Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
privileged access

Delinea Secret Server, plus the runtime controls StrongDM brought.

We implement and upgrade Delinea Secret Server and connect it to the Delinea Platform. Delinea's StrongDM acquisition added runtime authorization, and we set that up for admins and AI agents alike.

Talk to a Delinea engineerWhat changed recently
platform dossierDelineaPrivileged access
On-prem target
Secret Server 12.3.000002 (Delinea's fix for CVE-2026-115829 is 12.3.1)
Reported attacks
CVE-2026-19117, per Delinea's Trust Center
Acquisition
StrongDM, completed 5 Mar 2026
AI agent controls
Runtime authorization on the Delinea Platform, 30 Jul 2026
release watch
  • Secret Server login bypass scored CVSS 9.930 Oct 2026
  • Secret Server 12.3.000001 and 12.3.00000223 Oct 2026
connects with
in short·15-second read

We implement Delinea Secret Server, Privilege Manager and the Delinea Platform, and set up runtime authorization for AI agents.

If you run Secret Server on-prem at 12.2.7 or earlier, upgrade now: Delinea lists a 9.9 login bypass fixed in 12.3.1, and customers have reported attacks through an older flaw.

you probably need this if
  • Secret Server folders grew one team at a time and now the permissions differ in every branch.
  • A rotation failed halfway and left a service running with the old credential.
  • Your AI agents are hitting production databases with long-lived credentials sitting in config files.
terms on this page Service accountdefinitionA non-human account that software signs in with. Shared ones tend to pick up years of extra permissions.explained in a field note →RotationdefinitionChanging privileged passwords automatically, on a timer or after each checkout. If one leaks, it soon stops working.explained in a field note →Session recordingdefinitionRecording what someone does during a privileged login, as video or keystrokes. You watch it later when an auditor asks or something breaks.explained in a field note →
Ask an engineer facts checked 2026-11-06
how it runs
  1. 01Secret Server review
  2. 02Folder and policy redesign
  3. 03Platform connection
  4. 04Runtime authorization pilot
  5. 05Rollout and handover
you keep
  • A folder layout and secret templates your teams can actually live with, and the permission inheritance rules written down
  • Where each distributed engine goes, written out site by site, so you can see the placement before anything gets installed.
  • Heartbeat and rotation failures written up, with the riskiest fixes at the top
+ 2 more documents
who does it
Delinea Secret Server engineerDelinea Platform engineerPrivilege Manager engineer Delinea Platform Certification
platforms
proof
2 case studies on this
background
CYBERARK (IDIRA) Deep vault andsessions Now Palo Alto SaaS or self-hosted DELINEA / BEYONDTRUST SaaS-first options Strong remote access Different licenceunits
field note · 19 minCyberArk, Delinea or BeyondTrust? Choosing PAM now that CyberArk is Idira
delinea · release timeline
  1. 05 Mar 2026 StrongDM acquisition completed StrongDM's just-in-time runtime authorization is now part of the Delinea Platform. Delinea pitches it at both people and non-human identities, AI agents included.
  2. 30 Jul 2026 Runtime authorization for AI agents Policies are set per tool call, and each one allows the action, blocks it or sends it to a person. Anyone reviewing later can see every single action in the audit records. It's on the Delinea Platform now.
  3. 1 Oct 2026 Customers report attacks through the FIDO2 bypass Delinea's Trust Center says customers have seen active exploitation of on-prem servers through CVE-2026-19117, scored 9.8. 12.2.7 fixes that one but carries the newer flaws above, so don't stop there. After you upgrade, look at the FIDO2 registrations on admin accounts.
  4. 23 Oct 2026 Secret Server 12.3.000001 and 12.3.000002 Check your discovery scans before you upgrade. From 12.3.000001, an Active Directory scan stops at 500,000 objects, so bigger scans fail until someone raises the limit or narrows the scope. That build also brought a Migration Readiness Report and a Manage TOTP permission that doesn't need full Edit access. 12.3.000002 came two days later to fix a sign-in problem.
  5. 29 Oct 2026 Privilege Manager agent flaw scored CVSS 8.7 If you run Privilege Manager, check your Windows agent builds, on-prem or cloud. Delinea says CVE-2026-92744 can let a remote attacker run code as LocalSystem under certain conditions. Agents at 12.0.5796 or older go to 12.0.5804, and newer ones go to 13.0.2064. For cloud customers and on-prem customers who can't upgrade, Delinea's release notes cover mitigation.
  6. 30 Oct 2026 Secret Server login bypass scored CVSS 9.9 On-prem 12.2.7 and earlier are affected by CVE-2026-115829, where someone gets past the first login step and signs in on the second factor alone. Two sibling flaws came with it, scored 9.4 and 8.7. Delinea names 12.3.1 as the fix, and we'd go to 12.3.000002, because the first 12.3 build sent Windows-auth users on two-factor back to the login page.
  7. today · Nov 09, 2026
  8. no date yetFall (Q4) 2026 Platform releaseCommand Relay won't install PowerShell for you, and every Windows host running the Platform Engine with that workload needs 7.6 or later. Someone has to put it there. Entra ID MFA is also GA now as a challenge for endpoint login and privilege elevation.
  9. no date yetWinter (Q1) 2026 releaseTwo pieces went GA. Remote Password Pre-Validation in Secret Server, and Non-Human Identity support for Microsoft Entra.
the story · delinea estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Delinea estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • Secret Server folders grew one team at a time and now the permissions differ in every branch.
    • A rotation failed halfway and left a service running with the old credential.
    • Your AI agents are hitting production databases with long-lived credentials sitting in config files.
  2. chapter 02 · what we change

