PAM in manufacturing: controlling privileged access for the vendor operating remotely on your control systems

Industrial plants depend on outside vendors to maintain specialized equipment — and a good share of that maintenance now happens remotely: the equipment manufacturer's technician accesses the control system from outside the plant to diagnose a fault or apply an update, without needing to show up in person.

The problem is rarely the practice itself — it's legitimate and necessary. It's in how that access usually gets set up: a credential created once, to close a specific ticket, and never deactivated afterward. Months or years later, the connection is still live, with nobody checking whether it should still exist.

One-off access that never gets revoked

Revoking and re-granting access every time a vendor needs to handle a ticket is a hassle — so, in practice, a lot of plants take the path of least friction: they leave the VPN tunnel or the shared credential active permanently, "so it doesn't have to be set up again next time." That administrative shortcut turns what should be temporary, supervised access into a permanent entry point, with a credential nobody reviews and nobody can say for certain is still in legitimate use.

PAM for IT isn't the same as PAM for OT

Privileged access management built for a corporate environment — covering a server, a workstation, an application integrated with SSO — starts from assumptions that an OT environment often doesn't meet: a legacy system that can't run a modern agent, a proprietary protocol, equipment that can't be updated without voiding the manufacturer's certification. PAM applied to OT needs to operate outside the target device itself — an access gateway that brokers the entire session, grants time-limited privilege elevation, and never hands the real credential over to the outside vendor.

This pattern from modern identity architecture, already standard in corporate environments, is arriving late to industrial environments — but the risk it addresses is, if anything, just as critical.

A logged session matters as much as an authorized one

Authorizing access is only half the control. The other half is logging exactly what happened during the session — which command ran, which parameter changed, on which system. That record matters both for incident investigation and for an increasingly relevant question whenever something fails after a remote maintenance session: what exactly did the vendor do, and is that documented, or does it come down to their word against the plant's.

This is an architecture decision, not a contract clause

A contract clause stating that "access must be authorized and audited" doesn't implement any control on its own — it just formalizes an expectation that needs a real technical mechanism to actually hold. The same rigor already applied to continuous vendor risk monitoring needs to extend specifically to the remote access layer: every vendor with an active credential in the OT environment is, by definition, part of the plant's risk surface, and needs the same level of technical control — not just contractual language — as any other privileged access.

A forgotten credential is a door nobody locks

Mapping how many vendor connections are still active in the industrial control environment today, without recent review, usually turns up a bigger number than most plants expect. UNIQ helps industrial operations structure PAM built for this exact scenario. Talk to the technical team to start that mapping.