Home Products Protect GLIMPS Malware for PAM

GLIMPS Malware for PAM

Analyze every file transferred during privileged SSH and RDP sessions before it reaches your critical systems.

Request a demo

Secure file transfers in privileged access sessions

Transparent transfer inspection

Every file transferred via SSH (SCP/SFTP) or RDP during a privileged session is automatically intercepted and analyzed by more than 25 detection engines, including around ten AI-based engines.

Compatible with leading PAM bastions

GLIMPS integrates through the ICAP protocol with compatible PAM solutions: WALLIX Bastion (CSPN-certified by ANSSI), BeyondTrust Privileged Remote Access, and any bastion that supports ICAP. No additional infrastructure required.

Block before delivery

If a file is identified as malicious, the PAM bastion blocks the transfer before the file reaches the target system. The privileged session continues normally.

~3-second average verdict

Analysis does not slow down administrators. Processing time remains compatible with interactive SSH and RDP sessions.

How does GLIMPS protect privileged sessions?

Privileged sessions are a major risk: an administrator transferring a compromised file to a critical server can compromise the entire infrastructure. GLIMPS Malware for PAM integrates with ICAP-compatible PAM bastions to analyze every file in transit:

ICAP connector – The PAM bastion intercepts files transferred during privileged sessions (SSH via SCP/SFTP, RDP via clipboard copy/paste or drive sharing) and automatically submits them to the GLIMPS ICAP connector for analysis. Available as encrypted ICAPS hosted as SaaS by GLIMPS, or deployed on-premise via Docker. The verdict is returned to the bastion, which allows or blocks the transfer based on the defined policy. Everything works transparently, without changing administrator habits.

Preferred partnership with WALLIX Bastion – WALLIX Bastion, the only PAM solution CSPN-certified by ANSSI, is GLIMPS’ reference partner for privileged access security. The ICAP integration is native and operational within a few hours. Other ICAP-compatible bastions, such as BeyondTrust Privileged Remote Access, can also be connected.

REST API – For PAM solutions that do not support ICAP, integration is possible through the GLIMPS Malware API to submit in-transit files for analysis.

This mechanism applies to transfers in both directions: files sent to critical systems and files retrieved from those systems.

All results can be reviewed in GLIMPS Malware Expert (optional) for deep investigation, triage, and retrohunt.

I want to learn more

AI detection at the core of privileged access

Multi-engine detection

More than 25 detection engines, including around ten AI-based engines (Deep Learning, Machine Learning, LLM), complemented by antivirus engines and your own YARA rules, analyze every transferred file to identify threats before they reach critical systems.

Automatic archive extraction

Transferred archives (ZIP, RAR, 7Z…) are automatically extracted and analyzed by GLIMPS Malware. Every contained file is scanned by the detection engines.

PAM-bastion-actionable verdict

The verdict is returned via ICAP. The bastion automatically applies the defined security policy: allow the transfer, block the file, or alert the security team.

Cache and performance

Built-in caching prevents resubmission of already analyzed files. Designed for daily admin transfer volumes without impacting privileged sessions.

GLIMPS Malware for PAM: who is it for?

Context: You manage privileged access through a PAM bastion and must ensure that files transferred during SSH and RDP sessions do not compromise critical systems.

What GLIMPS delivers: Native ICAP integration with WALLIX Bastion and compatibility with other ICAP-capable bastions. Operational within a few hours. Files are analyzed transparently, without changing admin workflows or slowing sessions.

Context: Privileged sessions are a critical attack vector. A malicious file transferred by a privileged account can compromise the entire infrastructure.

What GLIMPS delivers: A sovereign AI detection layer that intercepts threats in the file flows of privileged sessions. Aligned with GDPR and NIS2. WALLIX Bastion is CSPN-certified by ANSSI. GLIMPS is used by ANSSI to protect government agents through jecliqueoupas.cyber.gouv.fr.

Context: You need to monitor privileged account activity and investigate quickly when a suspicious file transfer occurs.

What GLIMPS delivers: All analysis results are centralized in GLIMPS Malware Expert. A file blocked during an SSH or RDP transfer can be immediately investigated: malware family, IOCs, and a link to the detailed analysis.

How customers use GLIMPS Malware for PAM

Securing SSH transfers to critical servers

A system administrator transfers a patch or script to a production server through WALLIX Bastion using SCP/SFTP. The file is automatically intercepted and analyzed by GLIMPS before reaching the server. If a threat is detected, the transfer is blocked and the security team is alerted.

Controlling files copied during RDP sessions

An external provider accesses a Windows server through a PAM-controlled RDP session. When they copy a file via clipboard or drive sharing, GLIMPS analyzes the file before it reaches the server. Malicious files are blocked without interrupting the session.

Why choose GLIMPS Malware for PAM?

Proprietary AI detection

GLIMPS’ code conceptualization technology, developed within the French Ministry of the Armed Forces by GLIMPS’ founders, identifies zero-day threats and variants that traditional antivirus solutions do not detect. Detection rate above 99%.

Recognized by ANSSI

WALLIX Bastion is CSPN-certified by ANSSI. GLIMPS is used by ANSSI to protect government agents through jecliqueoupas.cyber.gouv.fr. A trusted combination to protect your most sensitive access.

Sovereignty and compliance

French vendors, hosting in France and Europe, no data leaves the platform. Aligned with GDPR, compatible with NIS2.

Used by the French Armed Forces

Used by the French Armed Forces and incubated by the French Ministry of the Armed Forces. French Tech 2030 award winner.

Frequently asked questions

Integration is done via the ICAP protocol, natively supported by WALLIX Bastion and BeyondTrust Privileged Remote Access. The GLIMPS ICAP connector is available as encrypted ICAPS hosted as SaaS by GLIMPS, or deployed on-premise via Docker. For bastions that do not support ICAP, integration is possible via the GLIMPS Malware API. You can be operational within a few hours.

GLIMPS Malware for PAM analyzes files transferred via SSH (SCP, SFTP) and via RDP (clipboard, drive sharing). The mechanism works both ways: files sent to critical systems and files retrieved from those systems.

GLIMPS analyzes all file types. Archives (ZIP, RAR, 7Z…) are automatically extracted and analyzed by GLIMPS Malware. The verdict is returned to the PAM bastion via ICAP.

Yes, GLIMPS Malware for PAM is available as SaaS (hosted in France), on-premise, and in SecNumCloud environments. The ICAP connector can be delivered as SaaS (encrypted ICAPS) or deployed locally via Docker, depending on your architecture constraints.

The PAM bastion blocks the transfer and applies the defined policy (alerting, logging, notification). The privileged session is not interrupted: only the offending file transfer is blocked. The SOC analyst can investigate the file in GLIMPS Malware Expert.