    How we solve it

    • Secret Server implementation and upgrades
    • Delinea Platform adoption
    • Session recording and remote access
    • Privilege Manager
    • Runtime authorization for AI agents
    • Service account governance
  3. chapter 03 · how it runs

    Our approach

    • Secret Server review
    • Folder and policy redesign
    • Platform connection
    • Runtime authorization pilot
    • Rollout and handover
  4. chapter 04 · where you end up

    What changes

    • A heartbeat failure is now worth someone's time.
    • The agents no longer hold the Postgres password or the SSH key.
    • A folder layout and secret templates your teams can actually live with, and the permission inheritance rules written down
    • Where each distributed engine goes, written out site by site, so you can see the placement before anything gets installed.
what we do

Our Delinea work

6 kinds of Delinea work, each run by engineers who have done it on live tenants.

  1. Folders, secret templates, rotation and heartbeat configured, with distributed engines placed where they can reach the target systems.

  2. Secret Server instances connected to the Delinea Platform, with identity providers and access policies consolidated in one place.

  3. Proxied RDP and SSH sessions recorded, with launchers configured for the tools your admins actually use.

  4. Local admin rights removed from workstations, with elevation policies built from observed usage.

  5. Agent connections to databases, SSH hosts, Kubernetes clusters and cloud consoles authorized per action, with credentials injected for the task and revoked when it ends.

  6. Service accounts discovered, owners assigned, and rotation turned on in stages so nothing breaks overnight.

capability 01 / 06in production

Secret Server implementation and upgrades

Folders, secret templates, rotation and heartbeat configured, with distributed engines placed where they can reach the target systems.

talk to an engineer about this →
capability 02 / 06in production

Delinea Platform adoption

Secret Server instances connected to the Delinea Platform, with identity providers and access policies consolidated in one place.

talk to an engineer about this →
capability 03 / 06in production

Session recording and remote access

Proxied RDP and SSH sessions recorded, with launchers configured for the tools your admins actually use.

talk to an engineer about this →
capability 04 / 06in production

Privilege Manager

Local admin rights removed from workstations, with elevation policies built from observed usage.

