A Privileged Access Workstation, or PAW, is a hardened computer reserved for sensitive administrative tasks such as managing Active Directory, servers, or cloud control planes. It is separated from everyday work like email, web browsing, document editing, and chat, which are common entry points for malware and phishing.
PAWs matter because privileged credentials are high-value targets. If an attacker compromises a normal laptop, they may capture admin passwords, tokens, or session cookies and then move into Tier 0 systems. A PAW reduces that risk by limiting software, restricting internet exposure, enforcing strong authentication, and isolating admin activity from lower-trust tasks. In real defenses, organizations pair PAWs with tiered administration and minimal standing privilege so that only trusted devices can reach critical management interfaces.