Read time: 8 minutes
Xage Security has been named in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management (PAM). This marks our first appearance in the report. This year, Gartner evaluated 15 vendors, and Xage Security is one of five vendors added to the 2026 Magic Quadrant. We are pleased to be among them.
For almost 10 years, Xage has protected access to the nation’s most important infrastructure, and now extends the same platform to the commercial IT sector. Gartner estimates that “PAM market revenue for 2026 will amount to $4.2 billion, representing a growth rate of 16% over 2025.” We believe the changes underway in this market fit the way Xage was designed.
What you’ll learn
- Why AI agents and machine identities are now part of privileged access management
- How insurers and regulators are raising expectations for privileged access
- Why centralized PAM struggles in OT and other distributed environments
- How the Xage Fabric keeps privileged access working at remote and disconnected sites
How is the PAM market changing in 2026?
Three shifts stand out to us. PAM now has to cover AI agents and machine identities, standing privileges are giving way to just-in-time access, and insurers and regulators expect continuous control. Each shift favors privileged access that is enforced close to the systems it protects, instead of through one central vault.
AI agents and machine identities are now part of PAM
PAM now has to cover AI agents and other workloads as well as human administrators. AI agents act autonomously and often hold elevated privileges, which raises the risk of unauthorized access to sensitive operations and data. According to Gartner, “Privileged Access Management (PAM) solutions represent a strong control for mitigating these risks, particularly for AI agents.”
In our view, PAM built around a central vault and session recording was designed for human administrators, and it struggles as the number of autonomous agents grows. We expect just-in-time access, granted per task and checked against policy at the moment of use, to replace standing credentials for these identities.
Standing privileges are being replaced by just-in-time access
We see organizations moving from static, vaulted credentials to just-in-time (JIT) access. Customers tell us that vault-centric designs cause problems like these:
- Inventories of credentials and service accounts are never complete, because scheduled discovery scans miss cloud workloads and machine identities that change between scans.
- Engineers are pushed out of their own command-line tools and into web portals and jump boxes, and some work around the controls to get their jobs done.
- Deployments are slow and hard to run, so many PAM programs for human users never mature.
Insurers and regulators now require continuous control
Cyber insurers are applying more pressure. According to Gartner, “In the past year, underwriters tightened their criteria, scrutinizing whether organizations have actively eliminated standing privileges, implemented continuous session recording, and enforced time-bound, JIT access as strict conditions for policy renewal or premium discounts.” For many organizations, that makes PAM a board-level decision.
Regulation is moving in the same direction. In Europe, the Digital Operational Resilience Act (DORA) and the NIS2 Directive call for continuous control rather than after-the-fact audits, and NIS2 places security obligations on critical infrastructure operators that extend to remote and third-party vendor access. We also see more buyers asking for audit evidence on demand and for credentials and session records to stay within their own jurisdiction.
Our focus on critical operations and cyber-physical systems
Xage is built for critical infrastructure and other distributed operations, including operational technology (OT) and cyber-physical systems, where a central PAM vault is hardest to deploy and run. Our customers in energy, utilities, manufacturing, and defense need privileged access that keeps working even when a site loses its network connection.
According to Gartner, “An emerging need from a vertical standpoint is for specific features for organizations using the Internet of Things (IoT) and cyber-physical systems (CPS)”. For critical infrastructure operators, third-party remote access requirements, insurance underwriting criteria, and NIS2 apply to OT environments as well. In our view, centralized PAM was not designed for those environments.
We back our focus on critical operations with dedicated support. Every Xage subscription includes a dedicated technical representative at no extra cost, and production tenants receive 24/7 coverage for Severity 1 issues, with a one-hour initial response target and direct escalation to L3/L4 engineering.
How does the Xage Fabric keep access running?
The Xage Fabric distributes identity, credential, and policy enforcement across a mesh of nodes instead of routing every session through a central vault. If one node or a site’s network link goes down, the other nodes keep enforcing policy locally, so privileged access keeps working at remote, disconnected, and air-gapped sites.
Legacy PAM uses a central vault and jump servers, and all privileged sessions go through them, so if there is an outage or the network link at a remote site is lost, access is blocked.
This design gives you:
- No single point of failure; other nodes continue to enforce policy if one node is unavailable.
- Access control operates locally at each site, so it continues to function even if the site is remote, disconnected, or air-gapped.
Which Xage products secure privileged access?
Xage secures privileged access with three products, all built on the Xage Fabric: XPAM for human, machine, and AI identities; Secure Remote Access (SRA) for VPN-less access by employees and vendors; and Xage Asset Protection for identity-based microsegmentation.