talk to an engineer about this →
capability 05 / 06in production

Runtime authorization for AI agents

Agent connections to databases, SSH hosts, Kubernetes clusters and cloud consoles authorized per action, with credentials injected for the task and revoked when it ends.

talk to an engineer about this →
capability 06 / 06in production

Service account governance

Service accounts discovered, owners assigned, and rotation turned on in stages so nothing breaks overnight.

talk to an engineer about this →
typical situations

Delinea situations we walk into

We pieced these together from Delinea situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

Heartbeat failing on a third of secrets, so nobody trusts rotation

composite · not a client story
  1. Beforethe situation

    One distributed engine site serves three data centers for a Secret Server that's just been connected to the Delinea Platform. About a third of secrets fail heartbeat. Admins still keep password copies in a shared spreadsheet.

  2. What we dothe work

    We sort heartbeat failures by cause: a blocked firewall path here, a wrong template or a retired host there. Engines go into each site and dead secrets get deactivated. Remote Password Pre-Validation is switched on last, so a rotation stops before it changes a password in some places but not others.

  3. Afterwhere you end up

    A heartbeat failure is now worth someone's time. Nobody babysits rotation any more, and the shared spreadsheet has a date on which it gets deleted.

case file 02

Coding agents still holding a database password nobody rotates

composite · not a client story
  1. Beforethe situation

    An engineering group gave its AI coding agents a read-write Postgres account and a shared SSH key so they could run migrations and debug staging. Those credentials never rotate, and nobody can say which agent ran which command.

  2. What we dothe work

    We route agent connections through Delinea's runtime authorization and inject short-lived credentials per task. Policies per action allow, block or escalate each request to a person, and anything writing to production gets escalated. Session records go to the SIEM.

  3. Afterwhere you end up

    The agents no longer hold the Postgres password or the SSH key. A migration against production waits for a person to approve it, and the SIEM shows which agent ran each command for which task.

case studies

Delinea case studies

All case studies
modernization Privileged access

Centrify alternatives, and how we untangle Server Suite zones

Untangling Centrify and Delinea Server Suite zones, UID maps and dzdo roles, and moving Linux and Windows servers to a server identity model you can run.

read the case study
migration Privileged access

Delinea Secret Server on-premises to the Delinea Platform

Getting Secret Server off on-premises hosts and onto the Delinea Platform while templates, engines and integrations keep working.

read the case study
approach

How a Delinea engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Secret Server review

    We look at how folders and permissions are laid out, which secret templates you use, where rotation and heartbeat fail, and where the distributed engines sit. Then we rank the fixes.

  2. step 02

    Folder and policy redesign

    We agree a folder and role model with your teams and move secrets into it. Heartbeat has to run clean before rotation is turned on, template by template.

  3. step 03

    Platform connection

    We hook Secret Server up to the Delinea Platform and consolidate identity providers there, which leaves one place to set access policy.

  4. step 04

    Runtime authorization pilot

    We pilot with one agent or admin group and one target, a database or a Kubernetes cluster, through runtime authorization. Then we check per-action policy, the just-in-time credentials and what ends up in the audit records.

  5. step 05

    Rollout and handover

    We add the rest of the systems in waves and roll out Privilege Manager policies group by group, then leave the runbooks with your team.

ai on delinea

Where AI fits on Delinea, and where it needs guardrails.

Delinea bought StrongDM in March 2026 and in July shipped runtime authorization for AI agents on the Delinea Platform. Each tool call can be allowed, blocked or escalated to a human, with action-level audit records. For engineering teams this replaces long-lived database and SSH credentials held by agents with per-action checks.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Delineadoes the work

Delinea's product docs don't list an MCP server. An MIT-licensed server for the Secret Server and Platform APIs is published under the DelineaXPM GitHub organization and keeps secret values out of model context. Put it behind your identity provider with TLS, scoped accounts and approval for writes.

