# Most PAM projects stall not because the product failed, but because nobody could get the accounts into it. *Privileged Access Management — a TechBag decision guide. Last reviewed 2026-10-03.* > A PAM platform takes the credentials that can change or destroy everything — domain administrators, root, network gear, database owners, cloud consoles, and the service accounts no human ever logs into — out of people’s hands and into a vault that brokers, records and rotates them. **The checkable fact:** CyberArk sells the human vault and Secrets Manager separately, because an application requesting a credential ten thousand times an hour is not a person checking one out. Most estates buy the first and discover the second two years later. - Canonical: https://www.thetechbag.com/browse/identity-access/privileged-access-management - Category: [Identity & Access](https://www.thetechbag.com/browse/identity-access) - Products compared: 30 ## What privileged access management actually is A vault, a broker and a recorder. The **vault** holds the credentials for accounts that can change or destroy your estate, rotating them so nobody memorises one. The **broker** gives a named person time-limited use of an account without ever showing them the password — ideally just-in-time, so no standing privilege exists between requests. The **recorder** keeps a replayable record of what was done, which is the part auditors ask for. The variable nobody prices is the **machine half**. Service accounts, API keys, pipeline credentials and the tokens AI agents now carry outnumber your administrators many times over, and a vault designed for humans checking credentials out is a poor fit for an application requesting one unattended, constantly. Read the [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) for who gets in at all, and the [identity governance guide](https://www.thetechbag.com/browse/identity-access/identity-governance) for proving the access granted was correct. **The most common mis-purchase.** Endpoint privilege management bought as PAM. PEDM removes local administrator rights from laptops and elevates applications — it vaults nothing. If the audit finding was about server, database or network credentials, **PEDM does not answer it**, and three products on this page are PEDM. ## PAM vs PIM vs PEDM vs secrets management Four terms sold by the same vendors, often in the same slide. They are adjacent scopes, not tiers — each answers a different question, and buying one for another is the most expensive mistake in this category. ### PAM — privileged access management The umbrella and the vault: store, rotate and broker credentials for accounts that can change or destroy things, record the sessions, prove it to an auditor. Answers: who used the domain admin account at 2am, and what did they do? This is the main purchase, and the one the regulators' language points at. ### PIM — privileged identity management The lifecycle of privileged identities: which accounts are privileged, who is eligible, for how long, with approval and expiry. Microsoft's Entra PIM made the term familiar — eligible rather than permanent roles, activated on request. Overlaps PAM heavily; where PAM vaults the credential, PIM governs the entitlement. ### PEDM — privilege elevation and delegation management No vault at all. An agent on the endpoint removes standing local administrator rights and elevates named applications or commands instead. Answers: how do we take admin away from laptops without breaking the software? A different budget, a different team, and three products on this page. ### Secrets management The machine half: credentials, API keys and certificates requested by applications, pipelines and containers, unattended and at machine speed. No interactive login, no session to record, no human to approve. A vault for people and a vault for code are different products — CyberArk sells both, separately, and that tells you what you need to know. **These are adjacent scopes, not tiers.** PAM vaults and records, PIM governs the entitlement, PEDM elevates on the endpoint, secrets management serves machines. Most regulated estates need PAM and secrets management, many need PEDM for a separate audit finding, and PIM is often already sitting in a Microsoft licence you own. A product that handles administrators perfectly can be useless for pipelines — that is the machine-identity problem, and it is this category’s real story. ## The decision variables Seven variables decide this purchase. The instrument tests what documentation establishes (platform coverage, secrets capability, deployment, recording, discovery, agent model, India origin); onboarding time, break-glass and storage are prose because the honest answers come from a project plan, not a datasheet. **Deployment model.** On-premises appliance, self-hosted software, or SaaS — decided by regulator expectations as often as by preference. Indian BFSI deployments are still frequently on-prem; ask your compliance team before your architects. **What it can vault.** Windows, Unix and Linux, network devices, databases, cloud consoles, Kubernetes, SaaS administrator accounts. Coverage varies enormously and the gap is always the system you cannot replace. **Session recording and playback depth.** Full searchable video-grade recording, basic activity capture, or none. The audit asks for playback; the storage bill arrives separately. **Secrets management for applications and CI/CD.** The machine-identity cut. Purpose-built brokering for pipelines and containers, credential storage that applications can call, or nothing. Several products here are genuinely thin — marked, never eliminated on. **Just-in-time access vs standing privilege.** Whether privilege exists between requests at all. Every vendor here documents just-in-time in some form; how far it extends beyond the flagship platform is the question. **Agent vs agentless architecture.** Agentless reaches more legacy targets with less deployment friction; agents give deeper control and offline enforcement. Most serious platforms do both. **Onboarding and discovery.