FortiPAM

Why do you need FortiPAM?

74% of data breaches exploit compromised privileged credentials. Shared admin passwords, standing privileges, and lack of session auditing create critical gaps. Traditional PAM requires separate infrastructure and doesn’t integrate with network security.

FortiPAM is Privileged Access Management integrated with Security Fabric. Zero standing privileges eliminates permanent privileged access, and session recording provides full audit trail of all administrator activities.

How does it work?

Credential Vault

Secure credential storage:

• AES-256 encryption at rest
• SSH keys, passwords, certificates
• API credentials, tokens
• HSM integration optional
• Role-based vault access

Just-in-Time Access

Elimination of standing privileges:

• Request-based access workflow
• Manager/security approval
• Time-limited grants
• Automatic revocation after time expires
• Full audit trail

Session Recording

Recording and monitoring:

• RDP, SSH, web sessions
• Keystroke logging
• Video playback
• Real-time monitoring
• Session termination capability

Key Features

Password Management

• Automatic rotation
• Post-session rotation
• Unique passwords enforcement
• Complexity policies
• Verification after rotation

Access Workflows

• Self-service requests
• Multi-level approval
• Emergency break-glass
• Scheduled access
• Ticket integration

Discovery & Inventory

• Privileged account discovery
• Service account detection
• Orphan account identification
• Privilege analysis
• Risk scoring

Compliance

• Full audit logging
• Session forensics
• Compliance reports (SOX, PCI, HIPAA)
• Evidence collection
• Long-term retention

Supported Systems

Servers:

• Windows (RDP, PowerShell)
• Linux/Unix (SSH)
• Mainframes
• Cloud instances (AWS, Azure, GCP)

Network devices:

• Routers, switches
• Firewalls (including FortiGate)
• Load balancers
• Wireless controllers

Applications:

• Databases (Oracle, SQL, MySQL, PostgreSQL)
• Web applications
• SaaS platforms
• Custom applications

Deployment Models

Model	Concurrent Sessions	Use Case
VM	Variable	Cloud/Virtual
200G	25	SMB
400G	100	Mid-size
1000G	500	Enterprise

FortiPAM Cloud: SaaS deployment without infrastructure

Who is it for?

• Organizations with compliance requirements (SOX, PCI, HIPAA)
• Enterprises with multiple administrators and shared accounts
• Companies deploying Zero Trust for privileged access
• MSP managing client infrastructure

Benefits

For IT: Centralized vault, automated password rotation, simplified access

For security: Zero standing privileges, full session audit, compliance ready

For business: Reduced breach risk, audit compliance, operational efficiency

Specifications

Vault encryption	AES-256, HSM optional
Session types	RDP, SSH, web, database
Access model	Just-in-Time (JIT)
Integration	Security Fabric native

FAQ

What is Just-in-Time Access? Access granted on request, time-limited, with automatic revocation. Eliminates permanent admin access.

How does session recording work? Video capture of RDP/SSH with keystroke logging. Playback, search, forensics.

Does FortiPAM require an agent? Not for most scenarios. Session brokering through FortiPAM without agent on target systems.

How does it integrate with FortiGate? Security Fabric - FortiPAM can use FortiGate for network-level access control.

What is break-glass access? Emergency access with elevated approval, full audit, immediate notifications.

How does password rotation work? Automatic on schedule, on-demand, or post-session. Verification that password works.

Does it support cloud instances? Yes. AWS EC2, Azure VMs, GCP Compute. Console and CLI access.

How does account discovery work? Scan Active Directory, network, systems. Identification of privileged accounts, service accounts.

Which compliance frameworks? SOX, PCI DSS, HIPAA, GDPR, ISO 27001. Pre-built reports and audit trails.

How does support work? Fortinet 24/7 TAC. nFlo as partner offers PAM deployment and workflow configuration.