Runtime authorization for AI agents

Each agent tool call against a database, SSH host, Kubernetes cluster or cloud console goes through policy. We start small (one agent group, one target), write allow, block and escalate rules, and widen coverage after the audit records look right.

Non-Human Identity support for Microsoft Entra

The Winter 2026 release made Entra non-human identity support GA. So we can bring service principals and agent identities from Entra into Delinea, and their secrets get owners and rotation.

Secrets out of agent configuration

Agents often carry passwords in their config files. We move those into Secret Server and give the agents short-lived access. Leak a config and there's nothing reusable in it.

architecture

Follow an admin session and an agent's action through Delinea

Admins start recorded sessions from Secret Server, and a distributed engine in each network handles rotation and heartbeat. Agent traffic takes the other path through the Delinea Platform, where runtime authorization checks each action before it runs and injects short-lived credentials for databases, clusters and cloud consoles.

Follow an admin session and an agent's action through Delinea Admins start recorded sessions from Secret Server, and a distributed engine in each network handles rotation and heartbeat. Agent traffic takes the other path through the Delinea Platform, where runtime authorization checks each action before it runs and injects short-lived credentials for databases, clusters and cloud consoles. 01 · REQUESTERS 02 · DELINEA 03 · TARGETS SAML · OIDC launch session per-action check rotation jobs rotate · heartbeat just-in-time creds just-in-time access just-in-time access Identity provider Entra ID · Okta Admins RDP and SSH launchers AI agents tool calls to infrastructure De Delinea Platform policy · runtimeauthorization De Secret Server vault · rotation ·heartbeat Distributed engines one per network segment Servers Windows · Linux Databases PostgreSQL · SQL Server Kubernetes clusters kubectl sessions Cloud consoles AWS · Azure · GCP © Cohash · cohash.com
01 · REQUESTERS02 · DELINEA03 · TARGETS Identity provider: Entra ID · Okta Identityprovider Entra ID · Okta Admins: RDP and SSH launchers Admins RDP and SSHlaunchers AI agents: tool calls to infrastructure AI agents tool calls toinfrastructure Delinea Platform: policy · runtime authorization DelineaPlatform policy ·runtimeauthorization Secret Server: vault · rotation · heartbeat SecretServer vault ·rotation ·heartbeat Distributed engines: one per network segment Distributedengines one per networksegment Servers: Windows · Linux Servers Windows · Linux Databases: PostgreSQL · SQL Server Databases PostgreSQL · SQLServer Kubernetes clusters: kubectl sessions Kubernetesclusters kubectl sessions Cloud consoles: AWS · Azure · GCP Cloud consoles AWS · Azure · GCP SAML · OIDC launch session per-action check rotate · heartbeat just-in-time creds just-in-time access just-in-time access © Cohash · cohash.com
use cases

Typical Delinea projects

The work teams usually bring us, and the platforms Delinea has to talk to while we do it.

  1. DEL-01 Secret Server on-prem is still on 12.2.7 or earlier, and nobody has booked the upgrade common request
  2. DEL-02 Secret Server grew folder by folder with no consistent permissions common request
  3. DEL-03 A rotation sometimes leaves some systems on the old password common request
  4. DEL-04 AI agents reach your databases on long-lived credentials sitting in config files common request
  5. DEL-05 You run both StrongDM and Delinea and need one plan common request
  6. DEL-06 Workstation users still have local admin rights common request
Delinea · connected platforms
Microsoft Entra IDOktaSailPointSaviyntHashiCorp Vault
you keep

What a Delinea engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • code01

    A folder layout and secret templates your teams can actually live with, and the permission inheritance rules written down

    yours to keep
  • document02

    Where each distributed engine goes, written out site by site, so you can see the placement before anything gets installed.

    yours to keep
  • document03

    Heartbeat and rotation failures written up, with the riskiest fixes at the top

    yours to keep
  • guide04

    Privilege Manager policies based on the elevation requests we actually saw

    yours to keep
  • guide05

    Per-agent runtime authorization policies that spell out allow, block and escalate

    yours to keep
talent and delivery · delinea

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
certifications our engineers hold
  • Delinea Platform CertificationDelinea
roles we staff
  • Delinea Secret Server engineer
  • Delinea Platform engineer
  • Privilege Manager engineer
  • Server PAM engineer
  • Secret Server upgrade and migration engineer
  • PAM architect
due diligence · delinea

Questions to ask any partner, including us.