- Extended Privileged Access Management (XPAM): An agentless PAM solution that covers human, machine, and AI identities throughout IT, OT, the cloud, and the edge, all from a single platform. It continuously discovers privileged accounts, including service accounts, workloads, and machine identities that run outside normal provisioning and access reviews, and applies the same vaulting, rotation, and access controls as human users. For AI agents, XPAM issues short-lived credentials for each session that expire when the task is complete, so agents never see their credentials or reach resources directly, and every agent action is governed by policy and captured in a full audit trail. It provides just-in-time, just-enough access; prevents permanent privileges; includes distributed credential vaulting with automatic password rotation; and monitors and records privileged sessions. The system runs on existing infrastructure and can be deployed in as little as one day, without agents, network changes, or replacing current systems.
- Secure Remote Access (SRA): Gives employees and third-party vendors remote access without a VPN or client software. Its multi-hop design terminates every session at each network boundary, creating a virtual air gap aligned with the Purdue Model: no connection reaches an OT asset directly, and no inbound firewall ports open. You can require MFA, just-in-time approval, and over-the-shoulder monitoring for each site, session, and asset. Xage Security was named a Representative Vendor in the 2026 Gartner® Market Guide for CPS Secure Remote Access.
- Xage Asset Protection: Features identity-based microsegmentation that prevents discovery and scanning of important, outdated, and unpatchable assets. It permits only explicitly approved identities, actions, and paths, preventing lateral movement and limiting the number of assets an attacker can access, all without a network redesign. The solution applies to OT, data center, cloud, and AI infrastructure.
What does this mean for your organization?
Xage’s expertise suits your organization if it runs critical operations where downtime is not an option, manages sites across a wide area, or cannot guarantee network connectivity. Our customers in the energy, utilities, manufacturing, and defense sectors already rely on this, and we are pleased to make the platform available to a broader audience in the PAM market.
Our key takeaways
- Xage Security has been named in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management, its first appearance in the report.
- PAM now has to secure AI agents and machine identities as well as human administrators.
- We expect just-in-time access to replace standing privileges, with insurers and regulators adding pressure for the change.
- Centralized, vault-based PAM is hard to run in OT and other environments where network connectivity is not guaranteed.
- The Xage Fabric enforces identity, credentials, and policy locally at each site, so privileged access keeps working during outages.
If you run critical operations across many sites, you need privileged access that keeps working when the network does not. That is the problem Xage was built to solve, and the reason we are now bringing the same platform to the wider PAM market.
Frequently asked questions
What is privileged access management (PAM)?
Privileged access management (PAM) is the set of tools and controls that protect accounts with elevated access, such as administrator, service, and machine accounts. PAM decides who can use those accounts, for how long, and for which tasks, and it records what happens during each privileged session. Today it covers AI agents as well as people.
How does just-in-time access reduce risk?
Just-in-time (JIT) access grants privileges only when a user, workload, or AI agent needs them for a specific task, then removes them when the task ends. Because no account holds standing privileges, an attacker who steals a credential has far less to work with, and every grant is tied to an approval and an audit record.
How do I secure privileged access at remote or disconnected OT sites?
Use PAM that enforces policy locally at each site instead of depending on a central vault and jump server. With the Xage Fabric, identity, credentials, and policy are distributed across nodes, so access control keeps working if a site loses its network link, and remote sessions terminate at each network boundary instead of reaching OT assets directly.
How do I manage privileged access for AI agents?
Treat each AI agent as a privileged identity. Give it short-lived credentials scoped to a single task, keep those credentials out of the agent’s reach, check every action against policy, and log it. XPAM issues per-session credentials that expire when the task is complete and records each agent action in a full audit trail.
About the author
Roman Arutyunov is the Co-Founder and Chief Product Officer at Xage Security. Roman leads the product vision and go-to-market with experience in security, networking, and industrial applications. Prior to Xage, led Product and Engineering at ABB, Tropos Networks, and Blue Coat Systems solving security, networking and data analytics challenges for industrial and commercial enterprises enabling millions of IoT devices in production today. Earlier in his career, Roman worked on the first generation of Content Distribution Networks (CDN) and Proxy Servers at Blue Coat Systems (Symantec). Roman holds a Bachelor’s in Applied Mathematics with an emphasis in Computer Science from the University of California, Berkeley and an MBA from Columbia University.
Gartner, Magic Quadrant for Privileged Access Management, Paul Mezzera, Shubham Gera, Tarun Rohilla, Scott Brinker, 21 October 2026.
Gartner, Market Guide for CPS Secure Remote Access, Katell Thielemann, Wam Voster, Sumit Rajput, 3 February 2026.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
Gartner and Magic Quadrant are trademarks of Gartner, Inc. and/or its affiliates.