** Can it find the privileged accounts nobody told you about? Discovery is the difference between a vault holding fifty accounts and one holding the estate. ## The 30 products Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one. ### CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud) — CyberArk - **Who it's for:** Large and regulated estates that want the reference vault — the deepest platform coverage, the strongest session controls, and an audit story every regulator already recognises. - **The honest limitation:** The most expensive licence here and the heaviest to deploy: reported bands run to $12,000 per privileged user per year at small volumes, and the onboarding project is measured in quarters, not weeks. Secrets management for applications is a separate product (Secrets Manager), not this SKU. - **Price:** ~$1,800–12,000 (≈ ₹1,49,400) — sold as Idira Privileged Access Manager since May 2026 (CyberArk is now a Palo Alto Networks company); per privileged user / year reported — the wide band is the volume curve (small deployments at the top, 1,000+ users near the floor); Self-Hosted and Privilege Cloud are separate SKUs - **Details:** https://www.thetechbag.com/cyberark/cyberark-privileged-access-manager ### CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur) — CyberArk - **Who it's for:** Platform and DevOps teams that need the machine half — secrets for pipelines, containers and applications, rotated and brokered without a human in the loop. - **The honest limitation:** Not a human PAM product: no session recording, no privileged-user workflow. It is the second purchase alongside the vault, and it is priced and deployed as its own project. - **Price:** Quote — sold under Palo Alto Networks’ Idira brand since May 2026 (Idira Secrets Hub is part of it); per application / per secret-consuming workload on quote; Conjur-derived, built for CI/CD pipelines, containers and application-to-application credentials - **Details:** https://www.thetechbag.com/cyberark/cyberark-secrets-manager ### CyberArk Endpoint Privilege Manager — CyberArk - **Who it's for:** Estates removing local administrator rights from laptops without breaking the applications that need elevation. - **The honest limitation:** PEDM, not PAM: it elevates on the endpoint and vaults nothing. Buying it expecting a credential vault for servers and network devices is the most common mis-purchase in this category. - **Price:** Quote — sold as Idira Endpoint Privilege Manager since May 2026 (Palo Alto Networks); per endpoint / year on quote; removes local admin rights on Windows and macOS and elevates per application (PEDM), not a credential vault - **Details:** https://www.thetechbag.com/cyberark/cyberark-endpoint-privilege-manager ### CyberArk Vendor PAM — CyberArk - **Who it's for:** Organisations whose auditors ask who from which supplier touched production, and when — without issuing the supplier a VPN account. - **The honest limitation:** Third-party access only — your own administrators are the main PAM SKU. Priced per vendor, which is cheap at ten suppliers and not at two hundred. - **Price:** Quote — sold under Palo Alto Networks’ Idira brand since May 2026; per external vendor / year on quote; biometric-verified access for third parties with no VPN and no agent on their machine - **Details:** https://www.thetechbag.com/cyberark/cyberark-vendor-pam ### BeyondTrust Password Safe — BeyondTrust - **Who it's for:** Estates that want a full vault with discovery and session management, and prefer paying for the machines they manage rather than the people who log in. - **The honest limitation:** The per-asset meter is cheap for a few administrators over many servers and expensive the other way round; the published figures are a public-sector schedule, not a commercial list. Application secrets are handled, but this is not a CI/CD secrets platform. - **Price:** ~$157 (≈ ₹13,031) — per managed asset / year on the US GSA public-sector schedule (about $1,355 per named user / year on the same list); commercial pricing is a quote — the per-asset meter is the one to model - **Details:** https://www.thetechbag.com/beyondtrust/beyondtrust-password-safe ### BeyondTrust Endpoint Privilege Management — BeyondTrust - **Who it's for:** Estates taking local admin away across a mixed Windows, macOS and Unix fleet with application-level rules rather than blanket elevation. - **The honest limitation:** PEDM again — it removes standing local admin, it does not vault credentials for network devices, databases or cloud consoles. The Unix server coverage is the differentiator against endpoint-only rivals. - **Price:** Quote — per endpoint / year on quote; least privilege and application control for Windows, macOS, Linux and Unix servers (PEDM) - **Details:** https://www.thetechbag.com/beyondtrust/beyondtrust-endpoint-privilege-management ### BeyondTrust Privileged Remote Access — BeyondTrust - **Who it's for:** Teams whose real problem is how administrators and suppliers reach production at all — a brokered, recorded path instead of VPN plus jump box. - **The honest limitation:** Access brokering with credential injection rather than a full enterprise vault: password rotation depth and discovery live in Password Safe, which is the companion purchase. - **Price:** Quote — per concurrent or named user / year on quote; brokered privileged sessions for insiders and vendors with full recording, no VPN; the cloud instance can be hosted in BeyondTrust’s Asia (India – West) region, or run on-prem - **Details:** https://www.thetechbag.com/beyondtrust/beyondtrust-privileged-remote-access ### ARCON Privileged Access Management — ARCON - **Who it's for:** Indian BFSI and regulated estates that want the vault, the auditor's report format and the support engineer in the same country, time zone and currency. - **The honest limitation:** Deepest where its market is: platform coverage and the ecosystem of integrations are narrower than CyberArk's, and Kubernetes-native secrets for CI/CD are not its strength. Quote-only, with no public list to anchor a negotiation. - **Price:** Quote (INR) — per privileged user and per managed target, quoted in INR; Mumbai-built and Mumbai-supported, with reporting shaped for RBI and SEBI CSCRF audits; on-prem is the common BFSI deployment - **Details:** https://www.thetechbag.com/arcon/arcon-pam ### ARCON Endpoint Privilege Management — ARCON - **Who it's for:** Indian estates extending least privilege to laptops and desktops from the same vendor that runs their server vault. - **The honest limitation:** Endpoint elevation only, Windows-centric, and documented scale is smaller than the server-side product's. Not a credential vault. - **Price:** Quote (INR) — per endpoint, quoted in INR; least privilege, application allow-listing and elevation on Windows endpoints - **Details:** https://www.thetechbag.com/arcon/arcon-epm ### ARCON My Vault — ARCON - **Who it's for:** Organisations that want employees' shared and personal business credentials in a managed vault rather than a spreadsheet. - **The honest limitation:** A password manager, not PAM: no session recording, no just-in-time elevation, no discovery of privileged infrastructure accounts. It sits beside the PAM purchase, never instead of it. - **Price:** Quote (INR) — per user, quoted in INR; a personal and team credential vault for business users — passwords, cards, documents — not privileged infrastructure sessions - **Details:** https://www.thetechbag.com/arcon/arcon-my-vault ### Securden Unified PAM — Securden - **Who it's for:** Mid-market and lean enterprise teams that want vault, session recording, discovery and remote access in one all-inclusive per-user number instead of six line items. - **The honest limitation:** No public list price despite the simple meter, and documented deployments are smaller than CyberArk's or BeyondTrust's — flagged rather than ruled out above 1,000 privileged accounts. Application secrets are stored and served, but this is not a CI/CD-native secrets platform. - **Price:** Quote — priced purely on the number of users — no per-target or per-connector add-ons, which is the whole pitch; quote-based, with a free Password