Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
privileged access

BeyondTrust deployments that rotate credentials without breaking things.

We implement and upgrade BeyondTrust Password Safe, Privileged Remote Access and Endpoint Privilege Management. Password Safe 24.3.x drops out of support at the end of December 2026, and any self-hosted Remote Support appliance that skipped the October patch is still exposed.

Talk to a BeyondTrust engineerWhat changed recently
platform dossierBeyondTrustPrivileged access
Vendor
BeyondTrust
Current release
BeyondInsight and Password Safe 26.3 (Sep 2026)
Support horizon
Password Safe 24.3.x support ends 31 Dec 2026
Patch now
Self-hosted Remote Support up to 26.2.3 needs BT26-05-RS (CVE-2026-102764)
release watch
  • Password Safe 24.3.x end of supportDec 2026
  • Remote Support and PRA 26.3.1 with optional automatic upgradesNov 2026
connects with
in short·15-second read

Cohash implements and upgrades BeyondTrust Password Safe, Privileged Remote Access and Endpoint Privilege Management.

Password Safe 24.3.x support ends on 31 December 2026, so plan the move to 26.x now. Self-hosted Remote Support up to 26.2.3 also needs the BT26-05-RS patch for CVE-2026-102764, which CISA lists as exploited in the wild.

you probably need this if
  • Password Safe is on 24.x and the December 2026 end of support is already on the risk register.
  • The Remote Support appliance sits at the edge, and nobody is sure the October patch went on.
  • Vendors come in over VPN on a shared account, and afterwards nobody can play back what they did.
terms on this page Service accountdefinitionA non-human account that software signs in with. Shared ones tend to pick up years of extra permissions.explained in a field note →Password SafedefinitionBeyondTrust's password vault for privileged accounts. People check passwords out of it, it rotates them afterwards, and it records the session.explained in a field note →Remote SupportdefinitionBeyondTrust's tool for help desks to see and control a user's device. It used to be called Bomgar.explained in a field note →Privileged Remote AccessdefinitionBeyondTrust's tool for admins and vendors to reach servers and network gear, often with credentials it injects so nobody sees them.explained in a field note →SafedefinitionCyberArk's container for accounts. You add people as safe members, and their rights there decide whether they can list, use or manage what's inside.explained in a field note →
Ask an engineer facts checked 2026-11-03
how it runs
  1. 01Health check
  2. 02Upgrade plan
  3. 03Service account mapping
  4. 04Vendor access through PRA
  5. 05EPM rollout and handover
you keep
  • A 24.x to 26.x upgrade runbook with real timings from the rehearsal. Next time your team runs it without us.
  • A service account dependency map: every service, task and app pool that uses each account
  • Rotation policies for each type of managed system. When a rotation fails, someone gets told.
+ 3 more documents
who does it
BeyondTrust Password Safe engineerPrivileged Remote Access engineerEndpoint Privilege Management engineer
platforms
background
24.2 ends 26.3.1 out 24.3 ends 27.1 dropsRADIUS Jul 2026 Mar 2027
field note · 13 minBeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade
beyondtrust · release timeline
  1. Sep 2026 BeyondInsight and Password Safe 26.3 This is the newest release on BeyondTrust's list, after 26.2 in July and 26.1 in April. Anyone still on 24.x has a long jump to rehearse, so start with a copy of production.
  2. Oct 2026 Remote Support CVE-2026-102764 (BT26-05), on CISA's exploited list Attackers used it before a fix existed, and CISA added it to the KEV catalog on 16 October 2026. SaaS sites were patched by BeyondTrust. Self-hosted appliances on 24.3.1 through 26.2.3 take the BT26-05-RS patch, and anything older has to upgrade first. PRA shares the affected code, so patch that too.
  3. Oct 2026 AI Agent Security on Pathfinder If developers run coding agents, this is BeyondTrust's answer. It sat in private beta from mid-2026 and launched for Windows and macOS in October. At the beta, BeyondTrust said it would be sold first as an add-on to Endpoint Privilege Management. Check your EPM licence before you plan a pilot.
  4. Oct 2026 Discovery Agent 26.3.1 and Password Safe Mobile 1.7.0 Discovery Agent 26.3.1 is a maintenance fix that replaces every agent from 20.1.0 up to 26.3.0.2721, and Windows service enumeration now gives up after 30 seconds by default where it could hang for a day. The mobile app picked up favorites, secret version history with rollback, and one-time codes for stored credentials.
  5. today · Nov 09, 2026
  6. Nov 2026ahead Remote Support and PRA 26.3.1 with optional automatic upgrades BeyondTrust is aiming for general availability on 3 November 2026. Sites that opt into the Fast Track get moved to 26.3.x in their maintenance window from about mid-January 2027. Standard Track waits for 27.1 and Enterprise Track for 27.2, so pick a track before someone else's calendar decides it.
  7. Dec 2026ahead Password Safe 24.3.x end of support Support stops on the last day of December 2026, and 24.2.x already lost it in September. If you're still on either, book the upgrade test now, because a December window leaves no room for a failed first attempt.
the story · beyondtrust estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your BeyondTrust estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • Password Safe is on 24.x and the December 2026 end of support is already on the risk register.
    • The Remote Support appliance sits at the edge, and nobody is sure the October patch went on.
    • Vendors come in over VPN on a shared account, and afterwards nobody can play back what they did.
  2. chapter 02 · what we change

