# Why the Simplicity of an Identity-Aware Proxy Wins Over Legacy Privileged Access Management - Link: https://www.agilicus.com/white-papers/identity-aware-proxy-wins-over-privileged-access-manager/ - Published: 2026-05-21T03:03:20+00:00 - Author: Don Bowman ![A high-fidelity cybersecurity comparison diagram contrasting a complex, heavy enterprise credential vault with a modern, lightweight, identity-aware proxy connecting a remote user clientlessly.](https://www.agilicus.com/www/be8ae2f8-2q.png) # Why the Simplicity of an Identity-Aware Proxy Wins Over Legacy Privileged Access Management ## Replacing Credential Vaults, Gateway Proliferation, and Subnet Exposure with Native, Layer 7 Identity-First Security ## The Modern Cyber-Physical Crisis and the Regulatory Paradigm Shift The industrial landscape is undergoing an unprecedented crisis of security and regulatory pressure. Historically, Operational Technology and SCADA systems operated in an environment of physical isolation, protected by the “air gap.” Today, the demands of industrial automation, remote diagnostics, and hyper-specialised supply chains have dismantled this isolation. Crucial infrastructure, including municipal water treatment facilities, electrical transmission grids, manufacturing plants, and oil and gas pipelines, must now be remotely accessible to a vast network of third-party engineers, maintenance technicians, and system integrators. This hyper-connectivity, whilst essential for operational efficiency, has exposed legacy industrial devices to the full spectrum of global cyber threats. Traditional IT security tools, which rely on the concept of a “trusted network perimeter” secured by virtual private networks (VPNs) and firewalls, have proven wholly inadequate. When an organisation establishes a VPN tunnel for a remote vendor, it creates a direct path to the internal network. If the vendor’s device is compromised, attackers can easily move laterally across the subnet, scanning for vulnerable devices and launching attacks against critical assets. The risk is no longer merely digital; it is physical. A cyberattack on an exposed Programmable Logic Controller (PLC) or Human-Machine Interface (HMI) can result in physical destruction, environmental contamination, or even loss of life, as evidenced by recent real-world attacks targeting municipal water plants and grid utilities. This physical risk has triggered a dramatic shift in regulatory oversight. Globally, critical infrastructure operators are facing a paradigm shift in compliance and personal liability. In Canada, the Canadian Centre for Cyber Security has issued the [36 Cyber Security Readiness Goals](https://www.agilicus.com/white-papers/pragmatic-cyber-resilience-achieving-the-canadian-centre-for-cyber-security-36-readiness-goals-with-agilicus-anyx/)( CRGs), which demand rigorous, verifiable controls for authentication, authorisation, and access management. Concurrently, the Critical Cyber Systems Protection Act ( CCSPA) imposes strict penalties for security failures. In North America, the North American Electric Reliability Corporation (NERC) enforces the NERC CIP standards, specifically CIP-003-9 and CIP-003-11, which mandate strict controls over vendor and external access to electronic security perimeters. In Europe, the [NIS2](https://www.agilicus.com/white-papers/enabling-nis2-compliance-for-vnc-remote-access/) Directive establishes that essential entities must implement comprehensive supply chain security, zero-trust architectures, and robust cryptographic controls, with severe personal liability for corporate boards and executives who fail to exercise proper oversight. Under these modern regulations, “best effort” security policies and manual administrative audits are no longer sufficient. Boards of directors and security officers must be able to provide verifiable, cryptographic evidence of individual accountability for every single remote access event. If a remote contractor modifies a PLC configuration, the compliance team must be able to prove exactly which physical human was using the account, why they were authorised, and what specific protocol-level commands they executed. This level of oversight requires a fundamental transition away from legacy, network-level connectivity models toward identity-governed, application- layer control. In this new regulatory and operational environment, organisations must choose between two competing paradigms: legacy Privileged Access Management( PAM) and modern, Layer 7 Identity-Aware Proxies. ## The Architectural Clash: Identity-Aware Proxy vs. Privileged Access Management (PAM) To secure remote access to sensitive systems, enterprise organisations have historically relied on Privileged Access Management (PAM) suites, with CyberArk and BeyondTrust being the dominant players. Designed during