Vault starter for up to five users - **Details:** https://www.thetechbag.com/securden/securden-unified-pam ### Securden Endpoint Privilege Manager — Securden - **Who it's for:** Teams removing local admin from laptops on the same all-inclusive commercial model as the Securden vault. - **The honest limitation:** Endpoint elevation only; no infrastructure vault. Documented scale is mid-market. - **Price:** Quote — per endpoint on quote; removes local admin rights and elevates named applications on Windows and macOS - **Details:** https://www.thetechbag.com/securden/securden-endpoint-privilege-manager ### One Identity Safeguard — One Identity - **Who it's for:** Estates that want the vault and the governance platform from one vendor, with behavioural session analytics on privileged sessions. - **The honest limitation:** Sold as an appliance-first platform with a heavier deployment than the SaaS-native options, and quote-only. Its strength is the Identity Manager pairing — standalone, it competes without that advantage. - **Price:** Quote — per user or per asset on quote; a hardened appliance heritage with session analytics, and the tightest coupling to Identity Manager for governance-plus-PAM estates - **Details:** https://www.thetechbag.com/oneidentity/oneidentity-safeguard ### One Identity Cloud PAM Essentials — One Identity - **Who it's for:** Mid-market teams that want brokered, recorded privileged sessions quickly, without an appliance project. - **The honest limitation:** Session access rather than a full enterprise vault: no discovery, no application secrets, and documented deployments are smaller. The fuller product is Safeguard. - **Price:** Quote — per user / month on quote; SaaS-delivered session-based privileged access with recording — no appliance to rack - **Details:** https://www.thetechbag.com/oneidentity/oneidentity-cloud-pam-essentials ### Okta Privileged Access — Okta - **Who it's for:** Okta estates that want just-in-time server and cloud access governed by the same identity, policy and lifecycle as everything else. - **The honest limitation:** Built for cloud and Linux/Windows server access from an Okta-centric estate: network devices, mainframes and the long tail of legacy targets that classic vaults cover are not its ground. It assumes you are already an Okta customer. - **Price:** Bundled ~$17 (≈ ₹1,411) — per user / month inside Okta's Essentials workforce bundle (list) rather than as a standalone vault; ties privileged server and cloud access to the Okta identity you already carry - **Details:** https://www.thetechbag.com/okta/okta-privileged-access ### miniOrange PAM — miniOrange - **Who it's for:** Cost-sensitive Indian estates that want a vault, session recording and web-application privileged access without an enterprise-scale licence or an enterprise-scale project. - **The honest limitation:** The value option, and priced like one: documented deployments are smaller than the enterprise vaults', deep platform coverage (mainframe, exotic network gear) is thinner, and it is not a CI/CD secrets platform. - **Price:** From ~$2.16 (≈ ₹179) — per user / month — miniOrange publishes workforce identity from ₹180 per user per month; PAM is quoted on top and remains the cheapest entry point of the vendors here, in INR, from an India-built vendor - **Details:** https://www.thetechbag.com/miniorange/miniorange-pam ### ARCON Global Remote Access — ARCON - **Who it's for:** Indian estates whose administrators and suppliers work remotely and need a recorded, controlled path into production rather than a VPN account. - **The honest limitation:** Session brokering rather than a full credential vault — rotation, discovery and the enterprise workflow live in ARCON PAM, which is the companion purchase. Documented scale is smaller than the flagship. - **Price:** Quote (INR) — per user, quoted in INR; brokered and recorded remote privileged sessions for distributed teams and third parties, without a VPN into the network - **Details:** https://www.thetechbag.com/arcon/arcon-global-remote-access ### Devolutions PAM — Devolutions - **Who it's for:** Small and mid-sized IT teams that want vaulting, rotation, checkout approval and just-in-time elevation at a price they can read before the first call — self-hosted or in the cloud. - **The honest limitation:** No Gartner Magic Quadrant placement (KuppingerCole 2026 rates it, without a Leader position), no published PAM customer or scale, network, MySQL and Oracle accounts are reset-only, and recordings are video without keystroke search. - **Price:** $50 / user / mo (≈ ₹4,150) — per named user a month, billed annually ($600 a year) — the PAM package, which includes Remote Desktop Manager, the Devolutions Server or Cloud vault and Gateway; Starter Pack $25 for teams of five or fewer; the only published PAM list price here - **Details:** https://www.thetechbag.com/devolutions/devolutions-pam ### OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS) — OpenText - **Who it's for:** Windows, Linux and UNIX estates that want admins to stop sharing root — rules on user, command, host and time decide what each person may run, and every session is brokered, keystroke-logged and recorded. - **The honest limitation:** Coverage is Windows, Linux and UNIX hosts plus AWS IAM roles, so test databases and network gear; it is not a CI/CD secrets platform; the SaaS edition names no hosting region; CVE-2024-12111 (CVSS 8.0) hit releases 4.4 and 4.5. - **Price:** Quote — quote-only; the self-hosted product is sold on a perpetual licence, and the SaaS edition (first released as 25.4 in March 2026) is a paid option on an OpenText Core Identity Foundation subscription - **Details:** https://www.thetechbag.com/opentext/opentext-netiq-privileged-access-manager ### Symantec PAM (Broadcom) — Broadcom - **Who it's for:** Large on-premises estates, often former CA customers, that want vaulting and recorded privileged sessions on their own infrastructure. - **The honest limitation:** Not evaluated in Gartner’s 2025 PAM MQ; just-in-time access and discovery are not documented; patch to 4.2.1 or later. - **Price:** Quote — quoted; the former CA PAM, deployed on premises, with credential vaulting, session recording and proxied access; 2025 CVEs reported fixed in 4.2.1 - **Details:** https://www.thetechbag.com/broadcom/broadcom-symantec-pam ### Heimdal Privilege Elevation and Delegation Management — Heimdal - **Who it's for:** Teams removing standing local admin rights from staff laptops without slowing support down. - **The honest limitation:** Elevation only: no credential vault, no session recording and no account discovery; per-file elevation should be shown in a demo; no India data region. - **Price:** Quote — quoted per device per year; time-limited admin rights granted from the dashboard or a phone, on Windows and macOS, through the Heimdal agent - **Details:** https://www.thetechbag.com/heimdal/heimdal-privilege-elevation-delegation-management ### Heimdal Privileged Account and Session Management — Heimdal - **Who it's for:** Smaller estates that want vaulted, approved and recorded RDP and SSH sessions on an appliance