CyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira

Palo Alto Networks now owns CyberArk and sells it as Idira, so plenty of PAM renewals are getting a second look this year. Pick on how each product fits the accounts, servers and vendors you actually have, then get support dates and the price in writing before you sign.

For CyberArk customers the deal didn't change anything on day one. Palo Alto said at closing that CyberArk would stay available as a standalone platform and existing customers would see no disruption. The Idira FAQ goes further: you can keep using the platform as you always have, and you'll mostly notice a new logo. What it does change is who sets the roadmap and who writes the renewal contract, and that's reason enough to ask questions.

Delinea and BeyondTrust haven't stood still either. Delinea finished buying StrongDM, which checks each action against a policy while a session runs. BeyondTrust ships about three Password Safe releases a year and supports each for roughly two years. 24.3.x came out in December 2024 and leaves support at the end of December 2026. If you run BeyondTrust, the upgrade forces a decision on its own timetable.

The order matters because the three vendors count licences in different units. A quote built around your admins can look cheap next to one built around every server you own, even when the second one covers more.

Each row below is a job a PAM programme has to do. We went through each vendor's own documentation and product pages in October 2026. Where a vendor publishes nothing, the table says so instead of guessing.

CyberArk (Idira) fits large, regulated estates that need deep session recording and already have a team that knows its components: the Vault, PVWA, CPM and PSM. If you also run Palo Alto firewalls or Prisma, the Idira FAQ promises cross-platform features over time. The catch is that Palo Alto hasn't published dates for that roadmap, and CyberArk's own docs and lifecycle pages now redirect or don't load. Ask for the support end date of your version in the contract.

Delinea suits teams that want a vault running without a big PAM staff behind it. The cloud edition of Secret Server takes server patching off your plate. StrongDM adds a check on each command while a session runs, which matters most for databases, Kubernetes and AI agents. Watch two things. Secret Server Cloud matches the on-premises Professional edition minus CRM integration, you can't configure its site connectors, and the distributed enginesdefinitionServices you install near your targets that do Secret Server's legwork: rotating passwords, heartbeat checks and discovery. If they're down, that work doesn't happen. do the rotationdefinitionChanging privileged passwords automatically, on a timer or after each checkout. If one leaks, it soon stops working. work, so somebody has to keep an eye on them.

BeyondTrust is strong where vendors and help desks need into your systems and where laptops still have local admin. Plenty of estates start with Privileged Remote Access or Endpoint Privilege Management and add Password Safe later. The thing to plan for is patching. Its remote-support products have had four entries on CISA's list of exploited flaws since December 2024, so a self-hosted appliance needs someone who patches it within days.

These are the details that change a design. They come from vendor docs and, where marked, from practitioners on vendor forums. None of them show up in a demo.

• CyberArk: Privilege Cloud still needs connector servers on your network to reach targets. Palo Alto's migration page says so, and somebody has to patch them.
• CyberArk: custom PSM connectors are hard to build because every target app's screens differ, writes Bakotech, an Idira distributor. Count yours before you price a move in either direction.
• Delinea: if distributed engines go down, queued work expires. A heartbeat is dropped after 5 minutes and a password change after 20, and expired work is thrown away.
• Delinea: Secret Server versions older than 11.9.000025 have to step through 11.9.000006 first, or offline upgrades fail an integrity check.
• Delinea: Secret Server Cloud runs its site connectors for you as an Azure service, and you can't configure them. CRM integration isn't available in the cloud edition.
• BeyondTrust: Password Safe runs only on physical or virtual U-Series appliances or in the cloud. If your policy says software goes on your own Windows servers, check that first.
• BeyondTrust: one admin on BeyondTrust's community forum had to roll back a Password Safe upgrade from 23.3 to 25.1. A reply pointed to SAML and access URL changes since 23.x.
• All three: rotation breaks things when nobody knows where a password is used. One ServiceNow community thread describes an LDAP service account that kept locking every few hours after rotation, while the poster hunted for wherever else the old password was still set.

Every PAM product holds the keys to everything else, so its own flaws matter more than most. As of late October 2026, CISA's Known Exploited Vulnerabilities list had no entries for CyberArk, Delinea, Thycotic, Centrify or StrongDM. It had several for BeyondTrust Remote Support and Privileged Remote Access, the latest added in October with forensic triage required.

Don't read that as a ranking on its own. Delinea fixed two critical Secret Server flaws this year that aren't on the list, a FIDO2 registration bypass and a padding-oracle bug, and both affected on-premises servers. In the BeyondTrust October case, SaaS instances were patched before self-hosted ones. Ask each vendor how they tell customers about a flaw, how fast SaaS gets fixed, and what you have to do for anything you host yourself.

CyberArk is the only one of the three with a plain annual price we could find. On AWS Marketplace, 25 standard Privilege Cloud users cost $44,712 for a year, and you can ask for a private offer. BeyondTrust's AWS listing, sold through the reseller Carahsoft, shows 36-month bundles with implementation and training included, like $288,700 for 500 Password Safe managed systems. Delinea counts users instead, and its remote access product counts people who are in a session at the same time. BeyondTrust charges for Password Safe by managed system. One of its staff said on the forum that a system you remove stops using a licence.

That's why the same estate can produce quotes that look nothing alike. A few admins and thousands of servers favours per-user pricing. Many users touching a small fleet favours per-system. Run your own counts through each model before you talk about discounts.

No vendor publishes a tool that imports a CyberArk vault straight into Delinea or BeyondTrust. Secret Server's built-in migration tool takes KeePass and a few password managers, and anything else comes in by CSV or XML. For Password Safe, a BeyondTrust employee advises onboarding accounts in batches through discovery, and bringing secrets in by CSV or API.

The passwords are the easy part. What eats time is rebuilding rotation for each kind of target, the session connectors your admins depend on, and the approval workflows. Then you test each one against real systems. Plan to run both vaults side by side and move one team or one kind of account at a time.

Staying put has a migration of its own. Palo Alto documents a four-phase move from PAM Self-Hosted to Privilege Cloud: prepare, deploy, migrate and optimise. Delinea sells migration packages from Secret Server on-premises to its platform. For many CyberArk customers the real decision this year is self-hosted against SaaS, and the vendor question comes second.

We upgrade and migrate all three platforms, and a lot of the work is onboarding service accounts nobody has touched in years. Before you choose, we count your accounts and connectors and get each vendor to price the same scope. Then we run the pilot on the targets that usually break. If you'd rather add people to your own team, we can staff PAM engineers for that too. Start with the free assessment, or read our CyberArk page first.