Idira Privileged Access Manager Reviews

We are working with CyberArk solutions such as PAM on-premises. We are working with CyberArk Privileged Access Manager, including AIM, PSM, and PSMP components. 

The ability of CyberArk Privileged Access Manager to safeguard financial service infrastructure is important; without it, banking and financial clients cannot secure their operations. Despite various attacks affecting other companies, CyberArk's implementations ensured that we remained unaffected.

CyberArk Privileged Access Manager has been helpful in managing over 125,000 privileged accounts in a single environment for our client, and we have multiple CyberArk environments for different clients with different numbers of accounts. CyberArk Privileged Access Manager is excellent at helping companies meet regulatory requirements due to its ability to cater to the specific needs of clients across different countries, ensuring compliance without data transfer issues.

CyberArk Privileged Access Manager provides security and video recording of user sessions for audit purposes. This feature is critical in financial sectors where auditing who performed specific actions is essential. Having video records adds a layer of proof and ensures compliance with audit requirements.

The key feature of CyberArk Privileged Access Manager is that it's a comprehensive package rather than just dependent on components such as Vault or Privileged Session Manager. Each component is necessary, and the Vault is the heart of CyberArk; everything connects via PSM and PSMP. I particularly appreciate PSM and PSMP because they simplify troubleshooting and charging.

A potential area for improvement is enhancing support for cluster environments and distributed Vaults. Clients in multiple countries that need central access have different challenges that require better solutions from CyberArk.

For financial services, CyberArk can improve incident response by ensuring fast support for critical priority tickets to meet compliance requirements. Providing more documentation on CyberArk is recommended for new team members to enhance their troubleshooting capabilities. I understand it's up to the client, but 99% fail to change the demo key, so it's crucial for CyberArk to emphasize changing the key and documenting it as part of the installation process.

I have been working with CyberArk Privileged Access Manager for more than nine years.

For stability, I would rate CyberArk Privileged Access Manager a nine out of ten.

I would rate the scalability of CyberArk Privileged Access Manager as a nine.

Regarding technical support from CyberArk, while L2 and L3 teams are effective, L1 support requires improvement due to longer response times in critical situations. Coordination with higher support levels sometimes takes longer than expected, which should be addressed.

Positive

After implementing CyberArk Privileged Access Manager, it typically takes about four to five months for a company to realize time to value, assuming they have a strong implementation team and infrastructure in place.

Integrating CyberArk Privileged Access Manager is very simple due to the provided connectors for Windows and UNIX, as well as plugins for databases. Custom integrations may take longer, around one month, due to development requirements.

Regarding costs, CyberArk Privileged Access Manager is not a cheap product; hence, many companies struggle with its high licensing cost. While it's valuable, it comes with a high price tag, making it hard for every company to afford it.

After comparing with other products, I find that no other product currently matches CyberArk's performance; the performance issues in alternative solutions make them less desirable. While there are competitors, I cannot definitively name one that compares with CyberArk Privileged Access Manager.

The requirements for CyberArk, particularly in India, have evolved significantly since the company acquired several businesses in 2014. Every organization needs an identity and access management (IAM) and privileged access management (PAM) solution. CyberArk stands out as the leading product in this category. While there are other protocols available in the market, CyberArk is known for its security, reliability, and user-friendly access.

In my experience working with multiple companies and clients using CyberArk, I have not encountered any cases of breaches or malicious activity associated with the platform. This track record provides a strong sense of security and assurance regarding CyberArk’s capabilities. Although the privileged access management solution can be costly, it offers extensive security features, including multi-factor authentication (MFA). Overall, CyberArk is an excellent product for organizations seeking robust security solutions.

Regarding granularity of PAM controls in CyberArk Privileged Access Manager, it means having centralized control in the Vault. Standalone CyberArk Vaults perform best compared to cluster systems, which present challenges during maintenance or network connectivity issues.

Overall, I would rate CyberArk Privileged Access Manager a nine out of ten.

My use case for CyberArk Privileged Access Manager is that I work as an administrator where I can configure and integrate all those CyberArk Privileged Access Manager components such as PSM, CPM, hardening the CPMs, checking the services of the PVWA and Vaults, and making sure everything is operational. I am responsible for creating safes and managing the accounts. I onboard the accounts on the platform based on their vendor requirement.

We also provide the SIEM integration to check the logs and we are responsible for Splunk integration too, but it is not related to CyberArk Privileged Access Manager. We actually implement all those application logs to Splunk for the dashboard monitoring and the alert-based system through ITSI.

CyberArk Privileged Access Manager has improved how my organization functions as we have 24 PSM servers, four CPM servers, one primary Vault, and one DR Vault. We are in the process of upgrading from version 11.3 to 14.6 and maybe next month, we are going to update our servers.

The best features of CyberArk Privileged Access Manager include that it is normally used for securing passwords because nowadays, most of the breaches happen due to leaking passwords. So we actually manage the passwords in a secured way. In a Vault, there is end-to-end security, with seven layers of security that we are maintaining. That is called session encryption, firewalls, authentication, authorization, and auditing. At the end of the day, we are doing the file encryption. Through this, we are actually managing the passwords in a very secure way. We can explain this architecture to the vendor to convince them to come to CyberArk Privileged Access Manager.

What I appreciate about CyberArk Privileged Access Manager is that it is not only for password security; we can also manage their applications and platforms. Each and every thing, whenever a user is coming to CyberArk Privileged Access Manager or logging in to CyberArk Privileged Access Manager, end-to-end protection will be handled by CyberArk Privileged Access Manager. Whenever they connect to their target servers, each and every thing will be monitored and reviewed by CyberArk Privileged Access Manager administrators such as us. We see whatever incidents happen and whatever is going to happen. Whatever the user does from the target system, we can monitor everything through the PSM servers. We also have PTA, Privileged Threat Analysis. Whenever a user is doing unwanted things such as running unwanted scripts in their target system, the PTA incident automatically closes their target system. For example, if a user is working beyond their scope and is running some scripts, it will show that and raise an incident. We get the tickets and we can monitor it and have a call with the user. We are giving end-to-end security from the user to the platform level.

In CyberArk Privileged Access Manager, I see room for improvement as I am working in the on-premises networks, and now we are also having the cloud-based PAM. So there, everything is maintained by the CyberArk Privileged Access Manager team, and we are only maintaining the PSM servers. So it is already upgraded from the on-premises network to the cloud network. If you ask me what we can implement beyond that, I just need a few minutes to think about what new things, because it is already an end-to-end security on-premises itself. Now, when it comes to PCloud, Privileged Cloud, it is more secure than the on-premises networks because most of the things are handled using the cloud itself. So it is an already upgraded version; we do not need to implement something new. But if you think in that way, we can have a chance to implement our things.