they host themselves. - **The honest limitation:** RDP and SSH only, kept 1–365 days; despite Heimdal’s “cloud-native” wording it is a VM you run; password rotation and discovery are not documented. - **Price:** Quote — quoted per admin user per year (minimum 1 admin and 10 users); a self-hosted virtual appliance on Hyper-V, VMware, VirtualBox, GCP, Proxmox or Nutanix that vaults credentials and brokers recorded sessions - **Details:** https://www.thetechbag.com/heimdal/heimdal-privileged-account-session-management ### Delinea Secret Server (on-premises · Secret Server Cloud) — Delinea - **Who it's for:** Estates that want a Gartner-Leader vault that goes live in weeks rather than quarters — discovery, rotation, approvals and recorded sessions, self-hosted or as SaaS. - **The honest limitation:** Full session recording and keystroke logging are Platinum-only on-premises (Professional caps them at 50 secrets); there is no India hosting region (nearest Singapore/Hong Kong or the UAE); and four critical on-premises CVEs in September 2026 mean anything below 12.2.7 must be patched. - **Price:** Quote — quote-only, on-premises in three editions (Vault, Professional, Platinum) or as Secret Server Cloud inside the Delinea Platform bundles; free 30-day trial; pipeline secrets are the separate DevOps Secrets Vault - **Details:** https://www.thetechbag.com/delinea/delinea-secret-server ### Delinea Privilege Manager — Delinea - **Who it's for:** Estates taking local admin away from Windows and Mac laptops with allow, deny and sandbox rules and an approval path instead of blanket elevation. - **The honest limitation:** Endpoint privilege, not a vault: it elevates and controls applications on endpoints and stores no infrastructure credentials. Server elevation is the separate Server PAM line, and the licence unit is not published. - **Price:** Quote — quoted per endpoint (unit not published); removes local admin rights and controls applications on Windows and macOS, cloud or on-premises, with a 30-day trial - **Details:** https://www.thetechbag.com/delinea/delinea-privilege-manager ### Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite) — Delinea - **Who it's for:** Mixed Windows, Linux and Unix estates that want one Active Directory identity on every server, MFA at login and at sudo, and host-level session recording, without shared root. - **The honest limitation:** An agent on every server, and three overlapping SKUs whose choice is about delivery, not features — get the edition in writing. Not a credential vault (that is Secret Server). Cloud Suite needed patch 25.2 HF1 for CVE-2026-2409. - **Price:** Quote — quote-only; one family in three deliveries: Privilege Control for Servers (cloud-native SaaS), Cloud Suite (SaaS) and Server Suite (on-premises); the Platform Standard bundle includes 15 servers - **Details:** https://www.thetechbag.com/delinea/delinea-server-pam ### Delinea Privileged Remote Access — Delinea - **Who it's for:** Teams whose suppliers and remote admins need a recorded, time-bound path into production without a VPN account or a client install. - **The honest limitation:** Session brokering, not a vault: rotation and discovery live in Secret Server, the companion purchase. RDP and SSH only, SaaS only, and the platform has no India hosting region. - **Price:** Quote — quote-only; browser-based, VPN-less RDP and SSH on the Delinea Platform for remote admins, contractors and vendors, with credentials injected from the vault and Iris AI auditing of recordings - **Details:** https://www.thetechbag.com/delinea/delinea-privileged-remote-access ### Delinea DevOps Secrets Vault — Delinea - **Who it's for:** DevOps teams that want machine secrets out of code and config files, with short-lived credentials, without running a vault cluster themselves. - **The honest limitation:** SaaS-only and machine-only: no human sessions, no recording. Kubernetes-native injection depth is not documented; compare HashiCorp Vault and CyberArk Secrets Manager on your pipeline tools by name. - **Price:** Quote — quote-only; SaaS secrets store for applications, CI/CD tools and RPA bots via CLI and REST API, with dynamic just-in-time credentials for databases and cloud platforms; free trial - **Details:** https://www.thetechbag.com/delinea/delinea-devops-secrets-vault ### Delinea Credential Manager — Delinea - **Who it's for:** Organisations moving staff’s shared business logins out of spreadsheets and browsers into a vault their PAM team already administers. - **The honest limitation:** A password manager, not PAM: no session recording, no elevation, no infrastructure discovery. It sits beside Secret Server, never instead of it, and its deployment and licence unit are not stated. - **Price:** Quote — quote-only; a workforce password vault for business users with a browser extension and mobile app, MFA and role-based sharing, on the Delinea Platform - **Details:** https://www.thetechbag.com/delinea/delinea-credential-manager ### StrongDM (a Delinea product) — Delinea - **Who it's for:** Engineering teams that want just-in-time, auto-expiring access to databases, Kubernetes and cloud, approved in Slack or Teams, without handing out credentials. - **The honest limitation:** Built for modern infrastructure: network devices, mainframes and classic Windows vaulting are Secret Server’s ground. You run the gateways, and the price is quote-only despite the single SKU. Part of Delinea since March 2026. - **Price:** Quote — per user, one SKU with every feature (no figure published); SaaS control plane with self-hosted gateways; brokers credentials to databases, Kubernetes, SSH, RDP, cloud consoles and AI agents - **Details:** https://www.thetechbag.com/delinea/delinea-strongdm ### JumpCloud Privileged Access Management (PAM) — JumpCloud - **Who it's for:** JumpCloud tenants that want admins and suppliers brokered into servers, databases and web consoles through the browser, with no VPN and no shared password, under the same directory as SSO. - **The honest limitation:** Built on VaultOne, acquired in May 2025, with no published PAM customer scale. You host and patch the Connector, video recording needs the Premium connector (native-client RDP is not recorded), account discovery is not documented and network devices are not listed targets. - **Price:** Quote — Contact Sales, with no published meter; a SaaS console plus a Connector you host (Ubuntu Server 24.04, Docker) that proxies and records sessions; Access Requests for just-in-time elevation lists at $5 per user a month or comes in Platform Prime - **Details:** https://www.thetechbag.com/jumpcloud/jumpcloud-privileged-access-management ## Why each constraint rules out what it does The full narrowing logic, as prose. Nothing here is hidden behind an interaction. **Windows servers.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), Heimdal Privilege Elevation and Delegation Management, Delinea DevOps Secrets Vault and Delinea Credential Manager — does not vault Windows servers or domain accounts. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Unified PAM, Securden Endpoint Privilege Manager, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM). **Unix and Linux.