in the high five-figure to low six-figure RM per year range. We provide a written quote after a 1-hour scoping call. Onboarding deployment is a separate one-time engagement of 4-6 weeks.
Scoping calls take 30 minutes. Onboarding runs 4-6 weeks. From week seven, you have a co-managed PAM operation that survives the inevitable staff turnover and stays examiner-ready.
Get a Scope