Magic Quadrant for Privileged Access Management

Privileged Access Management Vendor Product Comparisons 2023

Key features and pros and cons of top Privileged Access Management products:

BeyondTrust - Leader

Pros:

Product strategy: The bundle of PS and PRA provides strong capabilities, especially in the areas of account discovery and onboarding, privileged session management and remote access. However, the same is not true if only one of those products is deployed: PRA is focused on privileged session management, which the stand-alone version of PS is not strong in.
Product: BeyondTrust is best in class for UNIX/Linux and macOS PEDM, and a top performer for Windows PEDM. For the Total PASM bundle, clients comment favorably on discovery capabilities, smart rules, and ease of use.
Customer experience: BeyondTrust is very engaged with its customers, with multiple teams from customer success to technical support.
Market responsiveness: BeyondTrust has added zero trust network access (ZTNA) capabilities to its PRA product, and now offers a capable IT infrastructure access tool for developers and engineers. It also added more tools to help customers measure their PAM maturity levels.

Cons:

Product: For workload identity and secrets management, BeyondTrust continues to disappoint, with little innovation and lacks support for native authentication methods and integration with DevOps technologies.
Offering strategy: Roadmap items for BeyondTrust are less focused on needed improvements in core PAM capabilities such as just in time (JIT) use cases, and more focused on edge cases like CIEM and managing passwords for business users.
Product: Clients point out a cumbersome upgrade process for software versions.
Pricing: BeyondTrust's pricing remains higher than the market average, especially for its software PAM offerings.

CyberArk - Leader

Pros:

Product: CyberArk has a large partner ecosystem, and has delivered many connectors and integrations with adjacent technologies, such as IT service management (ITSM) and identify governance and administration (IGA) tools. CyberArk's PAM products are some of the most mature in the market. It rates high for workload identity and secrets management, credential management, logging and reporting, adjacent technology integrations and automation, and CIEM.
Overall viability: CyberArk continues to have the largest share of the PAM market. Customer and revenue growth continued to be strong since the publication of the last Magic Quadrant.
Innovation: CyberArk has delivered a number of significant updates since last year's Magic Quadrant, such as integrating its secrets manager with Amazon Web Services (AWS), and extending JIT functionality to cover more use cases.
Market responsiveness: CyberArk added a feature called transparent secrets management — an enhancement for its secrets management, which allows secrets to be managed across both CyberArk and AWS secrets vaults.

Cons:

Product: CyberArk's PASM software remains difficult to manage and upgrade, including those on-premises bridge components that are required even for SaaS. Disaster recovery — especially failover support — is brittle, relies on manual processes and has been a source of customer complaints for a long time.
Pricing: A common complaint from clients is about cost — CyberArk's products are among the most expensive on the market. Clients will often require multiple products offered in different editions that are licensed separately. This makes it more complicated to select and size the right solution and predict costs, especially for multiyear deals.
Offering strategy: For several years, CyberArk has roadmapped improvements for its aging PSM functionality — especially to increase performance and throughput — but has not yet delivered.
Technical support: While customer experience is still positive overall, CyberArk is rated by customers in the lowest quartile for quality of technical support.

Delinea - Leader

Pros:

Product: Delinea has consolidated its PASM SaaS platform into three editions: Essentials, Standard and Enterprise. The last two editions notably also include licenses for a limited number of PEDM functions for servers and workstations. Delinea has a very competent PEDM offering for UNIX/Linux that scored among the top vendors of those evaluated.
Customer experience: Clients consistently mention ease of use as one of the aspects that they like most about Secret Server and Privilege Manager.
Offering strategy: Delinea is one of the first PAM vendors with plans to adopt two standards to help with interoperability: Secure Production Identity Framework for Everyone (SPIFFE) for PAM for machines, and elements of Open Policy Agent (OPA) for policy creation. It also plans to introduce functionality to manage Delinea and other on-premises vaults with a single management console.
Sales/geographic strategy: Delinea recently restructured its go-to-market organization, enabling it to refocus resources and efforts. Additionally, Delinea has expanded its sales, engineering and customer success functions.