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Endpoint Privilege Manager, Heimdal Privilege Elevation and Delegation Management, Delinea Privilege Manager, Delinea DevOps Secrets Vault and Delinea Credential Manager — does not vault Unix / Linux accounts. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM). **Network devices.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Endpoint Privilege Manager, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM) — does not vault network device credentials. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, ARCON Global Remote Access, Devolutions PAM, Symantec PAM (Broadcom) and Delinea Secret Server (on-premises · Secret Server Cloud). **Databases.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Endpoint Privilege Manager, One Identity Cloud PAM Essentials, Okta Privileged Access, ARCON Global Remote Access, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access and Delinea Credential Manager — does not vault database accounts. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), BeyondTrust Password Safe, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, miniOrange PAM, Devolutions PAM, Symantec PAM (Broadcom), Delinea Secret Server (on-premises · Secret Server Cloud), Delinea DevOps Secrets Vault, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM). **Cloud consoles.** Rules out CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Endpoint Privilege Manager, Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea Credential Manager and JumpCloud Privileged Access Management (PAM) — does not vault cloud console access. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Delinea Secret Server (on-premises · Secret Server Cloud), Delinea DevOps Secrets Vault and StrongDM (a Delinea product). **SaaS admin accounts.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON Endpoint Privilege Management, Securden Endpoint Privilege Manager, One Identity Safeguard, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea DevOps Secrets Vault and StrongDM (a Delinea product) — does not vault SaaS admin accounts. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), BeyondTrust Password Safe, ARCON My Vault, Securden Unified PAM, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Credential Manager and JumpCloud Privileged Access Management (PAM). **Application and pipeline secrets.** Rules out CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Endpoint Privilege Manager, One Identity Cloud PAM Essentials, ARCON Global Remote Access, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea Credential Manager and JumpCloud Privileged Access Management (PAM) — no application or pipeline secrets capability; it vaults credentials for people. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), BeyondTrust Password Safe, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, Okta Privileged Access, miniOrange PAM, Devolutions PAM, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea DevOps Secrets Vault and StrongDM (a Delinea product). It flags CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud) — Stores and serves application credentials, but is not a CI/CD-native secrets platform, BeyondTrust Password Safe — Stores and serves application credentials, but is not a CI/CD-native secrets platform, ARCON Privileged Access Management — Stores and serves application credentials, but is not a CI/CD-native secrets platform, Securden Unified PAM — Stores and serves application credentials, but is not a CI/CD-native secrets platform, One Identity Safeguard — Stores and serves application credentials, but is not a CI/CD-native secrets platform, Okta Privileged Access — Stores and serves application credentials, but is not a CI/CD-native secrets platform, miniOrange PAM — Stores and serves application credentials, but is not a CI/CD-native secrets platform, Devolutions PAM — Stores and serves application credentials, but is not a CI/CD-native secrets platform, Delinea Secret Server (on-premises · Secret Server Cloud) — Stores and serves application credentials, but is not a CI/CD-native secrets platform and StrongDM (a Delinea product) — Stores and serves application credentials, but is not a CI/CD-native secrets platform — marked, not removed. **Kubernetes workloads.** Rules out CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Unified PAM, Securden Endpoint Privilege Manager, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea Credential Manager and JumpCloud Privileged Access Management (PAM) — Kubernetes-native secrets brokering not documented. That leaves CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), Delinea DevOps Secrets Vault and StrongDM (a Delinea product). **On-premises deployment.** Rules out CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, One Identity Cloud PAM Essentials, Okta Privileged Access, Heimdal Privilege Elevation and Delegation Management, Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM) — SaaS only; there is no self-hosted deployment. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Unified PAM, Securden Endpoint Privilege Manager, One Identity Safeguard, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager and Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite). **Pure SaaS delivery.** Rules out CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Unified PAM, Securden Endpoint Privilege Manager, One Identity Safeguard, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager and Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite) — the deployment includes a self-hosted or on-premises component you run. That leaves CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, One Identity Cloud PAM Essentials, Okta Privileged Access, Heimdal Privilege Elevation and Delegation Management, Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM). **Full session recording.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), ARCON My Vault, Heimdal Privilege Elevation and Delegation Management, Delinea DevOps Secrets Vault and Delinea Credential Manager — no session recording; CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Management, ARCON Endpoint Privilege Management, Securden Endpoint Privilege Manager, Devolutions PAM, Delinea Privilege Manager and JumpCloud Privileged Access Management (PAM) — basic activity capture, not full session recording with playback. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, Securden Unified PAM, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, miniOrange PAM, ARCON Global Remote Access, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access and StrongDM (a Delinea product). **Account discovery.** Rules out CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, ARCON Endpoint Privilege Management, ARCON My Vault, One Identity Cloud PAM Essentials, Okta Privileged Access, ARCON Global Remote Access, Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM) — no automated discovery of unknown privileged accounts. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), BeyondTrust Password Safe, ARCON Privileged Access Management, Securden Unified PAM, Securden Endpoint Privilege Manager, One Identity Safeguard, miniOrange PAM, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager and Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite). **Agentless targets.** Rules out CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Management, ARCON Endpoint Privilege Management, Securden Endpoint Privilege Manager, Okta Privileged Access, Heimdal Privilege Elevation and Delegation Management, Delinea Privilege Manager and Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite) — requires an agent on the managed system. That leaves CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, ARCON Privileged Access Management, ARCON My Vault, Securden Unified PAM, One Identity Safeguard, One Identity Cloud PAM Essentials, miniOrange PAM, ARCON Global Remote Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM). **India-built, INR.** Rules out CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Endpoint Privilege Manager, CyberArk Vendor PAM, BeyondTrust Password Safe, BeyondTrust Endpoint Privilege Management, BeyondTrust Privileged Remote Access, One Identity Safeguard, One Identity Cloud PAM Essentials, Okta Privileged Access, Devolutions PAM, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS), Symantec PAM (Broadcom), Heimdal Privilege Elevation and Delegation Management, Heimdal Privileged Account and Session Management, Delinea Secret Server (on-premises · Secret Server Cloud), Delinea Privilege Manager, Delinea Server PAM (Privilege Control for Servers · Cloud Suite · Server Suite), Delinea Privileged Remote Access, Delinea DevOps Secrets Vault, Delinea Credential Manager, StrongDM (a Delinea product) and JumpCloud Privileged Access Management (PAM) — a global vendor; INR quoting is via the channel, not the vendor's own price list. That leaves ARCON Privileged Access Management, ARCON Endpoint Privilege Management, ARCON My Vault, Securden Unified PAM, Securden Endpoint Privilege Manager, miniOrange PAM and ARCON Global Remote Access. **Above 1,000 privileged accounts.** Rules nothing out on published terms. It flags ARCON Endpoint Privilege Management — Unverified above 1,000 privileged accounts, ARCON My Vault — Unverified above 1,000 privileged accounts, Securden Unified PAM — Unverified above 1,000 privileged accounts, Securden Endpoint Privilege Manager — Unverified above 1,000 privileged accounts, One Identity Cloud PAM Essentials — Unverified above 1,000 privileged accounts, miniOrange PAM — Unverified above 1,000 privileged accounts, ARCON Global Remote Access — Unverified above 1,000 privileged accounts, Devolutions PAM — Unverified above 1,000 privileged accounts, OpenText NetIQ Privileged Access Manager (Self-hosted · SaaS) — Unverified above 1,000 privileged accounts, Symantec PAM (Broadcom) — Unverified above 1,000 privileged accounts, Heimdal Privilege Elevation and Delegation Management — Unverified above 1,000 privileged accounts, Heimdal Privileged Account and Session Management — Unverified above 1,000 privileged accounts, Delinea Privileged Remote Access — Unverified above 1,000 privileged accounts, Delinea DevOps Secrets Vault — Unverified above 1,000 privileged accounts, Delinea Credential Manager — Unverified above 1,000 privileged accounts, StrongDM (a Delinea product) — Unverified above 1,000 privileged accounts and JumpCloud Privileged Access Management (PAM) — Unverified above 1,000 privileged accounts — marked, not removed. **Onboarding is the project, not the product.** Every vendor here can vault a Windows administrator account in an afternoon. What separates them is account 1,000: the service account nobody owns, the appliance whose password is in a runbook, the application that breaks when its credential rotates. Discovery (CyberArk, BeyondTrust, ARCON, Securden, One Identity Safeguard, miniOrange) finds the accounts; agreeing who owns each one is a governance conversation with your own teams, and it is where PAM projects stall. TechBag's delivery figures for accounts onboarded per week by platform are [TechBag to confirm]. **Secrets management is a different product.** Vaulting a credential a human checks out is not the same as brokering a secret an application requests ten thousand times an hour, unattended, with no interactive login. Only CyberArk Secrets Manager on this page is a purpose-built machine-identity platform; the full vaults (CyberArk PAM, BeyondTrust, ARCON, Securden, One Identity, miniOrange, Okta) store and serve application credentials but are not CI/CD-native — marked partial, flagged, never eliminated. If your pipelines and containers are the gap, price the second product now rather than discovering it in year two. **Break-glass and the day the vault is down.** Every deployment needs an emergency path when the vault, the directory or the network is unavailable — sealed credentials, an offline copy, a documented two-person procedure. Every vendor supports one; almost nobody tests it. Put the break-glass rehearsal in the implementation plan, not the runbook. **Session-recording storage.** Full recording produces video-scale data. Retention is a policy decision with a storage bill attached, and it is not in the licence — see the cost section. Ask for gigabytes per recorded hour and set retention before go-live, not after the first audit. **Under 50 privileged accounts.** Rules nothing out on published terms: Securden, miniOrange, One Identity Cloud PAM Essentials and Okta Privileged Access are sold to small estates; CyberArk and BeyondTrust publish no floor but are enterprise-positioned. Where a small estate should stop at a vault and skip the full platform is delivery judgement: [TechBag to confirm]. ## Eight situations, eight shortlists — with the onboarding named Each shortlist names what the first ninety days look like, not only which product wins a feature grid. If a regulator is driving this, start from the first row. ### Indian bank or NBFC — the auditor arrives and the report format matters **Shortlist:** ARCON Privileged Access Management, CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), Securden Unified PAM **Why:** ARCON is Mumbai-built with reporting shaped for RBI and SEBI CSCRF audits and support in the same time zone; CyberArk is the platform every regulator already recognises; Securden gives the same controls on an all-inclusive per-user number. **Trade-off:** ARCON's platform breadth and CI/CD secrets are thinner than CyberArk's; CyberArk's licence and implementation are several times the cost. The regulator cares that privileged access is controlled and evidenced — not whose logo is on it. ### The pipelines are the problem — credentials live in CI/CD variables and container images **Shortlist:** CyberArk Secrets Manager (SaaS · Self-Hosted, formerly Conjur), CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), Securden Unified PAM **Why:** CyberArk Secrets Manager is the only purpose-built machine-identity platform here — pipelines, containers and application-to-application credentials brokered without a human. The full vaults store application credentials but are not