    How we solve it

    • Password Safe implementation and upgrades
    • Privileged Remote Access
    • Endpoint Privilege Management
    • Service account discovery and rotation
    • AI agents on endpoints
    • Health checks
  3. chapter 03 · how it runs

    Our approach

    • Health check
    • Upgrade plan
    • Service account mapping
    • Vendor access through PRA
    • EPM rollout and handover
  4. chapter 04 · where you end up

    What changes

    • Production is on a supported 26.x release with the integrations tested.
    • Nobody on a standard account has local admin any more, and elevation follows written rules.
    • A 24.x to 26.x upgrade runbook with real timings from the rehearsal. Next time your team runs it without us.
    • A service account dependency map: every service, task and app pool that uses each account
what we do

Our BeyondTrust work

6 kinds of BeyondTrust work, each run by engineers who have done it on live tenants.

  1. Managed systems, accounts and rotation policies configured, with upgrades from 24.x and 25.x to current releases rehearsed before the production window.

  2. Vendor and admin access through jump points, with credentials injected from Password Safe so nobody sees the password.

  3. Local admin rights removed from workstations, with application control policies built from what people actually run.

  4. Service accounts mapped to the services and scheduled tasks that use them before rotation is switched on.

  5. A review of the coding agents and assistants running on your endpoints, and a pilot plan for BeyondTrust's AI Agent Security module where it fits.

  6. A review of rotation failures, session policies and stale accounts, with a ranked list of fixes.

capability 01 / 06in production

Password Safe implementation and upgrades

Managed systems, accounts and rotation policies configured, with upgrades from 24.x and 25.x to current releases rehearsed before the production window.

talk to an engineer about this →
capability 02 / 06in production

Privileged Remote Access

Vendor and admin access through jump points, with credentials injected from Password Safe so nobody sees the password.

talk to an engineer about this →
capability 03 / 06in production

Endpoint Privilege Management

Local admin rights removed from workstations, with application control policies built from what people actually run.

talk to an engineer about this →
capability 04 / 06in production

Service account discovery and rotation

Service accounts mapped to the services and scheduled tasks that use them before rotation is switched on.

talk to an engineer about this →
capability 05 / 06in production

AI agents on endpoints

A review of the coding agents and assistants running on your endpoints, and a pilot plan for BeyondTrust's AI Agent Security module where it fits.

talk to an engineer about this →
capability 06 / 06in production

Health checks

A review of rotation failures, session policies and stale accounts, with a ranked list of fixes.

talk to an engineer about this →
typical situations

BeyondTrust situations we walk into

We pieced these together from BeyondTrust situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

Password Safe 24.3 with a December deadline and no test instance

composite · not a client story
  1. Beforethe situation

    Password Safe runs 24.3.x with about 6,000 managed accounts on a single production appliance. There is no test instance, two integrations call the API from old scripts, and support ends on the last day of December 2026.

  2. What we dothe work

    We build a test instance from a recent backup, upgrade it to 26.3 and time each step. The API scripts run against it and get fixed where they fail. Then the production window is booked with a rollback point and a post-upgrade checklist for rotation and sessions.

  3. Afterwhere you end up

    Production is on a supported 26.x release with the integrations tested. Next time, the team starts from a rehearsed runbook and not from nothing.

case file 02

The local admin cleanup that got rolled back and never retried

composite · not a client story
  1. Beforethe situation

    The last attempt to strip local admin rights from 8,000 Windows laptops swamped the helpdesk within a week and got rolled back. Since then, developers have started running coding agents like Claude Code and Cursor with admin rights.

  2. What we dothe work

    Endpoint Privilege Management runs in audit mode only for a few weeks. We write the elevation rules from what people actually ran, then roll out department by department, starting with the one that has the fewest elevated apps. Developer machines get an AI Agent Security pilot next to the EPM policies.

  3. Afterwhere you end up

    Nobody on a standard account has local admin any more, and elevation follows written rules. The agents developers run now sit under a policy with a named owner.

approach

How a BeyondTrust engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Health check

    We look at which BeyondInsight and Password Safe versions you run and how managed systems are set up. Then we go through rotation failures, session policies and stale accounts, and put the fixes in order.

