Tanflow PAM · Capability
External Access Monitor
A PAM gateway protects the door people use. The External Access Monitor watches for anyone who comes in through a window.
Overview
Logins that skip the gateway
Every privileged access platform has the same weak spot: a login that never goes through the gateway, such as a local console, a forgotten direct route or a shared password used outside the platform. Tanflow's External Access Monitor puts a lightweight agent on the targets you choose to detect and report those logins.
Logins to a server that happen outside PAM are tracked, so a bypass of the gateway gets noticed.
Turn monitoring on for a connection and a small agent is deployed on that target server, only where you want it.
See monitored targets, active agents and stale agents at a glance, so you know how complete your coverage is.
Each monitored target reports its events and last check-in, building a record of external activity.
Export the monitoring data for review, reporting and evidence.
Why it matters
What you can show an auditor
- You find out when someone logs in around PAM
- Forgotten direct routes and shared credentials used outside the platform come to light
- You can show that the gateway is the only way in, or see exactly where it isn't
- Evidence of out-of-band access for incident investigations
Part of Tanflow PAM
This is built into Tanflow PAM, the privileged access platform that needs no agents and deploys on your infrastructure in 2-4 weeks.
Explore the full platform →FAQ
Common questions
Does every server need the agent?
No. Monitoring is switched on per connection, so the agent goes only on the targets where out-of-band access matters.
What does the monitor actually report?
Server logins that happen outside the PAM gateway, plus each agent's status and last check-in, so bypass activity can be seen and exported.
See External Access Monitor in action
A short demo built around your environment and your compliance requirements.