- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Symantec PAM
Your admins share root and vCenter passwords, and scripts hold the rest. One leaked login shouldn’t unlock everything — Symantec PAM vaults privileged credentials, records admin sessions, narrows what root can run and serves secrets to scripts — Broadcom’s ex-CA product, quote-only, and yours to run on servers in India.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Broadcom platform family
This page covers Symantec PAM — Broadcom’s privileged access manager. The rest:
Quick facts
30-second orientation- Product
- Symantec Privileged Access Management: vault, recorded sessions, super-user control, app secrets
- Maker
- Broadcom Inc., Palo Alto; run by the Identity Management Security Division under Clayton Donley
- Lineage
- A CA Technologies product; Broadcom closed that purchase on 5 November 2018, for about US$18.9B
- Status
- The 4.x line is current; NVD lists 3.4.6, 4.1.0–4.1.8 and 4.2.0 as hit by three 2025 CVEs
- Price
- No list price from Broadcom or a reseller; every deal is quoted through a partner
- VMware tie-in
- Guards vCenter and guest systems; paired with the Identity Security Platform as Identity Security for VCF
- Brand
- Still Symantec-branded, but outside the Enterprise Security Group that runs Symantec and Carbon Black
- Analysts
- No Gartner PAM placement: Broadcom was not evaluated in the 2025 Magic Quadrant, per vendor lists
- India
- Broadcom offices in Bangalore, Hyderabad and Pune; self-hosting keeps the vault in your own data centre
- In India via
- TechBag — target inventory, patch-level check, quote in INR with GST, first recorded-session test
Understand privileged access management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is privileged access management?
A vault holds the most powerful passwords, and every use of them is brokered and recorded.
Shared admin passwords and scripts with secrets vs one PAM product — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Shared admin passwords, secrets in scripts | Symantec PAM |
|---|---|---|
| Where admin passwords live | Spreadsheets, wikis and runbooks | The PAM credential vault |
| What root may do | Anything, once logged in | What fine-grained super-user rules allow |
| Passwords in scripts | Hard-coded in code and config | Served by PAM secrets management |
| Proof for the auditor | Login logs stitched together | Recorded privileged sessions to replay |
| vCenter administrator access | A shared login known to many | Vaulted and brokered through PAM |
| What it is NOT | — | A published price, or a Gartner PAM placement |
The cheapest test is a narrow pilot: one team’s servers and vCenter accounts, connected only through PAM, with one recorded session replayed for your auditor.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Vault
Privileged account passwords and keys move out of spreadsheets and runbooks into the PAM vault, and administrators reach targets through PAM rather than keeping private copies.
Sessions
Sessions opened through PAM are recorded, so an auditor or investigator can replay what an administrator did on a target; Broadcom demonstrated the feature in a 2020 video.
Super-user
Beyond deciding who may log in, PAM narrows what a super-user may run once on a server, so one shared root or administrator account stops meaning unlimited power.
Analytics
Threat analytics watch privileged activity for behaviour that looks wrong, while secrets management serves credentials to applications and scripts so none sits hard-coded in them.
A vault, recorded sessions and super-user rules on servers you run — with analytics and script secrets layered on top.
Nine capabilities. Vault, control, watch.
Symantec PAM puts every privileged password, session and script secret behind one Broadcom product you run yourself.
Passwords out of runbooks
Admin, root and service-account credentials move into the PAM vault instead of shared sheets, wikis and handover emails.
No passwords in scripts
Secrets management hands credentials to applications and scripts, so database and service passwords leave code and config files.
VCF credentials under guard
Broadcom documents PAM protecting VMware vCenter and the guest systems beneath it, the subject of a December 2025 video.
Every privileged hop via PAM
Zero-trust access is on Broadcom’s list of PAM controls: privileged connections pass through PAM instead of going straight to a target.
Root, narrowed
Fine-grained super-user control limits what a privileged login may do on a server, not only whether it may log in at all.
Identity Security for VCF
Broadcom pairs PAM with its Identity Security Platform as Symantec Identity Security for VCF, introduced in February 2026.
Sessions you can replay
Privileged sessions are recorded, so a reviewer can see what was done on a target, by which administrator and when.
Odd privileged use flagged
Threat analytics review privileged activity and raise behaviour that looks out of pattern for a person to investigate.
Evidence in one place
Vault access, recorded sessions and analytics together form the trail an auditor asks for when reviewing privileged access.
Watch Symantec PAM in action
Guarding VMware Cloud Foundation credentials, the Identity Security for VCF bundle, and 2020 demos of the credential vault and session recording.