the era of centralised IT corporate data centres, traditional PAM systems were built to secure administrative access to Windows servers and Linux databases. The core objective of PAM is to “vault” high-privilege credentials (such as domain administrator or root passwords), rotate them automatically, and inject them into remote user sessions so that the technician never actually sees the raw credentials. To achieve this, PAM systems implement a complex, multi-server architecture that acts as a secure intermediary between the user and the target resource. In a standard CyberArk or BeyondTrust deployment, a remote user must first log into a central web portal (such as [CyberArk Password Vault Web Access](https://docs.cyberark.com/pam-self-hosted/latest/en/content/pasimp/password-vault-web-access.htm), or PVWA). When the user requests a session, the PVWA coordinates with a [Privileged Session Manager ](https://docs.cyberark.com/pam-self-hosted/latest/en/content/pas%20sysreq/system%20requirements%20-%20psm.htm)( PSM). For clientless web-based access, the session must be routed through an HTML5 Gateway (for example, built on top of Apache Guacamole), which translates protocol- specific streams into an HTML5 canvas. The PSM server then retrieves the required credential from a secure, encrypted Database Vault, establishes a native remote session (such as Remote Desktop Protocol – RDP or Secure Shell – SSH) to the target machine, and merges the credential into the session stream. Throughout this process, the PSM records the screen and intercepts commands for audit purposes. While this model is highly effective for rotating IT passwords, it is an extremely heavy and fragile architecture that creates a significant operational and financial “choke point.” This vault-and-proxy model represents a “perimeter-based” security mindset that has simply been wrapped in layers of enterprise software. It assumes that resources must remain accessible to the session manager, meaning that the session manager itself must reside on a network that can reach the target subnets. Furthermore, because traditional PAM systems operate primarily by proxying administrative sessions, they require substantial server infrastructure, including dedicated databases, web frontends, protocol proxy servers, and gateway clusters. Managing, patching, and licensing this enterprise software stack requires a dedicated team of administrators, resulting in enormous total cost of ownership (TCO) and significant configuration complexity. In stark contrast, the Identity-Aware Proxy paradigm, pioneered by the Agilicus AnyX platform, completely re-imagines the security model by moving the security boundary from the network layer (Layer 3) to the application layer (Layer 7). Instead of building a complex fortress of credential vaults and session-translation gateways, Agilicus AnyX operates as an identity-governed broker. There is no network-level connection between the remote user and the target resource. Instead, the AnyX platform leverages an outbound-only, lightweight connector sitting safely inside the target network. When a user requests access, the AnyX cloud validates their identity natively against the organisation’s existing Identity Provider (IdP) and enforces granular, context-aware authorisation policies. Once authorised, the AnyX platform brokers a protocol-specific Layer 7 stream directly from the user’s browser or native client to the local connector. The remote user never touches the network, and the application remains entirely invisible to the public internet. ## The Burden of Credential Vaulting and Account Proliferation The primary source of operational friction and security risk in traditional PAM systems is the reliance on credential vaulting. Because PAM is designed to manage high-privilege administrative accounts, it requires that every target resource have a corresponding account in the PAM vault. In a large enterprise or utility, this means maintaining thousands of credentials across hundreds of servers, databases, and network devices. The administrative overhead of configuring password rotation policies, managing vault synchronisation failures, and troubleshooting credential mismatch errors is a constant drain on IT resources. This problem is severely compounded when dealing with external vendors, contractors, and third-party technicians. Under the traditional PAM model, to grant a vendor remote access to a system, administrators must first create a shadow user account in their own corporate directory (such as Active Directory) or provision a local account on each target machine. This leads to a massive “account proliferation” problem, where organisations are managing hundreds of stale, inactive vendor accounts. These shadow accounts represent a significant attack surface; they are frequently