If anything could be improved in CyberArk Privileged Access Manager, I think we could build a small agent AI in my team, we could give access to these logs—the Vault logs, PSM logs, and CPM logs. Whenever the system is going down, the AI will automatically check. If we actually implement agent AI in CyberArk Privileged Access Manager, it will check the logs, and if any errors are coming, it automatically triggers alerts and gives the solution. That is the best improvement I can think of because these days, most things are done by agent AI. So if we also implement this agent AI in CyberArk Privileged Access Manager, we can add more features.

I have been using CyberArk Privileged Access Manager for around three years. I have exactly three years of experience with CyberArk Privileged Access Manager.

I would rate the stability of CyberArk Privileged Access Manager as an eight.

I will rate the scalability of CyberArk Privileged Access Manager as a ten, indicating it is a scalable solution.

I rate the technical support for CyberArk Privileged Access Manager as the main thing in any environment. It can be a production environment such as CyberArk Privileged Access Manager or any production environment with any project. Because of technical support, we have continuous deployment and continuous monitoring. Whenever they are doing their work best, and at that time, when something is going down, they are the first point of contact to check what the issue is. After that, it will come to the developers to check that issue. So I will rate the monitoring team, the operations team, a ten.

Positive

I have used other PAM solutions, and I find that when it comes to CyberArk Privileged Access Manager, it is a company that has a long history of trust with users and vendors, which provides a more secure way of doing things for their platforms and their work. So in my opinion, CyberArk Privileged Access Manager is the best solution we can give to vendors for PAM solutions.

The time it takes to deploy CyberArk Privileged Access Manager is actually based on the architecture of their requirement, such as the number of users, accounts, and the platforms they are onboarding into CyberArk Privileged Access Manager. If it is less than ten users and four platforms, it will take one or two days. If the communication between our servers and the platforms is already good, it will normally take one to two days. If their requirement is more, such as at the platform level where they have both Windows and Linux operating systems and database operating systems and they want to segregate multiple users based on their OS, at that time we just need some time to create the SOPs and we have to proceed based on that requirement.

My team works with CyberArk Privileged Access Manager, and we have 12 members.

My thoughts on the pricing of CyberArk Privileged Access Manager depend entirely on the vendors' requirements. If they want their things to be secure, they have to spend accordingly. We have four types of pricing. Based on their requirement, we will actually propose the pricing to the vendor. If their platforms and accounts are fewer, we can go for the minimal requirement of a PAM solution. And if they want more upgraded servers in their system, we can go for the maximum pricing.

CyberArk Privileged Access Manager solution requires maintenance, and definitely, we are actually doing rotations 24/7 to make sure every system is active 24/7 so a user will not get interrupted when accessing their platforms.

My clients use CyberArk Privileged Access Manager for around 12,000 accounts.

The vendor can contact me if they have any questions or comments about my review.

I'm interested in being a reference for CyberArk Privileged Access Manager.

I definitely recommend CyberArk Privileged Access Manager to other users because it gives more security to their platforms and users to store their passwords and provides end-to-end security. If they do not want to breach their platforms, I would recommend CyberArk Privileged Access Manager 100 to 200 percent to keep it secure. My overall rating for this product is a ten.

In the healthcare sector, my use case involves securing privileged accounts across the entire organization. Although this is not specific to any sector, I also work for banking and financial services. As a PAM solution, I secure privileged accounts while provisioning access.

With nine plus years of experience, I can develop and suggest solutions for various infrastructures, install, build, onboard, upgrade, patch, reboot, and maintain backup and restore solutions, as well as handle disaster recovery activities. I address troubleshooting of infrastructure issues and end-user requests, effectively managing onboarding and deboarding, and access provisioning for end-users. This allows me to provide end-to-end support in CyberArk Privileged Access Manager.

CyberArk Privileged Access Manager's best features include password rotation and an excellent monitoring solution, with the additional benefit of monitoring for Enterprise Password Management (EPM) where I provision privileged access.

Delving deeper into the solution reveals many valuable features, but I particularly find password rotation and monitoring capabilities highly effective for auditing purposes. These features restrict users from unauthorized communications outside of CyberArk.

CyberArk Privileged Access Manager has helped reduce privileged accounts in my healthcare organization, where I generate reports for approximately 500,000 accounts. This reporting capability allows me to analyze and restrict based on the reports tab effectively. I note that there are limitations with supporting the pass reporter feature, although I still find it valuable for generating comprehensive account and safe level reports.

CyberArk Privileged Access Manager assists in meeting compliance and regulatory requirements such as HIPAA and SOX, ensuring I adhere to necessary standards in my operations.

CyberArk Privileged Access Manager has room for improvement regarding notifications for service account password rotations. Currently, notifications are sent at the platform level rather than at the account or safe level. I suggest enabling notifications at lower levels to help users and application owners easily identify which specific accounts are due for password rotation.

This would alleviate confusion among multiple application accounts on the platform.

With CyberArk Privileged Access Manager implemented in the healthcare industry, I observe benefits in efficient password rotation for individual and generic accounts. However, there are challenges with service account password rotation. Application teams often do not adhere to standards for rotating service account passwords, fearing failure in their jobs. While the feature exists, the delay in updates can lead to reluctance among teams to use it effectively. This reveals a need for better integration at the application level for immediate password updates.

Positive

Positive

Regarding my relationship with the vendor, I am currently a customer. Previously, I was a partner while working in the banking and financial sector, but now in healthcare solutions, I associate as a customer. I reach out to the vendor whenever I encounter issues, seek information, or require assistance with upgrades. I maintain consistent communication on a weekly or biweekly basis through calls, emails, or tickets.

I rate CyberArk's technical support as an eight. The vendor provides solid support when needed.

Positive

In comparison to other PAM solutions like Delinea and BeyondTrust, I find CyberArk Privileged Access Manager continues to lead in effectiveness. With over nine years of experience, I believe CyberArk is superior in its password rotation capabilities and overall management, despite competitors having similar functionalities under different names.

I recommend CyberArk Privileged Access Manager to small and mid-level organizations needing a PAM solution. I assert that it has been a reliable tool for me for over nine years. Even a proof of concept might be beneficial initially, with an emphasis on understanding the budget aspect. I would rate this product a nine overall.

I find CyberArk to be expensive in general. Many organizations have considered alternatives due to budget constraints, even though CyberArk is a leading product in the PAM industry, recognized for its quality and long-standing presence. However, the high cost can drive some customers away.

Integrating CyberArk Privileged Access Manager with existing EHR systems and healthcare workflows, such as SailPoint, presents challenges. SailPoint integration often hinges on third-party tools, making the process complicated and critical for many organizations. I endeavor to manage this necessity.

In terms of mean time to respond, I acknowledge variable response time. The L1 team is proactive, yet the vendor often pushes to close incidents swiftly, even when issues remain unresolved. This can extend the resolution timeline significantly.