Put these to anyone bidding on your Delinea work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Where will the distributed engines sit, and can every target be reached from one for heartbeat and rotation?

    If an engine can't reach a target, heartbeat fails quietly. Engine placement per network segment is what separates rotation that works from rotation someone eventually turns off.

  2. Q2

    Now that StrongDM is part of the Delinea Platform, which of its features does our contract actually include?

    The acquisition closed in March 2026. If the design is going to depend on runtime authorization, first confirm you've actually bought it. It may not have come with the platform.

  3. Q3

    How do we stop a rotation that changes the password on some systems and misses the rest?

    Half-finished rotation is the classic failure for secrets with dependencies. Remote Password Pre-Validation checks every linked system before anything changes. Someone still has to enable it and test it per secret type.

  4. Q4

    Who approves an escalated agent action in the middle of the night?

    Escalation only works if someone is on call to approve. Otherwise agents stall, and teams quietly widen the policies to keep work moving.

  5. Q5

    If Secret Server stays on-premises, who patches it and on what schedule?

    On-premises keeps credentials inside your network, but upgrades become your team's problem. Someone has to own that trade, with a patch schedule written down.

01Which Secret Server version should we be on right now?

On-prem, 12.3.000002 or later. Delinea's advisory names 12.3.1 as the fix for the 9.9 login bypass, and it links the 12.3.000001 notes, so we read those as the same build. The next build fixes a sign-in loop for Windows-auth users on two-factor, so go straight to it. September hotfixes and 12.2.7 don't cover these flaws.

02Is Delinea Secret Server being attacked?

One flaw is, going by Delinea. Its Trust Center says customers have reported active exploitation of CVE-2026-19117 on on-prem servers. We found no such reports for the October flaws, but the worst of those scores 9.9, so don't wait. After you upgrade, check FIDO2 registrations on admin accounts. Disabling FIDO2 won't clear a registered key, but a two-factor reset will.

03What did the StrongDM acquisition change?

The deal closed on 5 March 2026, and StrongDM's just-in-time runtime authorization came with it. Nobody needs standing rights with that, since access gets decided when someone asks to run an action. In July 2026 Delinea made it available for AI agents on the Delinea Platform too.

04Is Secret Server better on-premises or in the cloud for us?

Start with your hosting rules and the number of distributed engines you'd need, then ask who will patch the servers. The cloud version takes upgrades off your plate. If credentials have to stay inside your network, on-premises still makes sense.

05What does Remote Password Pre-Validation do?

It's a pre-flight check for rotation, generally available since Delinea's Winter 2026 release. Each system tied to the secret gets tested for health and connectivity, and one failure stops the whole rotation. You won't end up with a password that changed on some systems and not the rest.

06Do you also work with CyberArk and BeyondTrust?

Yes, both. If you're still deciding, we compare them against your actual systems and hosting rules, and against the team that would run the tool day to day.

07Can you migrate us to Secret Server from another vault?

Usually. We export secrets and folder structures from the old tool, map them to Secret Server templates and permissions, and test heartbeat on each secret type before cutting over. Integrations that call the old tool's API need rework, so we inventory those first.

services

Related services

Projects on Delinea usually end up touching one of these, so they're worth a look.

you are hereDelinea
fact-checked Checked against vendor and official documentation last checked 2026-11-06 content fingerprint 8b2b033c
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team Delinea is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it