Brokered access. MFA at every session. Full replay.
SSH, RDP, database protocol proxy, Kubernetes API guard — every privileged session goes through a Tessarac broker that issues short-lived credentials, challenges MFA at session start, and records the full session for replay. Just-in-time approvals route to Slack, Teams, or PagerDuty.
What gets brokered
Every protocol your operators actually use.
The PAM industry has decades of products that broker SSH well and everything else badly. Tessarac brokers SSH, RDP, every database protocol your team touches, and the Kubernetes API — same identity, same session model, same recording, same audit.
- SSH session brokering on Linux — short-lived OpenSSH certificates signed by the internal CA, MFA challenge at session start
- RDP session brokering on Windows — managed by the rdp-proxy service, full screen-recording and replay
- Database protocol proxy for every major relational, document, and key-value database protocol — query-level audit, not just connection-level
- Kubernetes API guard — every kubectl call passes through Tessarac with the user's identity stamped in the audit log
- Session recording and replay for every protocol above — tap the timeline scrubber, watch what happened
The just-in-time approval surface
Standing privilege is the source of most breaches. Tessarac PAM defaults to zero standing privilege — every escalation needs a fresh approval, every approval lives in the audit log.
Slack / Teams / PagerDuty approvals
Operator requests access; approver gets a Slack DM (or Teams card, or PagerDuty page) with the request, the reason, and one-click approve/deny. SLA is bounded by your own response time, not Tessarac's.
Time-bound elevation
Elevations are bounded — one hour, four hours, eight hours, configurable. The credential expires automatically; the session terminates if it's still active when the window closes.
Full session replay
Every keystroke, every screen update, every database query — captured at the broker. Scrub the timeline, jump to the specific command, export the segment. Useful for postmortem; useful for compliance.
Hardware-bound operator identity
The operator is identified by the hardware-bound key on their workstation (Sentinel agent, FIDO2 hardware key, or smart card on the Federal plan). No long-lived passwords, no SSH keys-on-disk to steal.
Why this is different
The audit isn't a separate product.
In the legacy PAM world, the broker is one product, the recording is another product, the analytics is a third product, and stitching them together is a six-month integration project. In Tessarac, the broker IS the audit IS the analytics. Every session you broker is searchable, replayable, and exportable through the same surface.
- Replaces CyberArk, BeyondTrust, Teleport — same brokering primitives at a fraction of the operational footprint
- Customer-visible per-tenant PAM audit — your customers see who accessed their data and when
- Audit export to your own object-storage bucket / syslog endpoint / Linux host — opt out of Tessarac retention if you want to
- Federal plan: smart-card sign-in for every operator session; STIG-hardened broker images
Stop standing privilege from being your weakest link
Brokered access for every protocol, MFA at every session, full replay for every action. One audit log, one cost line.