When assessing CyberArk Privileged Access Manager for protecting against ransomware attacks, I find that it effectively isolates components such as the primary vault, DR vault, PVWA, CPM, PSM, and PSMP, ensuring communication is limited to internal only. This isolation prevents any interaction with the external world, including AD, thereby safeguarding my systems. The feature of maintaining a DMZ for the vault, which ensures that attackers cannot reach it, is critical in protecting against ransomware threats targeting Active Directory.

Every infrastructure requires maintenance, including upkeep and patching. I find managing CyberArk Privileged Access Manager's infrastructure is straightforward. It can run effectively in physical or virtual environments, whether on cloud machines or VMware systems. Overall, maintenance is not overly complex.

If deploying in a lab environment, setting up the primary and DR vaults, PVWA, and CPM can usually be completed within one and a half to two hours. Organization-wide implementations may require more time due to necessary approvals and hardware availability, but the actual installation process itself remains swift.

I assess the granular controls provided by CyberArk Privileged Access Manager as robust because they enable tailored access at the individual user level or through AD groups. This includes detailed role definitions such as safe reader, safe auditor, safe approver, and safe manager. As an administrator, I can manage all access. By provisioning least privileged access and allowing users to connect and view their accounts without exposing passwords, I uphold the principle of least privilege at the safe level.

I started as a CyberArk administrator for a fairly large bank in the US. They are a large global company. They formed a US branch, and I was the sole CyberArk administrator there. They had a basic CyberArk setup, and that is where I gained my initial experience before moving on to consulting.

My first consulting gig was for two and a half years with a defense contractor. They had a very complex environment. The complexity is typically gauged, especially for PAM products, by the number of passwords being managed. Many organizations have 10,000 or 20,000, whereas this organization had 750,000. This included the number of machines required to rotate all these passwords and integrations with their API and SailPoint to provision and de-provision users. We initially helped them change from a standalone vault architecture to a clustered vault architecture for high availability failover. Once we completed that, our work expanded, similar to being the IT person for the family—each task leading to another. This extended our engagement.

CyberArk Privileged Access Manager provides granularity. You can break things down into individual safes. You have specific access to safes by individual or group. The interface is with AD, with LDAP, or with local CyberArk passwords. You also have the ability to establish policies for your individual credentials. If you want them rotated at a certain time of day or you want the password complexity to forbid certain characters, you can create a new policy and fine-tune those elements. It provides excellent granularity because you can control all the factors related to password complexity requirements, password rotations, allowed connections, etc.

CyberArk Privileged Access Manager’s ability to safeguard the infrastructure is extremely important. Otherwise, clients would be keeping passwords in Excel spreadsheets. Consider having an isolated, non-domain joined vault that cannot be accessed from DNS. The vault itself takes over control of the local Windows Firewall and even things as simple as emails. It keeps the ports closed. If it is time to send out a notification to someone, it opens the port, sends the email, and closes the port. It cannot get any more secure than the vault system of CyberArk. People who land on a user credential and try moving laterally throughout your network, scraping RDP connections or hashes, will never find any information about how to get to the vault because it is non-domain joined.

CyberArk Privileged Access Manager is excellent for meeting compliance and regulatory requirements. The need for compliance is the main reason why organizations implement a PAM solution in the first place. They have to be SOX compliant in terms of log retention, audits, and even video recordings of people's actions. They all have varying retention periods depending on the organization.

CyberArk Privileged Access Manager provides operational efficiency with automation. It saves a lot of time for password rotations, managing SSH key rotations, and doing automated discovery at periodic intervals to reach out to your servers and check which credentials are there on those servers. If they are not managed in CyberArk, they are added to your CyberArk queue to be onboarded and automatically managed. These things save a lot of time throughout the organization.

Many people underestimate the value of these tools because they treat them as simple automated password management. Once you realize the volume of passwords in your organization and factor in nonhuman passwords, you realize its value. Last year, CyberArk Impact cited 45 nonhuman passwords for every human password. If you have 10,000 employees, you can imagine the number of passwords. There are also many other operations. For example, you have a Qualys scanner that needs to reach out and touch all your endpoints and scan them for vulnerabilities. They use an API call to CyberArk to pull out a Privileged credential that allows them to log in to that target. This is an automated machine call. It is tapping into CyberArk to get that credential. There can be hundreds of thousands of those operations a day. You do not want to manage those passwords by hand. Some people marginalize the significance of such a solution by saying that it is just a fancy password changer. It goes well beyond that, especially with API calls and automation. Its importance extends beyond merely changing passwords; it involves automation, API calls, and process integration, crucial in agile environments for standing up new Amazon servers or other processes needing privileged credentials. CyberArk can automate these tasks into their build processes.

Another critical feature is the proxy service via Privileged Session Manager (PSM), providing not only a proxy between your user and the target servers, protecting against malware but also offering session recording. Many companies I have worked with implemented a PAM product as a knee-jerk reaction to SOX audit requirements. They discovered they needed session recording and retention for regulatory compliance. This has become a major factor for clients instituting CyberArk, so PSM is a big deal in addition to regular password rotation.

CyberArk reporting is notoriously poor, offering about 5 reports out of the box. I am certified in Delinea, which includes 60 reports plus a custom report generator out of the box. Improved reporting would be beneficial.

I have used CyberArk Privileged Access Manager for seven years.

I encountered some unique challenges while working with a client managing 750,000 credentials because the underlying MySQL database is not exactly enterprise-level, unlike Oracle and Microsoft SQL Server. MySQL is free, and CyberArk's updates are infrequent. They went through many iterations starting with version 7 but did not update the underlying database version until version 12. We experienced database response and connectivity issues due to having too many credentials. That was a very unique case and a very large implementation, but they did have to do some tweaks to the database.

They also had an issue where they had too many passwords in a single safe. It is like the old Windows limitation where you can only have 512 entries in a particular folder. I had never seen that before, and that was because CyberArk retains the previous x number of password revisions for any given password. If you have 20,000 passwords in a safe, it also saves the last ten iterations of that password for each one, so you technically have 200,000 passwords in that safe. CyberArk literally issues a warning if you exceed 300,000. I have never seen that in my life, and it happened with one client. It caused the replication to the DR server to fail. We saw that in the logs, and then we had to do the math. They had 40,000 passwords in this one safe, and it was saving the last ten iterations of each password object. That means they had 400,000 password objects in this safe. They exceeded the limit. I do not expect to see this kind of issue again, but it happened.

When your client base grows from a few hundred to over three thousand, the number of tech support calls increases drastically, which is understandable. The support structure is tiered: L1, L2, and L3. L1 personnel follow a set procedure to gather information and logs. If they cannot solve the issue, it escalates to L2, possibly involving live sessions. Only complex problems reach the L3 experts in Israel. This normal tiered support approach can delay resolution, resulting in frustration. Response time is not ideal, and reaching someone knowledgeable can take time. It could be forever until you talk to someone who knows what they are doing.

