ARCON’s partnership with DNV Cyber to strengthen privileged access management capabilities in the Nordics reflects an important reality for regional security programmes: PAM is no longer only about protecting a small set of data-centre administrator accounts. It is becoming a services, compliance, and operational discipline that must work across distributed infrastructure, suppliers, and regulated environments.
The problem many organisations face is uneven privilege control. Critical systems may be governed by a PAM platform, while contractors, remote engineers, operational technology, and third-party support retain direct or persistent access. Those gaps are especially difficult to manage across multiple countries and regulatory regimes, where evidence requirements, data residency expectations, and local delivery capabilities can vary.
A partner model can help close that gap when it combines product capability with implementation expertise. A PAM deployment needs more than a password vault: it requires discovery of privileged accounts, ownership mapping, access policy design, onboarding of infrastructure, and a process for removing obsolete privilege. Regional expertise also helps align privileged account security with local assurance requirements and the operating practices of the organisations being protected.
Remote access and session management are central to the value. Third-party users should receive time-limited access to an approved target, with credentials hidden from the operator and activity recorded for review. Commands, file transfers, and session duration can be constrained according to risk. If a supplier relationship ends or a project changes scope, the access path can be disabled centrally rather than relying on manual account cleanup.
The Nordic market also illustrates why PAM must cover hybrid environments. Cloud consoles, on-premises systems, network devices, industrial platforms, and SaaS administration all create different privilege paths. A fragmented control model leaves security teams with inconsistent logging and access reviews. An integrated PAM programme provides a common policy language while still allowing controls to reflect the sensitivity and technical realities of each environment.
For CISOs, the partnership is a reminder to measure PAM by privilege outcomes, not deployment counts. The meaningful questions are whether standing access is shrinking, third-party sessions are attributable, high-risk actions receive appropriate approval, and every privileged account has an owner and an expiry path.
Source: Industrial Cyber