Cons:

Product: Delinea continues to lag behind other Leaders in some capabilities. RDP session management with keystrokes and metadata recording requires installation of local agents on target servers, which most other vendors don't require. Secret Server also lags behind other Leaders in support for advanced service account and credential management scenarios, and is especially brittle on local systems that are not permanently connected.
Product strategy: Delinea has a strategy to present Secret Server as a "simple to deploy and use" solution. However, several fairly common requirements need customization through PowerShell, placing an additional burden on clients.
Business model: Delinea is developing significant new capabilities to be delivered as SaaS-only, leading to an increased disparity in functionality between its SaaS and on-premises offerings.
Operations: Overall, Delinea continued to shrink slightly in terms of employee count. The company has added some staff to R&D, but it still has the lowest ratio of employee population devoted to PAM R&D of all three Leaders in this research.

ARCON - Challenger

Pros:

Product: ARCON's offering is the most capable of all vendors evaluated, with every capability evaluated above — and often well-above — the average.
Pricing: ARCON's pricing is competitive. In most pricing scenarios, especially around PASM, ARCON is more affordable than other vendor offerings in this research. In AAPM and PEDM scenarios, pricing is around average and sometimes higher than average, especially for its software offering.
Customer experience: ARCON staffs its customer relationship management team with customer success managers for each customer. Even the most basic support package offers 24/7 support.
Market responsiveness: Since last year's Magic Quadrant, ARCON introduced additional capabilities for collaboration in session management and incident management. It also introduced starter kits that simplify adoption of the product.

Cons:

Product: The most common complaint Gartner heard from ARCON's clients is related to the overall user interface. Some also mentioned session management performance and the overall upgrade process.
Marketing and sales: ARCON is lagging behind Leaders in this research in marketing and sales efforts to gain new customers.
Geographic strategy: ARCON's footprint in the Americas is small, with only a few deployments.
Product roadmap: ARCON's product roadmap is mostly focused on convergence with its own IAM products, as opposed to focusing on innovation in core PAM functionality (like simplifying implementations with toolkits).

ManageEngine - Challenger

Pros:

Product: PAM360's discovery capabilities are extensive, offering a wide range of scanning tools for finding privileged accounts on systems, databases, infrastructure and networks. Ease of deployment, administration and maintenance are areas in which ManageEngine is strong.
Pricing: ManageEngine pricing is now consistently less than market averages. It offers a distinct pricing model where PAM360 is licensed based on the number of PAM tool administrators (and not the number of privileged users who would like to perform administrative tasks on the target systems).
Product strategy: ManageEngine sells a version of PAM360 for use with managed service providers that require managing privileged access to multiple customers.
Geographic market strategy: ManageEngine is well-represented across the globe, with customer concentrations in North America, Asia/Pacific, EMEA and Latin America.

Cons:

Product: PAM360 supports multiple connection mechanisms, including proxying, but full session management and recording is only supported through an HTML5 browser session emulation, which is resource-intensive and less scalable.
Innovation: New product introductions since last year's Magic Quadrant were limited to feature enhancements and catch-ups in the market.
Market understanding: While ManageEngine recognizes market trends toward cloud adoption and integration with DevOps, it still has to catch up by offering a SaaS-based solution and building out its secrets management capabilities.
Product strategy: ManageEngine's roadmap does not address long-standing product gaps compared to the market. PAM360 is below the average of vendors evaluated for privileged credential management, workload identity and secrets management, and Windows PEDM.

Broadcom (Symantec) - Niche Player

Pros:

Product: Symantec offers a very competitive PEDM product for Windows, UNIX/Linux and mainframe clients. Its performance and scalability, availability and recoverability capabilities are strong for PASM, including excellent clustering and high-availability features that support the addition of nodes without having to take a cluster down.
Pricing: Symantec's PAM offering is priced competitively, with almost all scenario pricing below — and sometimes well below — the average for the market as a whole. In addition, Broadcom offers its top clients portfolio license agreements, which may offer additional savings.
Vertical industry strategy: Symantec supports a very diverse set of market verticals, including the public sector, with its PAM tool.
Geographic strategy: Symantec's customer base is very diverse in terms of regions, and the company has an established global support structure.