Neutral

Its primary competitor is BeyondTrust, which is not very highly rated based on the feature set. There is senhasegura, a company from Brazil. They are new to America. They are barely making their way in now. ForgeRock has been around for a while, but CyberArk's closest competitor in terms of feature set and Gartner ratings would be Delinea. I am currently assigned to Delinea at my client. I have been working with that for the past year. I do see some benefits. There are certain things I like better about CyberArk, and there are certain things that are better about Delinea, but both of them are pretty competent.

It is quick because CyberArk follows the 80:20 rule. If you can get domain admins and local administrators into CyberArk, that is 80% of your exposure. That is a very quick turnaround. That can be a matter of a couple of months.

There is a specific order required to implement components: the vault is installed first, followed by CPMs, PVWA, and then PSMs. It is a fairly straightforward process, with some necessary preparation for the servers. CyberArk has incorporated scripts over the years, particularly for complex PSM setups because you have to utilize AppLocker scripts to enforce or specifically allow executables. Customization requires file reconfiguration and rerunning server hardening scripts. PowerShell scripts are now available to aid automation. Understanding the configuration and exceptions in scripts remains important for effective customization.

In terms of integration, out of the box, it has integration with Windows and Linux. They have a Telnet connector. It is a matter of CPM connectors being able to talk to the various systems and rotate their credentials because each operating system is different. AIX is different from HP. UNIX is different from Linux which is different from Windows. Windows is different from the mainframe. They have a lot of connectors out of the box, and they also have a plethora of additional connectors on their marketplace, which is their common website. Some of them are verified by CyberArk and some are not. They periodically review the ones that are uploaded based on the amount of time they have. Eventually, a connector could be certified by CyberArk. The big difference is whether a connector is officially supported by CyberArk or not. CyberArk does not address your support ticket if it is not a vetted connector.

Connectivity from SailPoint to CyberArk is done through SCIM servers. CyberArk has its own SCIM server set up, complete with documentation, for establishing that. I have done that before. When people are onboarded, most people in a lot of organizations get assigned an administrative credential so that they are not reaching out to target servers with the same credentials they use to log into their computers. As soon as they are onboarded, SailPoint sends over REST API calls through this SCIM server to create a safe for this person based on agreed-upon nomenclature. The account creation and assignment of permissions are done through calls and are automated.

Last year's Impact estimated the cost of an average breach to be nine million dollars. Once you have a breach, customers are hesitant to use your goods and services because you have had a major issue. It is difficult to put a price on your name going downhill.

The time savings primarily come from shifting from manual to automated management for all your passwords. With other tools such as Okta where you have self-service for resetting your own passwords and things like that, the average savings is 12 minutes, which is six dollars for a password reset, and you can extrapolate that over your organization. You do not really do that with CyberArk because it is managing the credentials. The manual work of managing all these credentials as opposed to the automation is where your time savings come in, but savings are difficult to calculate.

CyberArk has been Gartner's number-one pick for the past ten years, so you can infer that their pricing is higher than everyone else. When you are the best, you will charge appropriately for it. It does get fairly granular because they have separate licensing based on the number of users, the number of API call accounts that you can have, and the number of disaster recovery servers you can have in the system. A license is broken down into so many subcomponents.

They have a core product covered in the license. It includes the vault, the CPM that rotates the passwords, the PSM that does the proxying and the session management, and the PVWA, which is the web interface. Other things like Privileged Threat Analytics, Endpoint Privilege Manager, and other tools are bolt-ons with their own licensing. It gets a little hectic. At one point, they were offering a flat fee that was exorbitant at the time, like a million dollars, and you got everything, but they do not do that anymore. It is piecemeal now, and you have to pay for all different areas of licensing, which is problematic.

CyberArk recently introduced an identity bolt-on product. PAM tools and IAM tools are broadening their horizons to become a one-stop shop. Okta has a PAM solution which is not very effective but it is an attempt to be an all-in-one shop. CyberArk Cloud has gained traction, particularly among small to mid-size companies not needing the full customization and feature set of the tool. As with most cloud offerings, CyberArk's Cloud service expects out-of-the-box usage, with vendors maintaining and upgrading the system, limiting customization. This offers a viable solution for companies without significant on-premises needs, saving costs on servers and full-time employees.

I would advise evaluating whether you can manage with the cloud version's feature set, as it is simplified and requires minimal on-premises resources. An on-premises connector minimizes firewall rules and facilitates cloud communication, allowing the on-premises connector to interact with other targets. Delinea's cloud offering similarly requires an on-prem component called a site connector. If a simplified cloud feature set suffices without extensive customization needs, choose the cloud version to potentially save money, eliminating the need for assets on-premises and full-time employees for upkeep.

If someone thinks that they do not need a privileged access management tool because they are already using other security tools, I would wonder what features their tool is providing. Does it have account discovery and onboarding? Does it have proxying, web recording, and retention for videos of people accessing their assets? Does it support automatic pass or remote rotation? I would like to compare feature sets.

CyberArk Privileged Access Manager has not helped reduce the number of privileged accounts. In most organizations I have joined, users have their own account for logging in, and in the interest of security, a separate administrative account is created that gets vaulted in CyberArk. So, they have doubled credentials because people have a normal login plus an administrative login for doing privileged activities. You also have to factor in roughly 45 nonhuman privileged accounts or identities for every human identity because of your scanners, robotic process automation, and automatic agile builds from your CI/CD tools. All of these nonhuman factors are also reaching out and getting credentials from CyberArk. The point of a PAM system is not to reduce the number of privileged accounts. The point is to find accounts that are already in your system with account discovery and make sure they are managed by the tool. That extends to things like SSH keys. Most organizations have no clue how many SSH keys they have in their environment. CyberArk offers SSH key management as well. So, it does not reduce the number of privileged accounts. If anything, it encourages people to have more because they now have a tool to do all this work for them, and they do not have to do it manually.

I would rate CyberArk Privileged Access Manager an eight out of ten.

We use CyberArk Privileged Access Manager for least privilege and accountability purposes, while we also utilize the EPM solution for endpoint protection. Additionally, PTA is one of the most important tools from CyberArk Privileged Access Manager, which we use on a real-time protection basis. CyberArk Privileged Access Manager effectively prevents attacks on the financial service infrastructure, as we protect against lateral movement, credential stuffing, and since no passwords are available because they are rotated through CyberArk Privileged Access Manager, we can isolate every session and record all activity while monitoring in real-time.

The ability of CyberArk Privileged Access Manager to safeguard the financial services infrastructure by protecting credentials is extremely important, as every activity in a financial organization needs to be recorded for accountability in auditing. Therefore, CyberArk Privileged Access Manager is a crucial tool, and we utilize credential rotation as 85% of successful attacks in the last 10 years have been initiated through credential theft. Monitoring, recording, and credential rotating activities are crucial because if CyberArk Privileged Access Manager goes out of service, the total environment would collapse due to the lack of passwords for respective servers.

