PAM vs session recording: do you need a PAM suite yet?

Fernhill is a made-up but typical startup: five engineers, 20 Ubuntu servers on AWS, and a first SOC 2 Type II audit starting next quarter. Nobody shares passwords. Each engineer has their own account, signs in with Google Workspace and a hardware passkey, and reaches servers with their own SSH key.

The CTO's real question is about evidence. If someone runs a migration on a production database at 11 p.m., or a customer asks who touched their data, can the team replay exactly what happened and prove nobody edited the log?

PAM suites were built for large companies where many admins and contractors share passwords for accounts like root across hundreds of machines. The suite locks those passwords in a vault, changes them after each use, and can require approval before anyone checks one out.

To connect, an engineer goes through the suite's proxy. The proxy fetches the password, logs in for them, and records the session. CyberArk, BeyondTrust, Delinea and KeeperPAM all work this way. CyberArk can also let a reviewer watch or end a session live and block listed commands. KeeperPAM runs its proxy on your own network and encrypts recordings with keys Keeper can't read.

The weak spot is any route that skips the proxy. An emergency SSH key left on a server, a peered network or a local console all get in unrecorded. Closing those gaps means blocking every other route or installing an agent on each server.

A session recorder skips the proxy and records on the server itself, so it doesn't matter how someone got in. You install shellz with one command on each server. From then on it records SSH sessions, one-off remote commands, SFTP file transfers, console logins, su - and container shells. tmux and screen are captured inside the session.

Each recording is encrypted on the server, signed so any edit or gap shows up, and uploaded to storage that can't be changed. Fernhill's deploy bot gets its own account and is recorded like the engineers (how agent recording works). The security page covers encryption and tamper alerts.

shellz doesn't do what a PAM suite does. It has no password vault and no approvals, it doesn't block commands, and it doesn't record Windows, Kubernetes or database sessions. There's no self-hosted version, public API or SIEM export yet. shellz hasn't completed its own SOC 2 audit either, so your reviewer will treat it as a startup vendor.

SOC 2 doesn't name any type of software. Its criteria ask how you limit access to production (CC6.1) and how you watch for unauthorized changes (CC7.2). Fernhill's auditor will want:

• ›A list of people with production access.
• ›Proof that they use MFA.
• ›A quarterly review of that list.
• ›Tickets showing access removed when people leave.
• ›A record of what admins did on production servers that nobody could edit.

Anyone with sudo can wipe their shell history. AWS CloudTrail logs calls to the AWS API, so it never sees what happens inside a server. PCI DSS asks for logs of every action by anyone with admin access (Requirement 10.2.1.2). Personal logins plus tamper-evident recordings of every session give the auditor that, with no vault involved.

BeyondTrust, Delinea and KeeperPAM sell through quote forms. Delinea offers a 30-day trial of its vault for up to 10 users. CyberArk is the exception, with a public AWS Marketplace price of $44,712 a year for 25 users, about $1,788 each. Fernhill would pay for 25 seats to cover five engineers.

Setup usually takes days to weeks, because the vault, the proxy and the firewall rules that force traffic through it all need configuring. Delinea's own pitch is "weeks, not months."

On shellz Commercial, Fernhill's five engineers cover all 20 servers for $50 a month plus $1/GB stored. The free plan covers up to 10 servers. The first live session appears about two minutes after sign-up.

Auditors give no credit for buying enterprise software two years early, and recording now doesn't stop you adding an access tool later. You can use Teleport, AWS Session Manager or Tailscale SSH to control who reaches a server, and keep shellz on the servers to catch emergency logins and container shells.

• ›Today, under 25 people on cloud Linux with a first SOC 2: SSO with MFA, no shared SSH keys, and shellz on every production server.
• ›Contractors or temporary production access: add a proxy that grants time-limited access. Compare StrongDM alternatives and Boundary replacements.
• ›Shared accounts you can't get rid of yet: add a password vault with rotation before buying a full suite.
• ›Windows servers, regulated finance or healthcare, or 50+ admins: budget for CyberArk, BeyondTrust, Delinea, KeeperPAM or Syteca, and someone to own it.