Privileged User Management isn’t part of the Enterprise Password Vault.

Understanding the four players in CyberArk’s Enterprise Password Vault

If you’re digging into privileged access management, you’ve probably bumped into CyberArk’s Enterprise Password Vault (EPV). It’s the backbone that keeps high-risk credentials—like administrator passwords and service account keys—from wandering into the wrong hands. Think of EPV as a high-security safe with smart controls, not a shoebox full of passwords. In real-world terms, you want the right pieces talking to each other, with clear roles and strong oversight. Let me break down the core components and show you where the line is drawn.

Meet the three core movers you’ll actually use day to day

First, a quick map of the main parts you’ll deal with in the vault itself. Each has a job, a home, and a style of operation that fits together like a small security ecosystem.

• Password Vault Web Access (PVWA)

This is the web-based doorway. PVWA lets approved users reach the vault, retrieve credentials when they’re needed, or push a password change if a policy says so. It’s the user-facing side, the one you click through when you need something in a hurry while keeping strong control over who can see what. In practice, PVWA is the everyday interface that ties people to the stored secrets.

• Central Policy Manager (CPM)

If PVWA is the doorway, CPM is the policy brain behind the scenes. It enforces rotation schedules, password complexity rules, and other security policies. CPM makes sure that passwords aren’t wandering aimlessly and that rotations happen on time, without human guesswork creeping in. It’s a quiet supervisor that keeps the rhythm of security aligned with the rules your organization has adopted.

• Privileged Session Management (PSM)

PSM brings eyes and control to active sessions. When someone with elevated access signs in, PSM can monitor, record, and even intervene if something looks off. It’s like having a security guard in the room who can watch every move, with the ability to pause or terminate a session if needed. Real-time oversight is the name of the game here.

Where Privileged User Management fits in (and where it doesn’t)

Now, you might have seen Privileged User Management (PUM) listed somewhere. Here’s the distinction that matters in practice: PUM isn’t part of the Enterprise Password Vault’s core trio. PUM focuses on the lifecycle and privileges of users themselves—who they are, what roles they hold, and what access levels they should have. It’s a crucial piece of the broader identity and access landscape, but it operates somewhat independently from EPV’s password storage and rotation machinery.

So, if you’re asked, “Which component is NOT part of the Enterprise Password Vault?” the answer is Privileged User Management (PUM).

Why this separation matters in real environments

Understanding where PUM fits and where EPV concentrates helps you design a cleaner, safer security architecture. Here’s the practical takeaway:

• EPV’s strength is in password storage, rotation, and controlled retrieval. PVWA, CPM, and PSM are the trio that makes this mission possible—secure access to credentials, enforced policies, and guarded sessions.

• PUM complements EPV by handling user identities and their broader privileges. It’s about governance of people, not just passwords. When you map out access across systems, you’ll often find PUM and EPV working alongside an identity provider, not replacing it.

Let’s ground this with a simple analogy

Picture a high-security museum:

• PVWA is the front desk where staff requests keys to exhibit rooms.

• CPM is the curator who sets rules on when keys can be used and how often they’re rotated or updated.

• PSM is the security team that watches live video feeds while a key is being used, ready to step in if something looks off.

• PUM is the HR team that manages who is allowed to be in the building at all, handling roles, promotions, and terminations.

All parts matter, but they don’t all do the same job in the same system. That differentiation is what keeps the security model clean and scalable.

Common questions you might encounter while learning this material

• What exactly does PVWA do for everyday users?

PVWA provides a secure, auditable way to access stored credentials. It’s where you sign in, select a vault entry, and either retrieve a password or trigger a change, all while the action gets logged for compliance.

• How does CPM enforce security policies without slowing things down?

CPM runs the defined rotation schedules, ensures password strength requirements are met, and applies policy changes automatically. It’s designed to work in the background so legitimate operations aren’t blocked by policy errands.

• Why is PSM important during privileged sessions?

Privileged sessions are high-risk moments. PSM adds monitoring, records actions, and can enforce session boundaries. If a session behaves oddly, it can terminate access or escalate the alert.

• Can an organization operate without PUM?

You can, but it makes governance harder. PUM gives you a formal structure for who can access what and when, which reduces the risk of orphaned accounts or excessive privileges.

Putting it into a practical study frame (without turning this into a cram session)

If you’re absorbing these ideas for a broader security understanding, let curiosity lead the way:

• Map each component to a real-world task: retrieval, policy enforcement, and session oversight.

• Consider how a change in one component affects the rest. For instance, what happens if a policy is updated? How does CPM propagate that change to PVWA operations?

• Think about the human role. PVWA is user-facing, PSM is auditor-facing, CPM is policy-facing, and PUM is governance-facing. Each perspective adds a layer of control.

A quick recap you can bookmark

• EPV is built from core parts that handle credentials, policies, and live sessions.

• PVWA, CPM, and PSM are the vault’s primary workhorses.

• PUM sits outside the vault’s core storage and rotation workflow, focusing on user identities and privileges.

• Knowing which component does what helps you design safer systems and communicate clearly with teammates.

Final thoughts: why this clarity matters

Security isn’t a single switch you flip. It’s a layered approach where each piece has a defined job, a clear boundary, and a traceable history. When you can articulate what belongs to the Enterprise Password Vault and what sits beside it, you’re better equipped to craft architectures that resist both casual missteps and focused attacks.

If you’re curious to explore further, you might look at how PVWA interacts with other CyberArk modules in more complex environments—how dashboards present risk indicators, how automated workflows reduce manual errors, or how auditing reports help with compliance narratives. It’s a rich field, and the more you understand each component’s role, the more you’ll see the beauty in the system’s design.

In the end, the one not fitting into the vault’s core trio—the Privileged User Management—serves a different but equally vital purpose in the grand scheme of identity and access protection. And that distinction is exactly what helps security teams keep things humming smoothly, without overcomplicating the protection layer.