CI/CD-native. **Trade-off:** It is a second product with its own project and its own quote. Buying only the human vault and hoping it covers pipelines is how the machine half stays unsolved for two more years. ### Few administrators, many servers **Shortlist:** BeyondTrust Password Safe, Securden Unified PAM, ARCON Privileged Access Management **Why:** BeyondTrust's per-managed-asset meter (about $157 per asset per year on the US GSA schedule) suits a small team over a large estate; Securden's per-user-only model suits the same shape from the other direction; ARCON quotes both dimensions in INR. **Trade-off:** The two meters invert: per-asset is cheap for five admins over 500 servers and expensive for 200 admins over 50; per-user is the reverse. Model both on your real numbers before reading a quote. ### Third parties and vendors need into production **Shortlist:** CyberArk Vendor PAM, BeyondTrust Privileged Remote Access, ARCON Global Remote Access **Why:** CyberArk Vendor PAM gives biometric-verified, VPN-less access priced per supplier; BeyondTrust Privileged Remote Access brokers and records the session for insiders and vendors alike. **Trade-off:** Per-vendor pricing is cheap at ten suppliers and painful at two hundred; the brokered-session products price per user instead. Both beat issuing the supplier a VPN account nobody reviews. ### Remove local admin rights from laptops — the audit finding everyone gets **Shortlist:** CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Management, Securden Endpoint Privilege Manager **Why:** All three are PEDM: they take standing local administrator rights away and elevate named applications instead. BeyondTrust extends the same model to Unix and Linux servers. **Trade-off:** None of these vaults anything. If the finding was about server, database or network credentials, PEDM does not answer it — that is the vault, and it is a separate purchase. ### Already on Okta, and privileged server access is the remaining gap **Shortlist:** Okta Privileged Access, One Identity Cloud PAM Essentials, Securden Unified PAM **Why:** Okta Privileged Access puts just-in-time server and cloud access under the identity, policy and lifecycle you already run; One Identity Cloud PAM Essentials is the vendor-neutral SaaS equivalent. **Trade-off:** Okta's version assumes an Okta-centric estate and does not reach network devices, mainframes or the legacy long tail. If those matter, you are buying a classic vault regardless of who runs your SSO. ### Mid-market, no dedicated identity team, needs it running this quarter **Shortlist:** Securden Unified PAM, miniOrange PAM, One Identity Cloud PAM Essentials **Why:** Securden's all-inclusive per-user pricing and miniOrange's low INR entry point (workforce identity published from ₹180 per user per month, PAM quoted on top) are the two fastest routes to a working vault; Cloud PAM Essentials needs no appliance. **Trade-off:** All three are flagged unverified above 1,000 privileged accounts — not ruled out, but ask for a reference at your size before signing a three-year term. ### Governance and PAM bought together, one vendor, one roadmap **Shortlist:** One Identity Safeguard, CyberArk Privileged Access Manager (Self-Hosted · Privilege Cloud), Okta Privileged Access **Why:** One Identity pairs Safeguard with Identity Manager more tightly than anyone here; CyberArk and Okta each sell governance beside the vault on one platform. **Trade-off:** One platform means one negotiation and one throat to choke — and one vendor's roadmap for two disciplines that are usually run by different teams on different timelines. ## At scale PAM scales by accounts onboarded, not licences bought. The bill follows the meter; the timeline follows how many owners you have to find. ### 50 privileged accounts — Getting started is the constraint - Any product here covers it; the question is how fast it stands up. Securden, miniOrange, Cloud PAM Essentials and Okta Privileged Access reach a working vault fastest. - The accounts are mostly known — domain admins, a few servers, the firewall. Discovery matters less than the workflow your administrators will actually use. - All-inclusive per-user pricing is cheapest at this size; per-asset meters rarely are. **The test:** Vault the domain administrator account and have someone use it through the broker for a week. If they route around it, the product is wrong or the workflow is. ### 250 privileged accounts — Coverage and ownership are the constraint - Discovery finds accounts nobody claims — service accounts, appliance logins, the application credential in a config file. Each needs an owner before it can be onboarded. - Platform coverage starts to bite: the one legacy system, the network gear, the database that must not have its password rotated on a schedule. - The machine half becomes visible — pipelines and applications now hold more credentials than your administrators do. **The test:** Ask for a named reference at your size and industry, and ask them how long onboarding actually took versus the plan. ### 1,000 privileged accounts — The machine half and the evidence are the constraint - Non-human identities dominate: service accounts, pipeline credentials, cloud workload identities, agent tokens. A human-only vault is now covering a minority of what signs in. - Session-recording storage and retention are a real budget line; certification evidence for the regulator is a recurring process, not a report. - Securden, miniOrange, ARCON EPM and One Identity Cloud PAM Essentials are flagged unverified at this size — not ruled out; ask for the reference. **The test:** Count your non-human identities and your human ones. If the first number is larger and only the second is vaulted, you have found the next project. CyberArk, BeyondTrust, ARCON, One Identity Safeguard and Okta document large estates; Securden, miniOrange, Devolutions PAM, ARCON EPM, ARCON My Vault, Securden EPM and One Identity Cloud PAM Essentials are flagged unverified above 1,000 privileged accounts. Where a specific product strains for your estate: [TechBag to confirm]. ## Leaving a PAM platform means re-onboarding every account The vault holds credentials, workflows, approvals and years of recordings. None of it moves. Switching is the original onboarding project run a second time, with the first platform still live. **Re-onboarding** — Every account is discovered, owned, connected and tested again on the new platform. The plan that took two quarters takes two quarters. *(The project, again)* **The recordings** — Session recordings live in the old platform's format and storage. Audit and legal retention decide how long you keep it running read-only after the switch. *(Keep it for retention)* **Integrations and connectors** — Ticketing approval flows, SIEM feeds, directory joins and custom connectors are per platform and rebuilt from scratch. *(Rebuild and re-test)* **The overlap** — Both vaults run until every account is migrated and rotated. Two PAM bills for two quarters is the honest cost of not leaving a gap in the control the regulator asked for. *(Overlap, not a gap)* **Re-onboarding effort, recording retention and overlap cost for your estate:** [TechBag to confirm] — TechBag scopes it from your account inventory and audit retention rules. ## Per user, per asset, or per target — the difference is often 5× What you may already hold, the products priced on their own meters at three estate sizes in USD and INR, and what the licence line leaves out — which, for PAM, starts with the onboarding project. ### Do you already own one? Four places privileged control may already sit. Two are real; none is a vault for your infrastructure. - **Microsoft Entra ID P2 — Partly.