Securing VMware Cloud Foundation Credentials with Symantec PAM
How PAM takes vCenter and guest-system credentials under control in a VMware Cloud Foundation estate.
Introducing Symantec Identity Security for VCF
The bundle that pairs PAM with Broadcom’s Identity Security Platform for VCF environments.
Symantec PAM - Privileged Credential Vault
A 2020 walk-through of the credential vault; the screens predate the current 4.x line.
Symantec PAM - Session Recording
A 2020 demo of recording and replaying privileged sessions; check today’s interface in a live demo.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Privileged passwords leak through shared logins and scripts. Symantec PAM vaults them and records every use.
Here’s what genuinely sets it apart — and exactly where it stops.
People, scripts and super-users in one product
Many PAM buyers end up with a vault for people and another tool for passwords baked into scripts. Symantec PAM lists both: a vault and recorded sessions for administrators, secrets management for apps and scripts, plus fine-grained super-user control and threat analytics.
Built to guard a VMware Cloud Foundation estate
Because Broadcom also owns VMware, PAM has a documented path for vCenter and the guest systems under it, and Symantec Identity Security for VCF pairs it with the Identity Security Platform. If vCenter administrator logins are your open audit finding, that tie-in is the reason to shortlist it.
In India by deployment, not by promise
No Broadcom-hosted Indian region is established for PAM, so the dependable route is to run it yourself: the vault and its session recordings then sit in your own Indian data centre. Broadcom lists offices in Bangalore, Hyderabad and Pune; buying goes through partners on quote.
Where it stops
There is no price list. Three NVD-listed CVEs from January 2025, scored 8.7 to 8.9, affected 3.4.6, 4.1.0–4.1.8 and 4.2.0; secondary trackers report the fix in 4.2.1. Broadcom has no Gartner PAM placement, no named Indian customer is published, and the newest vault demo dates from 2020.
The numbers behind the platform
What your Symantec PAM rollout looks like
List every privileged account
Inventory admin, root, service and vCenter accounts, note who uses each, and flag the scripts that hold passwords.
Check builds, then get the quote
Confirm any existing PAM is past the 2025 CVE range, choose where it will run in India, and get an INR quote with GST.
Vault one server group
Install PAM on your own servers, vault one team’s server and vCenter accounts, and have admins connect only through it.
Record sessions, narrow root
Turn on session recording for the pilot targets, write super-user rules for shared root, and replay a session for audit.
Move scripts and switch on analytics
Swap hard-coded passwords for secrets calls, enable threat analytics, and plan the wider rollout by risk of each target.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Putting our vCenter administrator logins into Symantec PAM closed the audit point that had stayed open for two cycles.”
“Super-user rules let us keep one shared root login on the billing servers but cap which commands it can actually run.”
“Nightly batch jobs had database passwords in plain text. Secrets management removed them, though every script needed a rewrite.”
“The January 2025 CVEs meant an unplanned upgrade for us. Subscribe to Broadcom’s advisories before you go live.”
“A replayed session settled a dispute with an outsourced support firm in an hour; we could see exactly what was changed.”
“Three partner calls before a number, and no price list to check it against. Leave procurement plenty of time.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the privileged access management market — tap any vendor to see why it sits where it does.
TechBag Privileged Access Management Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; no Gartner PAM placement in 2025.
India Fit × Control Breadth
The grid nobody publishes — how well the vault can be bought, hosted and supported in India vs how many privileged controls it covers.
Vault, sessions, super-user, analytics, secrets; self-run in India.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Symantec PAM vs the privileged access field
Against CyberArk (Idira), BeyondTrust Password Safe, ARCON PAM, One Identity Safeguard and Securden Unified PAM — on deployment, targets, sessions, secrets, price, India and analyst standing.