  2. step 02

    Upgrade plan

    We map your route from 24.x or 25.x to a current 26.x release and check every integration on the way. The upgrade gets rehearsed on a copy before anyone books the production window.

  3. step 03

    Service account mapping

    Rotation doesn't get switched on until each service account is mapped to the Windows services, scheduled tasks and app pools using it. Otherwise one of them keeps the old password and breaks.

  4. step 04

    Vendor access through PRA

    We put a Jumpoint in each network zone and set up vendor accounts with approval and session recording. Credentials are injected from Password Safe.

  5. step 05

    EPM rollout and handover

    We build Endpoint Privilege Management policies out of observed application use and roll them out one group at a time. Then the runbooks go to your team.

ai on beyondtrust

Where AI fits on BeyondTrust, and where it needs guardrails.

BeyondTrust announced AI Agent Security for Pathfinder in June 2026, and it's in private beta. It controls coding agents on endpoints (Claude Code, Copilot, Cursor and Codex among them) and is sold first as an add-on to Endpoint Privilege Management. BeyondTrust has also shown a preview MCP server for Password Safe. We'd run both as pilots next to your current EPM and Password Safe policy.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
BeyondTrustdoes the work

BeyondTrust has a preview Password Safe MCP server, authenticated with an API client ID and secret. For production we'd have agents call the Password Safe API instead, on a dedicated API registration with source IP limits, credential checkout approval and session logging.

AI Agent Security for Pathfinder (private beta)

It targets agents running on endpoints and is sold as an add-on to Endpoint Privilege Management. We'd pilot it on a developer group already under EPM, with exit criteria agreed before it starts.

Coding agents and local admin rights

Developers often run coding agents with admin rights. We run EPM in audit mode to see which elevations agents actually request, then write elevation rules so agents work without standing admin.

Password Safe preview MCP server

In October 2025 a BeyondTrust employee posted a demo of a preview MCP server that pulls privileged credentials from Password Safe into Claude Desktop. We'd keep it out of production. Any test should use non-production accounts only.

architecture

Where BeyondTrust sits between your people and your servers

A vendor or admin starts a session in Privileged Remote Access and goes through the Jumpoint in that network. Password Safe types in the password, which nobody ever sees, and changes it afterwards. Admin rights on laptops are handled separately by Endpoint Privilege Management.

Where BeyondTrust sits between your people and your servers A vendor or admin starts a session in Privileged Remote Access and goes through the Jumpoint in that network. Password Safe types in the password, which nobody ever sees, and changes it afterwards. Admin rights on laptops are handled separately by Endpoint Privilege Management. 01 · WHO NEEDS ACCESS 02 · BEYONDTRUST 03 · INSIDE YOUR NETWORK 04 · TARGETS remote session console session inject credentials outbound tunnel RDP · SSH rotate rotate elevation request policy enforcement Vendors and contractors browser-based sessions Internal admins PRA console Workstation users standard user rights BT Privileged RemoteAccess approval · recording BT Password Safe credentials ·rotation BT Endpoint PrivilegeManagement elevation · appcontrol Jumpoint one per network zone Servers Windows · Linux Databases SQL Server · Oracle Workstations Windows · macOS © Cohash · cohash.com
01 · WHO NEEDS ACCESS02 · BEYONDTRUST03 · INSIDE YOUR NETWORK04 · TARGETS Vendors and contractors: browser-based sessions Vendors andcontractors browser-basedsessions Internal admins: PRA console Internaladmins PRA console Workstation users: standard user rights Workstationusers standard userrights Privileged Remote Access: approval · recording PrivilegedRemoteAccess approval ·recording Password Safe: credentials · rotation PasswordSafe credentials ·rotation Endpoint Privilege Management: elevation · app control EndpointPrivilegeManagement elevation · appcontrol Jumpoint: one per network zone Jumpoint one per network zone Servers: Windows · Linux Servers Windows · Linux Databases: SQL Server · Oracle Databases SQL Server ·Oracle Workstations: Windows · macOS Workstations Windows · macOS remote session console session outbound tunnel RDP · SSH rotate rotate elevation request policy enforcement © Cohash · cohash.com
use cases

Typical BeyondTrust projects

The work teams usually bring us, and the platforms BeyondTrust has to talk to while we do it.