excluded from standard corporate multi-factor authentication policies, utilise weak or shared passwords, and are rarely de-provisioned in a timely manner when the contractor finishes their work. Furthermore, issuing Active Directory accounts to non-employees requires purchasing expensive client access licences (CALs), resulting in significant unnecessary software costs. Agilicus AnyX completely eliminates the need for credential vaulting, password rotation, and shadow account creation by implementing **Frictionless Identity Federation**. Instead of creating new accounts for external vendors, Agilicus allows organisations to leverage **federated single sign-on**. When a third-party technician needs access, Agilicus federates their identity natively with their _own_ corporate identity provider( such as Entra ID, Okta, or Google Workspace). The organisation does not provision any new user accounts, usernames, or passwords in their own Active Directory. Instead, they simply define an authorisation policy in Agilicus AnyX that maps the vendor’s external identity group to the specific internal resource they need to access. When the vendor logs in, they are redirected to their own company’s identity provider, where they must authenticate using their existing credentials and multi-factor authentication. Once authenticated, their identity is securely verified by Agilicus AnyX via OpenID Connect (OIDC) or SAML, and they are granted clientless access strictly to the authorised resource. If the vendor is terminated by their parent company, their account is instantly deactivated in their home directory, automatically revoking their access across all Agilicus-protected systems. This eliminates the risk of stale accounts, removes the administrative burden of credential management, and provides perfect individual accountability without creating a single new credential or shadow account. ## Securing the Cyber-Physical Frontier: SCADA, PLCs, and Rockwell Studio 5000 While traditional PAM systems are highly functional in standard IT environments where remote access is limited to standard RDP and SSH sessions, they struggle immensely when applied to the operational technology (OT) and SCADA environments found in critical infrastructure. Operational networks do not run on standard IT operating systems; they consist of Programmable Logic Controllers (PLCs), Human-Machine Interfaces( HMIs), and SCADA gateways manufactured by industrial giants like Rockwell Automation, Schneider Electric, Siemens, and Schweitzer Engineering Laboratories (SEL). These devices communicate using specialised, low-level, proprietary industrial protocols( such as Common Industrial Protocol – CIP, EtherNet/IP, Modbus/TCP, and S7-Comm) that were designed decades ago without any concept of authentication, encryption, or security handshakes. In a standard industrial system, these legacy protocols carry massive cyber-physical risk. Modbus/TCP, for example, has absolutely zero built-in authentication or cryptographic security. Any device on the same subnet can send a Modbus packet containing a “write holding register” command to change critical process setpoints or issue a “stop” command to halt a turbine. The Common Industrial Protocol (CIP) used natively by Rockwell Automation platforms exhibits similar vulnerabilities. Because these protocols operate at the application layer without transport-layer security or user-level authorisation, network-layer protection is the only barrier. If an attacker traverses a Layer 3 VPN or gains a foothold on an intermediate jump host, they can execute raw CIP or Modbus commands to physically damage operational equipment. Traditional PAM systems (such as CyberArk or BeyondTrust) cannot natively interpret or proxy these specialised industrial protocols. To allow an external engineering contractor to configure a Rockwell ControlLogix PLC remotely, a legacy PAM system cannot simply proxy the EtherNet/IP connection. Instead, the PAM system is forced to rely on a highly complex and inefficient “jump host” or virtual machine architecture. The organisation must deploy a Windows virtual machine sitting inside the OT network, install the vendor’s proprietary engineering software (such as **Rockwell Studio 5000**) on that VM, and grant the remote contractor RDP access to the jump host. The contractor must log into the PAM portal, launch an RDP session to the jump host, wait for the remote desktop to render, open Studio 5000 on the remote VM, and then initiate the PLC configuration over the local OT network. This jump host model introduces massive operational and financial pain points: 1. High Latency and Desktop Lag: The engineer is forced to interact with highly sensitive programming software over an RDP-in-browser session. Even a minor network lag can result in misclicks, which are extremely dangerous when modifying active control programs in a water treatment or power plant. 