While I cannot suggest major changes, I did encounter a vulnerability concerning RADIUS blasts, which was recently mitigated by CyberArk Privileged Access Manager in their latest version, indicating an area for improvement in vulnerability assessments. Improvements in vulnerability assessment are essential. A notable request I have regarding CyberArk Privileged Access Manager is to address the issues of database corruption identified in cluster environments experienced by multiple clients.

From 2021 to now, I have been working on CyberArk Privileged Access Manager.

I have not experienced any stability issues with CyberArk Privileged Access Manager.

It is easy to scale.

In terms of technical support, CyberArk Privileged Access Manager has provided excellent support without any doubt. Based on the issue resolution and support quality, I rate the support 10 out of 10.

Before using CyberArk Privileged Access Manager, I did not evaluate any other PAM tools.

Setting up CyberArk Privileged Access Manager is not complex, especially if you properly follow the recommendations from CyberArk.

I handled the deployment myself.

CyberArk Privileged Access Manager has been very effective in helping my company meet compliance and regulatory requirements. Implementing CyberArk Privileged Access Manager saved time on compliance requirements in finance, typically around one hour.

There has been no reduced cost associated with CyberArk Privileged Access Manager, as when it is required, you must pay for their licensing and prepare the full environment. While there are costs for the licensing of CyberArk Privileged Access Manager, it definitely provides value when I need any accountability or session recording.

CyberArk Privileged Access Manager is one of the most important components from CyberArk, along with EPM (Endpoint Privilege Manager) and PTA (Privileged Threat Analytics tool). I recommend anyone considering CyberArk Privileged Access Manager to view it as a friendly environment, as it stands out among the other PAM solutions I have encountered. CyberArk Privileged Access Manager is highly recommended for its user-friendly nature. I rate CyberArk Privileged Access Manager a ten out of ten.

The primary use case for CyberArk Privileged Access Manager in our organization is to ensure we move away from named identity admin access, which lacks protection such as MFA and other features offered by cloud privileged identity management solutions. Our goal was to protect anything on-prem related to Active Directory privileged access, so we chose to go with CyberArk Privileged Access Manager.

I am the cybersecurity lead in my organization. Every single year when we do the audit, one of the things that consistently comes up is how there are hashes floating around the environment. Since switching over from named admin-privileged identities to CyberArk PAM identities, like PAM accounts, there have been almost no breadcrumbs left behind. There are no hashes and that sort of thing. We hardly see any hashes floating around the environment. We have not done the audit yet, which is due next month, but I have been keeping an eye on the hashes and it is looking promising.

The session recording and monitoring capabilities are valuable. We have real-time session management ability to record, audit, and monitor any privileged user activities. That is a big deal.

Automatic credential rotation and granular access control for target resources accessed by admins add to the value. 

Seamless integration with the SIEM, especially Microsoft Sentinel, is valuable.

Lastly, the platform's versatility allows for the use of different types of platforms beyond just RDP and SSH, including SQL and web applications.

There is room for improvement, particularly with Vendor PAM. We were previously using a competitor product that allowed vendors to manage their own teams. CyberArk has brought a feature called Vendor Team Manager, but it does not provide full access. It requires the vendor team leader to be onboarded as a local account instead of using their email address. Improvements could be made to onboard the vendor team leaders using their email, allowing them to manage their own team. That would greatly reduce the overhead in managing vendor team members. We have 50 to 100 vendors. Each vendor has at least 10 to 20 accounts., so we are talking about 500 to 1,000 accounts. It would be easier if we could just manage those 50 vendor team leaders rather than hundreds.

We have been using CyberArk Privileged Access Manager for six months, having started on the first of July.

Stability has been impressive. We have not experienced downtime for any reason. We did encounter one bug, but it was resolved once a patch was applied. The system is very stable and seamless. It requires minimal intervention to maintain high functionality.

When we took over as system owners of CyberArk, I thought every single time there was an update, we would have to stay up the night to do the patches and make sure it worked, but it has been very smooth and seamless. There is no friction. Everything has been taken care of at the back end, and we have not had to do anything out of hours. It has been very good.

I would rate it a ten out of ten for stability.

So far, scalability has been excellent. Initially, we deployed the architecture for 10 to 20 users, but we have onboarded 30 users while still on that mid-tier configuration. We have had no issues.

Being a mining company, we do have operations at various sites. That includes multiple sites in Australia as well as a couple of sites in Northern America. We do have multiple sites with critical infrastructure on every single site. 

At the moment, we have 50 user licenses, and so far, we have onboarded 30 users. We have 20 more users and some more coming on board in the new year.

I would rate it a ten out of ten for scalability.

CyberArk's support is excellent, providing personalized assistance through a dedicated local account manager and sales engineer. Their responsiveness is impressive, even though our location is quite isolated. We receive prompt support, which often exceeds expectations.

The dedicated local account manager has been providing us with personalized assistance tailored to the unique challenges that we have as a mining organization. The sales engineer supported us with his expert technical guidance during the deployment as well. It has been amazing. Both of these guys ensured smooth implementation.

For any issues that are not important, we raise tickets for customer support, and they have been very responsive. They get us back promptly. That is something unheard of because we are a very isolated city in Australia. Ours is the most isolated city in the world. The nearest city to us is 2,400 kilometers away. For someone like us, the support has been amazing. Sometimes, with other vendors, we have to wait a couple of days to hear back from them, but CyberArk has been exceptional in coming back to us with immediate responses. Their support has been perfect. I would rate them a ten out of ten.

Positive

Previously, we used BeyondTrust. We decided to switch to CyberArk due to its superior support, scalability, adaptability, and the local presence of account managers and sales engineers, which facilitated a smooth and effective experience. 

While other products in the market may offer certain features at a competitive price, they often compromise on support, scalability, and adaptability. The main thing for us was the support. CyberArk combines top-notch technical capabilities with the local human touch of the local account managers and sales engineers. That was a big thing for us because that ensured a smooth and effective experience throughout the journey, which other products lacked. 

We are in the West of Australia, and all the competitors are in the East. The only way to communicate is over the phone, and we would only see them once or twice a year. Having local account managers and a sales community was a game changer. Also, considering the reputation and the gold standard for Privileged Access Manager, others cannot compete with CyberArk.

It is a fully SaaS model, but because of the way CyberArk is architected, we do have our jump servers, PSM connector servers, and Secure Infrastructure Access servers in Azure, but it is not self-hosted. It is a cloud solution.

The jump start that was offered as a part of the product licensing was a game changer. When it comes to CyberArk, the complexity is quite high. That comes with security. Security and usability do not go hand in hand, but we have had help throughout our journey. The initial setup was detailed and supported actively by CyberArk's jump-start engineer. Every question was addressed, and the deployment was well-structured.

