Despite the increased understanding in the importance of locking down privileged account access, the fact is that privileged access is not limited to users with a “heartbeat.” Enterprise applications, including COTS and custom-built apps often require the same access to privileged accounts as privileged users do. Understanding how breaches occur has allowed for the creation of a methodology, which focuses on reducing the most risk for the least effort first. A phased approach ensures the ability to show measurable risk reduction, and meet compliance, without impacting operational efficiency.