2. Software Maintenance and Licensing: The utility must purchase extra Windows Server and remote desktop client licences, as well as expensive licences for Studio 5000 and other engineering tools to sit on the jump host. These software licences must be maintained, patched, and updated by the IT team, which is highly inefficient. 3. The Pivot Point Target: Because the jump host VM has Studio 5000 installed and resides directly on the local OT network, it represents an extremely valuable target for attackers. If a hacker compromises the jump host, they gain direct, unrestricted physical network access to every PLC, HMI, and actuator on that subnet, rendering all other firewalls useless. Agilicus AnyX completely solves the “Legacy Gap” in OT environments by implementing a specialised **Universal Protocol** or **local protocol interceptor** engine. Instead of forcing the technician to log into a remote Windows VM jump host, Agilicus allows the engineer to run [Rockwell Studio 5000](https://www.agilicus.com/anyx-guide/sample-rockwell-studio-5000/) natively **on their own local workstation**. The lightweight Agilicus local proxy agent intercepts the engineering traffic (such as EtherNet/IP on CIP port 44818) directed to the PLC’s target IP on local loopback. It validates the user’s federated identity against the corporate identity provider using single sign-on and multi- factor authentication. Once authorised at Layer 7, the local proxy encapsulates only that specific protocol-level socket connection into an encrypted, secure stream and tunnels it to the local AnyX connector sitting inside the OT network. The connector then performs a local socket connection directly to the physical PLC. This revolutionary approach delivers immense benefits for OT environments: * Zero Desktop Lag: Engineers get to utilise their own high-performance local workstations and native tools. There is no remote desktop lag, drastically reducing the risk of operational errors. * No Jump Host VMs: Organisations completely eliminate the need to purchase, maintain, host, patch, or licence Windows jump hosts, saving thousands of dollars in operational and licensing overhead. * Micro-Segmentation down to the Backplane: Unlike a jump host or a VPN network tunnel that exposes the entire subnet, Agilicus AnyX restricts the engineer’s session strictly to the authorised PLC on port 44818. They have absolutely no network visibility to scan the network, access neighboring PLCs, or pivot laterally. [Perfect ISA/IEC 62443 zones and conduits are achieved](https://www.agilicus.com/white-papers/zero-trust-microsegmentation/) purely through software without complex firewall configurations. ## Deployment, Maintenance, and Firewall Topology The operational and financial differences between a traditional PAM suite and an Identity-Aware Proxy become starkly apparent when analyzing their deployment topologies and infrastructure footprints. Installing a legacy PAM solution is a major, multi- month system-integration project. To support a solution like CyberArk or BeyondTrust, organisations must provision a substantial on-premise or cloud-hosted server footprint. This typically includes multiple Microsoft SQL Server databases for credential and session logging, Password Vault Web Access servers for the user portal, Privileged Session Manager servers to proxy RDP and SSH traffic, and HTML5 Gateway clusters to translate those protocols into the browser. Maintaining, backing up, patching, and securing this massive enterprise software stack is an ongoing operational burden that requires highly specialised, expensive administrative teams. Furthermore, legacy PAM architectures require opening inbound ports on the corporate firewall. For users to connect clientlessly, the HTML5 Gateway and web portals must be exposed to the public internet, creating an immediate target for scanning, brute- forcing, and zero-day exploits. In OT SCADA networks, this is a significant non- compliance risk; NERC CIP and NIS2 strictly regulate or forbid opening inbound firewall ports to OT environments, forcing organisations to build complex, multi-tiered DMZ architectures to isolate the PAM components. This adds layers of firewall rules, routing tables, and network translation layers, rendering the entire network highly complex and fragile. In addition, traditional systems struggle with complex networking topologies. In municipal and utility networks, it is common to have overlapping IP addresses across different physical facilities or substations. A PAM system trying to route sessions over a Layer 3 network tunnel faces significant routing conflicts when trying to address the same IP address (e.g., 192.168.1.10) in substation A and substation B. To