| Dimension | Symantec PAM | CyberArk (Idira) Privileged Access Manager | BeyondTrust Password Safe | ARCON PAM | One Identity Safeguard | Securden Unified PAM |
|---|---|---|---|---|---|---|
| What it is | Ex-CA PAM suite | The reference vault | Vault with discovery | India-built PAM suite | Appliance-based PAM | All-in-one PAM |
| Deployment | Self-run; SaaS unclear | Self-hosted or SaaS | On-prem, cloud, SaaS | On-prem common in BFSI | Hardened appliance | On-prem or PAMaaS |
| Targets covered | Servers, vCenter, apps | Six target types | Servers to DevOps | Five target types | Servers, network, DB | Includes SaaS admins |
| Session recording | Recorded sessions | Isolate and record | Live view, keystrokes | Control and record | Proxy plus playback | Every session recorded |
| App and script secrets | Apps and scripts | Secrets Manager apart | A2A passwords | Partial; not CI/CD | Partial coverage | Stored and served |
| Least privilege and JIT | Super-user rules | Just-in-time | Time-limited access | JIT privileges | JIT and approvals | Grant, then revoke |
| Behaviour analytics | Threat analytics | Not stated here | Insights sold apart | ITDR in the suite | Session analytics | Not stated here |
| Pricing model | Quote via partners | Per user or account | Per managed asset | Per user and target | Per user or asset | Per user, all-in |
| Published entry price | Not published | ~$1,800–12,000 reported | $157/asset/yr (GSA) | Quote in INR | No public price | Free 5-user vault |
| Included vs add-on | VCF bundle optional | Extra SKUs for more | PRA and EPM separate | MFA, SSO, JIT inside | Two modules | EPM in the platform |
| Platform and lock-in | Broadcom identity stack | Idira platform core | Pathfinder platform | ARCON family | Identity Manager pair | Mid-market scale |
| India data and channel | Self-host in India | Self-hosted option | On-prem or SaaS | Mumbai-built, INR | Appliance on site | India-built, on-prem |
| Analyst standing | No Gartner PAM entry | Gartner MQ Leader | Gartner PAM Leader | Challenger, 2025 | Gartner-recognised | None cited |
| Best fit | Broadcom and VCF shops | Large regulated estates | Few admins, many servers | Indian BFSI | PAM plus governance | Mid-market, fast start |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Symantec PAM if…
- ✓vCenter and the guest systems under it are where your privileged-access audit findings keep landing
- ✓You want one product for administrator vaulting, recorded sessions and the credentials hidden in scripts
- ✓You already buy Broadcom identity products and would rather run PAM yourself, on servers in India
Compare alternatives if…
- ✓You want an analyst-backed shortlist — CyberArk and BeyondTrust are Gartner PAM Leaders, and ARCON a 2025 Challenger
- ✓You need a price before a sales call — BeyondTrust’s GSA schedule and Securden’s free five-user vault give you a start
- ✓You want the vendor, the reports and the support desk in India — ARCON is built and supported from Mumbai
Do not expect…
- ✓A Broadcom list price for PAM, or any reseller figure to benchmark a quote against
- ✓A Gartner PAM Magic Quadrant placement — Broadcom was not evaluated in 2025, per published vendor lists
- ✓Westcon-Comstor’s 2024 India distribution deal to cover PAM by default — identity sits outside that security group
Symantec PAM is one of 29 privileged access management products TechBag carries. The Privileged Access Management guide narrows them to a shortlist and shows the reasoning. →
What do unmanaged privileged accounts cost you?
Drag the sliders (privileged accounts; administrator-hour cost). Estimates model the time spent sharing, changing and tracking privileged passwords and gathering audit evidence at an assumed 1.5 hours per account a year, with 70% of it removed by a vault, recorded sessions and script secrets. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: Broadcom prints no list price and no licence unit for Symantec PAM, and no reseller list figure for it was found, so every deal is a partner quote. Symantec Identity Security for VCF, which pairs PAM with the Identity Security Platform, is quoted the same way. TechBag counts your privileged accounts and targets first, then gets the quote itemised in INR with GST.
Symantec PAM
Best for vaulting, sessions and script secrets
- Quote-only through Broadcom partners
- Licence unit not published; ask for it
- Self-host on your own servers in India
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Symantec Identity Security for VCF
Best for VMware Cloud Foundation estates
- PAM plus the Identity Security Platform
- Quote-only, like PAM on its own
- Covers vCenter and guest-system credentials
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Do you know every admin, root, service and vCenter account, and who owns each one before the vault goes in?
If you already run Symantec PAM, is it past 3.4.6, 4.1.0–4.1.8 and 4.2.0, the builds hit by the January 2025 CVEs?
Where will PAM run: your own Indian data centre, a colocation site, or a cloud account you control in India?
Has Broadcom confirmed connectors for every target you need — network gear, databases and cloud consoles included?
Which applications and scripts hold passwords today, and who will rework each one to call PAM secrets instead?
How long must session recordings be kept for your auditors, and what storage will that retention consume?
Which partner sells Broadcom identity products to you in India, given that the 2024 Westcon deal covers the security group?
What is the licence unit — users, accounts or servers? Ask for the quote in INR with GST and the support term spelt out.
Questions buyers ask
Ready to evaluate Symantec PAM?
Count your privileged accounts and the hours they cost first, or let a TechBag advisor scope a pilot that vaults one server group and its vCenter logins.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.