To realize its benefits, we had to wait until the users were happy using the PAM accounts. The individual privileged identities were still being used, so it took almost three months. That was the time it took for us to onboard the PAM accounts, hand over those accounts to the users, and confirm that it was working as expected.

In terms of maintenance, I thought there was going to be a lot of maintenance because we are the system owners, but so far, it has not skipped a beat. All the updates were very smooth. We did not have to do any work installing the patches, apart from underlying Windows patches, which is the sysadmin's job. If sysadmins are able to patch them, the product is resilient enough to come back up and do its function. Any updates related to the product itself are installed in the background, and it is very transparent for the user. It has been very seamless.

CyberArk's jump-start engineer played a crucial role in our successful deployment. He helped us all the way. Even now, about six months into the journey, he is helping us out with a few bits and pieces. Having that jump-start there was a game changer.

During our quantitative analysis, we estimated potential savings of one to ten million dollars a year by using a PAM solution. A cyber breach relating to admin-privileged access could lead to a financial loss of ten million dollars. If a standard user account is breached or compromised using their credentials, they cannot escalate to our higher privilege ones or cannot move laterally within the network. That was a game-changer.

CyberArk Privileged Access Manager is perceived to be somewhat overpriced compared to similar market products. It is a little bit overvalued. It could come down a little bit for my liking. However, the industry-leading reputation and the quality of service justify the high price point to some extent.

I would highly recommend CyberArk Privileged Access Manager. It is a leader in the privileged access management space, offering robust tools to secure credentials across IT and OT environments. We are very heavy on OT environments. It has been nothing but the best.

I would rate CyberArk Privileged Access Manager a ten out of ten.

As an implementation engineer, I have extensive experience with CyberArk Privileged Access Manager and its implementation this year at our customer site. We have been acting as a resident engineer for one of our customers for the past six months.

CyberArk Privileged Access Manager provides a repository and management system for our administrators to have sessions on our systems. For example, we require any administration access to our firewalls to be conducted through the PAM solution first. CyberArk Privileged Access Manager allows our administrators to access the firewalls and record the sessions.

Another use case is user offboarding. If an employee like Muhammad leaves our company, we can simply delete this user from the entire organization. We also have excellent compliance capabilities to review what occurs during administration sessions because we have them already recorded.

CyberArk Privileged Access Manager is very good on stability as a PAM solution. You can consider that if you do not have a stable PAM solution and the PAM solution always has issues with many maintenance windows, your entire organization cannot access the systems. It is very critical to rely on a stable system as a PAM solution.

The most valuable features are integrations with ticketing systems, recording sessions, and running with compliance. We also have another feature from CyberArk Privileged Access Manager, especially SSH key lifecycle management, which performs excellently in this area.

CyberArk Privileged Access Manager does not interrupt the sessions or administration sessions. Our professional services team implemented it, and we deployed full PAM features and the complete CyberArk Privileged Access Manager product in just three weeks across our larger organization. I think this is a strong point for CyberArk Privileged Access Manager.

I believe account discovery and rolling support need to be improved. Account discovery is important when integrating with other systems, as other PAM solutions can perform account discovery and onboarding effectively. Because PAM projects usually fail when teams try to onboard everything manually, CyberArk Privileged Access Manager discovery workflows can reduce this issue. Therefore, I think this area needs improvement.

We have recently relied on CyberArk Privileged Access Manager for only six months, so we have not tested the scalability yet.

We did not face any lagging or crashing during the past six months. The stability is very good, and I would rate it a ten.

We have recently relied on CyberArk Privileged Access Manager for only six months, so we have not tested the scalability yet. However, I can say it appears to be good from my understanding.

CyberArk customer support is professional. We contacted them on only one case and resolved it in time. Based on our experience, we resolved the issue in just five minutes. I can say the support team is very professional and very technical with strong technical capabilities.

Positive

I have implemented Fortinet VM, which is Fortinet's new PAM solution, two weeks ago recently. I think Fortinet has strengths in some areas and CyberArk Privileged Access Manager succeeds in other areas. Overall, I think CyberArk Privileged Access Manager is very good and can be considered a market leader in this space.

The pricing compared to other solutions, particularly Fortinet, is favorable. Fortinet overall has excellent pricing. However, CyberArk Privileged Access Manager has good return on investment. The pricing is affordable compared to the features and the stability of the product.

CyberArk Privileged Access Manager requires upgrading and maintenance. We have scheduled the upgrade, and we have detailed and informative documentation for upgrading. There is an integration matrix, or rather a compatibility matrix, between the newer versions of CyberArk Privileged Access Manager with other systems. Before upgrading, we study the compatibility matrix and the upgrade process is very smooth.

My overall rating for CyberArk Privileged Access Manager is ten.

We are a consulting company, and we provide consulting for solutions like CyberArk, HashiCorp, and similar offerings. I provide consultancy for various industries such as finance and hospitality.

Our clients use this solution for their critical assets and crown jewels. They want good identity and access management or privileged access management for their critical assets. A lot of mid-tier clients would have also implemented CyberArk on their servers if its pricing was better. Usually, they deploy it for their critical assets. They have implemented policies, just-in-time access, etc.

Having an efficient Privileged Access Management solution like CyberArk helps you stop bad actors early in the cyber attack chain process. You have an additional layer of security for your assets.

CyberArk Privileged Access Manager provides a good amount of granularity in giving access.

CyberArk Privileged Access Manager has a policy for blocking out everything as per the Zero Trust model, which can be helpful in a breach situation.

CyberArk Privileged Access Manager ensures data privacy by locking down your assets and recording each and every instance. That helps with the data information protection piece.

Privileged access management solutions like CyberArk Privileged Access Manager make it difficult for malicious entities to gain information or expose sensitive assets. Even if a specific asset not part of the PAM group gets breached, your critical information remains safe as access to specific resources or ports is not allowed. Implementing privileged access management in a way that blocks necessary threats makes it difficult for bad actors to access sensitive information.

The whole concept of Zero Trust and implementing it with CyberArk, which somewhat adheres to the 'never trust, always verify' principle, is very valuable. I really appreciate this aspect. Moreover, the just-in-time access is impressive, allowing access for a specific time.

Apart from CyberArk's PAM solution, I like CyberArk Conjur for secrets rotation. The constant rotation of secrets makes it hard for bad actors to gain access to environments. 

CyberArk provides a good amount of control over access types. However, as a future enhancement, having additional features for cross-platform integration would be beneficial. It would be good to have integrations with other tools and firewalls, such as Zscaler and CrowdStrike. Although I am not fully aware of recent updates, more cross-platform integration would be valuable. A SOC analyst would like to have centralized access in terms of information flowing in even for privileged access management. They would like to have control over everything instead of opening four to five tabs for different sorts of information. Cross-platform integration would help with that.

Customers also want CyberArk's pricing to be better so that they can implement it further and have more licenses.