solve this, network administrators must deploy complex NAT rules, double-NAT layers, or implement split-horizon DNS servers where internal DNS records do not match external records. This “split-horizon” configuration creates a highly complex maintenance landscape where resolving internal web hosts on SCADA networks requires local overrides, host file modifications, and custom routing configurations. The Agilicus AnyX platform completely eliminates this infrastructure footprint and firewall exposure by utilising a cloud-brokered, software-defined perimeter model. AnyX is a fully managed, cloud-native platform; organisations do not need to deploy, maintain, or licence databases, web servers, or session gateways. The entire enterprise management console, user directory federation, and logging engines are hosted and maintained in the cloud by Agilicus. The only component installed on the organisation’s network is the **Agilicus AnyX Connector**, a lightweight, containerised software agent that can run on any standard Linux or Windows machine, virtual machine, or even directly on an industrial gateway router (such as those from Siemens or Cisco). Most importantly, the AnyX Connector operates strictly via **outbound-only connections**. It initiates a secure, encrypted connection to the Agilicus cloud broker over outbound port 443. It **never** requires opening any inbound firewall ports, and the protected PLCs, HMIs, and SCADA systems do not need public IP addresses. This means that the internal operational technology network remains completely dark and invisible to public search engines like Shodan. Outbound-only connectivity allows AnyX to deploy effortlessly in highly constrained network environments, including behind cellular backdoors, satellite links (such as Starlink), or carrier-grade NAT (CGNAT) without complex routing or DNS configurations. A complete zero-trust, identity-aware remote access deployment can be accomplished in minutes purely through software, delivering immense cost savings and superior security. ## The Cryptographic Evidence Engine: Verifiable Compliance (NERC CIP and NIS2) In the high-stakes world of critical infrastructure protection, security that cannot be proven is security that does not exist. Compliance is the act of providing evidence to auditors and regulators. Traditional remote access tools like VPNs and legacy PAM systems fail the audit because they are network-centric and identity-blind. A VPN log shows network telemetry such as “IP 10.0.0.5 established tunnel at 10: 00 AM.” A traditional PAM log shows that an administrative user account (such as“ vendor_admin”) checked out a credential from the vault. In neither case can the organisation prove **who** (by physical human identity) was actually behind the keyboard, or what specific protocol-level actions they executed. The Agilicus AnyX platform solves this accountability crisis by introducing a centralised, cryptographic **Evidence Engine** that translates technical session data into human- readable compliance logs. Because AnyX enforces identity federation on every session, every remote access event is tied to a specific, verified physical human identity from the home directory. The Evidence Engine records complete, immutable audit logs containing: * Human-Identity Level Verification: The user’s full name, email, and corporate ID are permanently tied to the session log, eliminating the ambiguity of shared administrative accounts. * Granular Contextual Metadata: Every log contains the precise timestamp, session duration, source IP, geographic location, and device security posture. * Protocol-Level Action Records: For web, RDP, VNC, and SSH sessions, Agilicus logs the exact files accessed, URLs requested, or commands executed, providing a complete cryptographic chain of custody. For enterprise-scale utilities, Agilicus AnyX integrates natively with security information and event management (SIEM) platforms, such as **[Microsoft Sentinel](https://www.agilicus.com/anyx-guide/send-events-to-microsoft-sentinel/)**. Through automated, secure webhooks, AnyX streams real-time access logs directly into the corporate SIEM. This allows compliance officers to build automated, audit- ready dashboards that show every third-party session, authorised change, and access request across the entire OT and SCADA network. When an auditor demands proof of compliance with NERC CIP-003-9 or NIS2 supply chain controls, the organisation can generate a complete cryptographic report in seconds, proving that they have implemented proportionate, architecturally enforced, and fully audited zero-trust controls. For organisations utilising graphical remote control in SCADA networks, our dedicated white paper outlines the specifics of [enabling NIS2 compliance for VNC remote