** Privileged Identity Management gives eligible-not-permanent Entra and Azure roles with approval and expiry — real PIM, listed at about $9–10 per user per month. It governs Microsoft’s own roles; it vaults no server, database or network credential. - **Your endpoint or UEM product — No.** Some remove local admin rights (PEDM territory). None vaults, brokers or records privileged infrastructure sessions. - **A team password manager — No.** Shared credentials in a business vault — ARCON My Vault is exactly this. No rotation against the target system, no session recording, no discovery, no audit trail an auditor will accept for privileged infrastructure. - **Cloud-native privilege tools — Partly.** AWS IAM roles, Azure PIM and GCP IAM govern privilege inside that cloud, on consumption. They stop at the cloud boundary and do not reach the data centre. If what you own covers the accounts that actually worry your auditor, we say so. It costs us a sale and saves you one. ### What the rest actually cost Reported and published meters (INR for scale), worked at three estate sizes. **The meters are not comparable** — per privileged user, per managed asset and per target system can differ by 5× on the same estate, so each line states its own unit. The India-built and mid-market options are priced explicitly, because no other comparison does. ### What isn't in the licence price - **The onboarding project.** Discovery, finding an owner for every account, connectors, application testing and the rotation exceptions — measured in quarters at enterprise scale and the single largest hidden number in this category. Your figure: [TechBag to confirm]. - **Session-recording storage.** Full recording is video-scale data with a retention policy attached. It is not in the licence, it grows with adoption, and the audit that asks for playback also asks how long you keep it. Size it before go-live. - **The break-glass rehearsal and the exceptions.** The emergency path, tested; the application whose credential cannot rotate on a schedule; the legacy system that needs a bespoke connector. Every deployment has them, no licence includes them. ## What goes wrong Documented behaviour and project outcomes, cross-checked against TechBag engagements before any becomes a named case. Each is cheaper to read here than to discover in month nine. - **Discovery finding thousands of accounts nobody will own.** The scan succeeded and produced a list no team would claim. Onboarding stalls at the ownership conversation, not the technology — start it before the purchase order. - **Break-glass procedures that were never tested.** The vault, the directory or the network was down and nobody could reach the emergency credentials. Rehearse it quarterly; write down who holds what. - **Session recording storage growing without a retention plan.** Recording was switched on for everything; a year later storage was the largest line in the programme. Set retention by system class before go-live. - **Agents that don't cover the one legacy system that mattered.** The vault covered 95% of the estate and not the mainframe, the appliance or the industrial system the auditor asked about. Write the awkward list first, and test against it. - **Buying PAM and never getting past the first fifty accounts.** The domain admins went in and the project stopped. The remaining thousands are service accounts — which is the machine-identity problem wearing a different hat. - **PEDM bought to answer a vault finding.** Local admin rights were removed from laptops; the audit was about database and network credentials. Different product, different budget, same brochure vocabulary. - **Rotation breaking the application nobody documented.** A credential rotated on schedule and a batch job failed at 3am. Application-aware exceptions are a design decision, not a support ticket. - **The pipelines never entering the vault.** Human accounts are governed; CI/CD variables, container images and cloud workload identities are not. Non-human identities outnumber humans in most estates — and are usually outside the programme entirely. ## Questions this guide answers ### What is the difference between PAM, PIM, PEDM and secrets management? PAM is the vault and broker for credentials that can change or destroy things, with session recording — the main purchase. PIM governs the lifecycle and eligibility of privileged identities (Microsoft's Entra PIM made the term familiar: eligible rather than permanent roles, activated on request). PEDM has no vault at all — an agent removes standing local administrator rights on endpoints and elevates named applications instead. Secrets management is the machine half: credentials and keys requested by applications, pipelines and containers, unattended. They are adjacent scopes, not tiers, and CyberArk selling the human vault and Secrets Manager as separate products is the clearest statement of that. ### Do Indian regulators require privileged access management? Not by that product name in every case, so read the source. The RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (issued 7 November 2023, in force 1 April 2024) requires multi-factor authentication for privileged users of critical information systems and need-based access, and defines a privileged user explicitly. SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF, August 2024) sets access-management requirements including least privilege and multi-factor authentication for privileged access for regulated entities. The IRDAI Information and Cyber Security Guidelines, 2023 (24 April 2023) set access-management requirements covering privileged access and periodic access reviews. In practice these are met with a PAM platform; the obligation is the control, not the product category. ### Which PAM products are India-built? ARCON (Mumbai), Securden and miniOrange are India-built and quote in INR. ARCON is the deepest of the three for regulated infrastructure — on-premises as a first-class deployment, BFSI-shaped audit reporting, local support — while being narrower than CyberArk on platform breadth, integration ecosystem and CI/CD secrets. Securden's pitch is all-inclusive per-user pricing with no per-target add-ons; miniOrange is the lowest entry point here, publishing workforce identity from ₹180 per user per month with PAM quoted on top. All three are flagged unverified above 1,000 privileged accounts rather than ruled out. --- *Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.* *TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/identity-access/privileged-access-management*