Implementing a privileged access management solution can be challenging. It would be great if CyberArk could provide recommendations based on the compliance standards of an organization. It would help system admins ensure that all the required ports are closed and the systems are being managed properly. If any system is not being used anymore, any ports opened for that system need to be closed. Having such recommendations would be helpful.

I have been associated with CyberArk since it became popular two to three years ago. I have been working with CyberArk tools on the client side and the consultant or vendor side.

I cannot think of any stability issues.

I cannot think of any scalability issues.

In terms of tech support, I have had a positive experience with ManageEngine support, and I wish that a similar experience was there with other vendors and products. With ManageEngine, I appreciated the chat option. When I was stuck, I did not need to go through a dedicated portal or wait hours for a solution. A chat system providing quick access to a technical engineer, within four to five minutes, is very helpful.

I would rate CyberArk's technical support a seven out of ten.

Neutral

I worked with HashiCorp, specifically HashiCorp Vault, and had collaborations representing CyberArk's perspective. 

CyberArk focuses on privileged access management for enterprise security. They offer CyberArk Conjur, but if customers need secrets management or infrastructure automation, HashiCorp has a better solution with HashiCorp Vault. In terms of PAM, CyberArk excels. For Conjur-type products, HashiCorp is better. CyberArk caters to traditional infrastructures and security or IT admins, while HashiCorp has good cloud-native, DevSecOps, or DevOps services.

About two years ago, people focused on the on-prem side of things, but now the cloud version is gaining popularity.

The solution has so much to offer that it becomes a little bit complex. Every infrastructure is different, and you need a customized solution as per the infrastructure design. CyberArk has a lot to offer. It has a lot of buttons to push in terms of security, so it becomes a little bit complex when you are deploying it for a big organization.

During on-prem deployments, we followed specific steps for the right deployment process. The order of deployment is crucial, such as deploying necessary components first and then setting up CPM policies. This order is essential whenever deploying CyberArk.

Two to three years ago, its integration was difficult. We had to take different routes to integrate those solutions, but now, we see a lot of plug-ins. For example, Microsoft Sentinel does have a CyberArk plug-in.

For deploying a CyberArk solution, you would need at least two security analysts, two to three system admins, and one network administrator. The security admin provides the right infrastructure and access. The network administrator helps with all VLANs or separate segmentation for specific sites or resources. The security admin works on the CPM policies and more.

In terms of maintenance, like any other solution, it requires keeping an eye on it and any updates. You would need someone to support it.

A strong identity and access management solution aids in navigating significant incident responses or breach situations. Omitting important solutions can be highly costly. Implementing a privileged access management solution can help avoid such expenses.

Its value can be seen after one or two months of proper implementation. It makes the life of a security admin easier. 

I focus more on the technical side, but I hear customers say that if CyberArk was more affordable, they might have acquired more licenses. Some clients consider alternative solutions due to pricing concerns. If CyberArk could address this, it would help in offering their solution to additional customers.

With a PAM product, most customers want to block access to critical assets and have a strong policy set. They also look for cost-effectiveness.

For a financial organization, even a compromised password can trigger a domino effect in terms of exposure of sensitive information, leading to a failure to meet specific compliances being followed in a specific region. They might have to let consumers know. Having an effective PAM solution can save a company from such a situation. Generally, it is not that the solution is not efficient. It is usually that the implementation is not done correctly. Every infrastructure is different, so you need to have a proper plan and make sure it is implemented as per your industry requirements.

CyberArk Privileged Access Manager helps with compliance to a certain extent, but it is not a compliance solution. For compliance, we still rely on other solutions.

I tell my clients that having an additional piece of PAM helps protect against threats and provides an extra layer of security. Identity and access management are fundamental in cybersecurity. Done right, it offers peace of mind and safeguards against unauthorized access to sensitive information. In the financial sector, where data is highly sensitive, exposure to bad actors can lead to significant breaches and potential damages. A breach can cost a million of dollars.

I would rate CyberArk Privileged Access Manager an eight out of ten.

The use case of privileged access management is self-explanatory. A large telecommunication company like ours needs to protect our privileged access because every attack cycle has privilege escalation, and we have to stop attackers at this point. 

We have a lot of vendors or third parties working with us. They need to access our resources. The trust level of external third parties is lower than direct employees, so we do not want to share our critical credentials with them. That is our primary use case. 

Another use case is managing internal employees, especially highly privileged administrators. Furthermore, the critical business applications and areas throughout our IT infrastructure involve privileged access, and we aim to protect those. We want the ability to audit and have real-time control.

I appreciate CyberArk's real-time capabilities. I can secure critical sessions, such as SSH or database sessions. As a security professional, I have real-time visibility into ongoing sessions. If anything suspicious occurs, I can terminate or freeze the session, which is part of user behavior analytics. 

We can monitor and have real-time control over our environment with sessions coming from around the world, ensuring security. We have visibility and control through real-time user behavior analytics. That is my favorite feature.

It has a learning curve and is a complex product that requires dedicated training and people. 

Maintaining the product is challenging. Upgrades require a lot of resources, as it impacts the entire organization. For example, upgrading components like the Privileged Session Manager (PSM) and the vault is time-consuming and difficult. In the long term, I would like to see these processes simplified, especially for on-premise installations.

I have been using this solution since 2018, which is a little over six years for me.

The product is solid and works as designed. The product itself is not yet very mature. That is one side. Another side is not putting enough resources into it as a customer. Most of the time, any stability issues are mostly with the customer, not the vendor. Proper fine-tuning and expertise ensure the product performs well.

It is highly scalable. We started small and expanded it to an enterprise level, and are now moving to the cloud for further growth. Its architecture offers scalability. It can grow much bigger than our company. It provides all the flexibility and modules if you have the required expertise.

CyberArk's customer service has improved recently and is now very responsive. However, four to five years ago, they were average. They are now at acceptable levels.

Neutral

We are fully on-prem for the PAM, but we are moving to the cloud.

Its deployment is not easy due to CyberArk's complexity. We started from a small footprint and then moved to a larger deployment. It was a lot of work. This could not be managed without CyberArk-certified engineers. It is very complex.

We can never deploy and manage it fully by ourselves. No company has that expertise, so you always need CyberArk-certified engineers from a third party when it comes to critical things. We have over 30 servers running for the CyberArk solution. All 30 servers have different pieces of this complete solution. We can never upgrade it by ourselves without professional services. We can do some of the things ourselves, such as day-to-day management, troubleshooting, and operations, but for upgrades, installations, migrations, and disaster recovery, we need professional services. We have a separate budget every year for professional services.

We have a team including myself from governance, a project manager, senior leadership, and hands-on team members, among others. It requires four to five people from security and two CyberArk-certified engineers. I need two engineers because if one gets sick in the middle, the other person can take over because there is no going back when we start the upgrades and critical changes. We have four to seven knowledgeable and dedicated people in a critical scenario.