access](https://www.agilicus.com/white-papers/enabling-nis2-compliance-for-vnc-remote-access/). ## Total Cost of Ownership Analysis: Commercial and Operational Comparison To fully appreciate why modern security leaders are shifting from legacy PAM to Agilicus AnyX, it is necessary to examine the commercial and financial realities of both architectures. Implementing a traditional PAM solution (such as CyberArk or BeyondTrust) is not just a software purchase; it represents a major, recurring capital and operational expense. The total cost of ownership (TCO) of legacy PAM is driven by several hidden factors: 1. Active Directory Client Access Licences (CALs): Because PAM forces organisations to provision AD accounts or domain accounts for external contractors, utilities must purchase a client access licence for every external vendor. For organisations with hundreds of third-party integrators, this represents a massive, recurring, and entirely unnecessary software cost. 2. Windows Server and Remote Desktop Service (RDS) CALs: To run engineering software( such as Rockwell Studio 5000) on Windows-based jump host VMs, organisations must purchase a Windows Server licence and an RDS CAL for every concurrent remote user. These licences are highly expensive and must be renewed annually. 3. Infrastructure Hosting Costs: Running a multi-server PAM stack (including SQL Server, PVWA, PSM, HTML5 Gateways, and Jump Hosts) requires substantial hardware resources. Whether hosted on-premise or in the public cloud, the CPU, memory, and storage costs of running these servers 24/7 represents a major, recurring operational expense. 4. Administrative Overhead (FTEs): Due to the sheer complexity of legacy PAM architectures, organisations typically require 2 to 3 full-time equivalents (FTEs) purely to manage the PAM software stack, troubleshoot credential rotation failures, configure jump host software, and provide/de-provision vendor accounts. By implementing Agilicus AnyX, critical infrastructure operators can realise immediate, massive financial savings. Because AnyX relies on **Federated Single Sign-On**, there is no need to provision user accounts in the corporate Active Directory. This completely eliminates the need for AD CALs and removes the administrative burden of user provisioning. Furthermore, because AnyX allows engineers to run their native software natively on local machines, organisations **completely eliminate** Windows Server jump hosts and RDS CALs, saving thousands of dollars in software licensing. Finally, because AnyX is a fully managed, cloud-native SaaS platform, there is zero hosting infrastructure to manage, and the entire platform can be managed by a single IT generalist, drastically reducing administrative overhead and delivering a far superior return on investment (ROI). ## Conclusion: Shifting the Burden of Security from Administrators to Architecture The debate between legacy Privileged Access Management and a modern, Layer 7 Identity- Aware Proxy is a debate between administrative complexity and architectural security. Traditional PAM systems try to secure an outdated perimeter model by wrapping it in layers of heavy, expensive enterprise software. This results in severe operational friction, massive credential vaults, shadow account proliferation, and vulnerable jump host virtual machines that are highly frustrating for OT engineers and third- party vendors. The Agilicus AnyX platform represents a paradigm shift that solves this complexity. By utilising an identity-governed Layer 7 proxy and outbound-only connectors, AnyX delivers a truly frictionless, clientless Zero Trust Network Access platform. It federates identity natively, eliminating shadow vendor accounts, Active Directory licence overhead, and credential vaults. In OT SCADA networks, it allows engineers to use their native tools on local machines with zero lag, removing jump hosts while restricting access down to the specific PLC and port. For critical infrastructure operators, the path to security, compliance, and reduced liability is no longer through a network tunnel or a credential vault, but through the elegant, verifiable simplicity of Agilicus AnyX. BOOK A MEETING Ready To Learn More? Agilicus AnyX Zero Trust enables any user, on any device, secure connectivity to any resource they need—without a client or VPN. Whether that resource is a web application, a programmable logic controller, or a building management system, Agilicus can secure it with multi-factor authentication while keeping the user experience simple with single sign-on. [BOOK A MEETING](https://www.agilicus.com/book-calendar-meeting/) ![Agilicus AnyX platform logo, horizontal orientation.](https://www.agilicus.com/ www/9f758437-agilicus-logo-horizonta.svg) info@agilicus.com, +1 ‪519 953-4332‬ 300-87 King St W, Kitchener, ON, Canada. N2G 1A7 [⌊partner⌉⌊partner⌉[