  1. BEY-01 You're on Password Safe 24.x and support is running out common request
  2. BEY-02 Nobody can say for sure that the self-hosted Remote Support appliance got the BT26-05 patch. It sits on the internet edge. common request
  3. BEY-03 Vendors still connect over VPN with shared accounts common request
  4. BEY-04 Users keep local admin rights because removing them caused tickets common request
  5. BEY-05 Service account rotation keeps breaking scheduled tasks. So it's been switched off. common request
  6. BEY-06 Developers run coding agents with admin rights on their laptops. Nobody owns a policy for it. common request
BeyondTrust · connected platforms
SailPointSaviyntOktaMicrosoft Entra IDHashiCorp Vault
you keep

What a BeyondTrust engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • runbook01

    A 24.x to 26.x upgrade runbook with real timings from the rehearsal. Next time your team runs it without us.

    yours to keep
  • document02

    A service account dependency map: every service, task and app pool that uses each account

    yours to keep
  • guide03

    Rotation policies for each type of managed system. When a rotation fails, someone gets told.

    yours to keep
  • document04

    The Jumpoint layout for PRA, one per network zone, with a checklist for onboarding each new vendor.

    yours to keep
  • plan05

    EPM policies written from audit-mode data, and a plan for which groups go first.

    yours to keep
  • plan06

    A pilot plan for AI Agent Security. The exit criteria get agreed before anyone installs it.

    yours to keep
talent and delivery · beyondtrust

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
roles we staff
  • BeyondTrust Password Safe engineer
  • Privileged Remote Access engineer
  • Endpoint Privilege Management engineer
  • BeyondInsight administrator
  • PAM architect
due diligence · beyondtrust

Questions to ask any partner, including us.

Put these to anyone bidding on your BeyondTrust work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Before rotation goes live, how will you find every place a service account's password is used?

    Rotation that updates the vault but misses one scheduled task or IIS app pool breaks a service overnight. The dependency map is the real work, and it has to be checked host by host.

  2. Q2

    Can you rehearse our move to 26.x on a copy of production before the window?

    Jumping from 24.x touches the database, the API and every integration. A timed rehearsal shows how long the window must be and which scripts break.

  3. Q3

    How will vendors reach our network through PRA without a VPN account?

    With a Jumpoint in each network zone, a vendor can only reach the systems approved for that session. Whether that holds depends on where the Jumpoints sit and how approvals are routed, and that deserves its own design review.

  4. Q4

    What audit-mode data will you collect before EPM starts blocking anything?

    Elevation rules built from guesses are what flood the helpdesk. A few weeks of real application use per department gives the rule set something to stand on.

  5. Q5

    Our developers already run coding agents. How would you pilot AI Agent Security on their laptops?

    It ran as a private beta from mid-2026, and the wider launch only came in October. Scope it as a pilot with exit criteria first, and don't let auditors treat it as a production control until it has run on your own fleet.

01When does our Password Safe version go out of support?

BeyondTrust's table puts 24.2.x out of support since September 2026 and 24.3.x at December 2026, with support ending on the last day of the month. Look up your exact build in the support life cycle page before you pick a date, and leave yourself time for a rehearsal.

02Is our self-hosted BeyondTrust Remote Support still exposed to the BT26-05 flaw? What should we check?

If you run Remote Support yourself on 26.2.3 or earlier and haven't applied BT26-05-RS, yes. Hosted sites were patched by BeyondTrust. Appliances older than 24.3.1 need an upgrade before the patch will go on. Patch self-hosted PRA as well, then check the appliance logs for sessions nobody asked for.

03Will BeyondTrust upgrade our Remote Support or PRA appliance automatically?

Only if you opt in. Starting with 26.3.1, there's a choice of tracks. Fast Track sites move to 26.3.x in their maintenance window from about mid-January 2027, Standard Track after 27.1 ships and Enterprise Track after 27.2. Test your integrations before your track's date comes round.

04How long will it take to get Endpoint Privilege Management onto every laptop?

It depends on device count and how many applications need elevation. We start in audit mode to see what people actually run, then move groups to enforcement in stages so the help desk isn't flooded.

05Can BeyondTrust control AI agents on our laptops?

Yes, that's the job of AI Agent Security. BeyondTrust said it would first sell it as an add-on to Endpoint Privilege Management, it was in private beta from mid-2026, and BeyondTrust launched it for Windows and macOS in October. We'd still pilot it next to your current EPM policies before trusting it.

06Do you also work with CyberArk and Delinea?

Yes, we work on all three. If you're still choosing, we'll line them up against your own systems, your hosting rules and how big the team running it will be.

07What drives the cost of a Password Safe project?

Mostly the number and variety of managed systems, how many service accounts have dependencies to map, and how many network zones need Jumpoints. Licensing is priced separately by BeyondTrust. We size the work after a short inventory of systems and accounts.

services

Related services

Projects on BeyondTrust usually end up touching one of these, so they're worth a look.

you are hereBeyondTrust
fact-checked Checked against vendor and official documentation last checked 2026-11-03 content fingerprint 0b64c7af
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team BeyondTrust is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it