Pricing is a problem. CyberArk is expensive compared to other products I know. It is similar to buying a German car. It comes with all the bells and whistles, but some companies may find it too expensive.

I compared CyberArk with a product called Delinea. I preferred CyberArk because Delinea required additional agents installed on each target for session recording, whereas CyberArk does not. There was a difference between the two products in how they did the session recording. Because Delinea needs an extra agent installed on each target to do the session recording, you have a huge amount of work managing those target agents on probably thousands of servers. You need another team to do that. An extra workforce is needed to manage that. That was the first turn-off for me. CyberArk does not need an agent. It is in real-time. It drops DLLs to the target host during the session so that you do not need to manage the agent.

The most important aspect for us was that Delinea did not have real-time controls. They said they were developing that piece. They could only analyze recordings after the event had already happened, but then you are too late. All the artificial intelligence and machine learning were applied for the post-event activities. That was a big differentiator. CyberArk's real-time controls set it apart as Delinea only analyzed recordings after events.

These were the two main reasons for going with CyberArk. Everything else was fine. For an average-sized company, Delinea is fine, but for a large-scale company, CyberArk is a better choice.

It took us some time to realize its benefits because there was a learning curve for us. It took us about a year to get our heads around this product and start effectively using it. It is a journey. It takes at least five years for any company to make this product very useful and reach maturity. It is not only the product's fault. The company needs to have a vision, and the company culture needs to go with it. Senior leadership needs to support the vision. You need to have lots of ingredients for success. If everything is in place, you will see success after one year. In the first year, it is a struggle for everybody.

My company was bought by a bigger company, and they were very new to privileged access management. Everybody was struggling. The advice I would give is to have a good vision for privileged access management. You need dedicated teams, senior management support, and proper company policies and standards before implementing the solution. Start building knowledge slowly and avoid jumping into the deep end without preparation.

I would rate CyberArk Privileged Access Manager a nine out of ten.

My first use case is seamless recording and seamless connection to the area target, as well as the recording of ten sessions with command restriction. This is the first use case. 

Secondly, I can perform password rotation without needing to know or use the password of the privileged account. I can connect and rotate my password as needed. Various customers have password rotation for each day. 

These are the two main use cases currently employed: password rotation and a seamless connection to end targets with the recording feature.

It's a one-stop solution. Whatever I need, whether securing identity, web applications, privileged accounts, RDP, Windows, Linux, or other devices like switches or firewalls, CyberArk supports it fully. It eliminates the need for me to search for other solutions.

Its identity compatibility with CyberArk Identity Solution provides extra security, including free MFA with the licensing cost. Premium accounts can increase security using the EnCon Privileged Manager. CyberArk's integration with PaaS solutions makes it the most comprehensive solution, eliminating the need for me to explore other Gartner solutions.

The best feature is vaulting. CyberArk has a separate vault, which is their proprietary vault, which provides multiple encryptions for every password object, as well as tamper-proof recording. Recordings are sent to the vault. This is the best feature since all data and security we have are situated in the vault. 

CyberArk provides me with a single account page to access all endpoints or privileged accounts, simplifying connection without the hassle of password maintenance.

I sometimes require learning resources when there is a new solution for CyberArk. I need to mark favourite accounts or group accounts which point to needed improvements. Some users wish to bypass providing a reason when logging into some target servers. 

Additionally, some users could be excluded from certain requirements, but this is not currently possible. A gradual setting could be added to exclude users from regular routing, allowing direct access without entering a reason. 

Also, improving the support process is necessary. They are focusing on cloud solutions instead of on-prem. They are taking two to three days for resolution are too slow. Customers, including myself, do not want to wait this long for solutions. It is vital for CyberArk to focus more on enhancing support, though CyberArk is committed to monitoring customer reviews and is making progress in its solutions.

I have deployed and implemented CyberArk for various customers. I have been installing and deploying CyberArk to different clients and regions for more than four years.

In my four years of experience, I did not encounter any glitches or big problems in CyberArk. I have only encountered minor issues, such as a learning curve, which cannot be changed. There are also a few items that are mandatory and not optional in terms of being able to change things. Even if the customer does not want it, it is a one-stop solution.

Apart from these minor issues, CyberArk is perfect for daily operations when compared to other solutions. It secures my organization despite some mandatory features that clients do not want. 

I'd rate stability nine out of ten.

I'd rate scalability ten out of ten.

I'd rate the technical support seven out of ten.

I have experience with CyberArk support, where I had some unresolved issues. The support provided me with a different solution, which was unrelated to my request. The support staff appeared lacking in technical knowledge, which resulted in dissatisfaction for both myself and the customer. Consequently, they hired partners and services to manage their CyberArk application.

Neutral

The initial setup depends entirely on the investment. CyberArk consists of several components, such as four to five for a standard setup or eight to ten for distributed or high-availability configurations. 

This increases investment costs. SaaS, which requires fewer components, might be chosen yet comes with disadvantages, as Vault and PVWX come with the application. Compared to on-prem solutions, it's a bit more expensive, however it gives more rights to the customer. 

The initial setup is straightforward. The customer can use it almost right away.

The process might take 20 minutes with troubleshooting all the way up to three months for a full project. 

Most of our clients are bigger enterprises.

CyberArk does not need any maintenance. It deploys custom management, so you don't require anything beyond an administrator that can handle any downtime. It automatically upgrades.

Our team currently consists of up to ten members working, depending on the project's requirements.

The ROI is a big concern. It's a total solution, and most customers are totally satisfied with their solution right now. Most customers are satisfied with having this single solution, having initially wanted different solutions. After experiencing CyberArk and its demo, customers are fully satisfied. CyberArk's capabilities and functionality outperform other solutions.

CyberArk is not inexpensive. It offers a two-way model: access is a licensing cost based on the number of users, and the implementation cost is handled by partners. Although it is somewhat expensive, paying only for licenses instead of the number of devices can be considered fair. Yet, it is not labeled as cheap, it is somewhat falling on the expensive side.

CyberArk is a bit expensive and enterprise clients are the ones that are using it right now. It works well in big organizations with big architecture. 

I have experience with CyberArk as well as other on-prem solutions. CyberArk offers numerous solutions. Compared to others, CyberArk's identity system is bundled with access solutions and securing privileged access. The admin gateway first checks user legitimacy before granting access to the PaaS solution or privileged accounts. CyberArk integrates various cybersecurity solutions, such as identity, endpoint privilege manager, and PAM solution, apart from VPN-less access and dynamic privilege access. 

Other solutions only offer traditional features. CyberArk is progressing in AI and ML. It's allowing web applications and scripts onboarded without credential hassle. Hence, CyberArk is a leader in time solutions.

Overall, I would rate the product a nine out of ten. 

It's a one-stop solution. CyberArk has total support for everything, saving you from finding any other solution. You get strong security for your license costs.

I'm a partner of CyberArk.