Cons:

Product: For complex service account credential management, Symantec relies on its Custom Connector Framework. This means that customers sometimes have to develop custom connectors, whereas other vendors offer out-of-the-box connectors. Privilege credential management and JIT PAM were also less mature compared to the market.
Customer experience: Broadcom scored lowest of all included vendors in client ratings for customer support. Customers complain about resolution times for service incidents, especially after escalations.
Product strategy: While every other vendor in this Magic Quadrant provides (or is developing) SaaS capabilities, Broadcom has not as yet roadmapped a SaaS offering for its PAM product.
Business model: Broadcom's direct customer relationship focus is on its top 1,000 customers. Other clients are being offloaded to Broadcom's partner channel.

HashiCorp - Niche Player

Pros:

Product and market presence: HashiCorp has the highest market share for stand-alone secrets management. Its Vault product scores among the top of all products evaluated for that capability.
Marketing execution: HashiCorp demonstrates a keen understanding of its brand and the target personas to which it sells, including practitioners, application developers and DevOps teams.
Customer enablement: HashiCorp offers a vast library of free resources, documentation and tutorials that is very popular and provides excellent self-paced training.
Customer experience: Customer comments on HashiCorp Vault express an appreciation of its encryption capabilities and praise its ease of integration.

Cons:

Product: Boundary is a new offering and still lacks many of the features and capabilities commonly found in more mature PAM products, such as privileged account life cycle management, discovery and credential management. Its session management capabilities are below the average of what is offered by other included vendors.
Pricing: Customers mention the high cost of HashiCorp Vault as the main drawback and customers score HashiCorp lowest of all vendors for pricing and contract flexibility. In addition, pricing for Boundary is unusual, as HashiCorp charges customers on the basis of "sessions per month," unlike any other vendor in this market that charges on a per-user or per-asset basis.
Operations: HashiCorp laid off approximately 8% of its workforce in June 2023.
Market responsiveness: HashiCorp's PAM maturity model is less focused on long-term success with mitigating the risk of PAM in traditional corporate environments, and more focused on management of privileged access for DevOps use cases and a cloud operating model.

Netwrix - Visionary

Pros:

Product: JIT privileged access functionality is among the most capable of all vendors evaluated. The Windows PEDM product is also competitive.
Marketing execution: Netwrix has developed a solid narrative around its brand and specifically targets its marketing toward the benefits of zero standing privileges, rapid deployment and ease of use.
Market responsiveness: Since last year's Magic Quadrant, Netwrix introduced a comprehensive maturity program, helping customers measure and plan the maturity of their PAM practices, and it offers a zero-standing-privileges approach for database access.
Marketing understanding: Netwrix has a unique angle on the PAM market with a bring-your-own-vault approach, allowing the company to position itself as an enhancement to existing PAM tools as opposed to just a replacement for those tools.

Cons:

Product: For account discovery and onboarding, and credential management, Netwrix does the basics well, but has very limited support for advanced scenarios involving nonstandard service accounts, shadow admin accounts or Secure Shell (SSH) keys.
Customer experience: Netwrix does not offer fixed-price and scope-implementation packages beyond a simple one-day "jump-start" package with an additional customized professional services engagement. On-site training is also only available through the procurement of professional services.
Pricing: Since last year's Magic Quadrant, Netwrix's pricing has been simplified for its new offering; however, it is priced above average compared with the market, across multiple pricing scenarios.
Business strategy: Netwrix acquired four companies in 2022, among them Remediant, which is now part of Netwrix's PAM offering. While PAM product integration has made quick and large strides, the overall rapid pace of these acquisitions may create some distraction.

One Identity - Visionary

Pros:

Product: One Identity received one of the highest scores in the market for privileged session management and remote access, and for PEDM for UNIX/Linux and macOS.
Customer experience: One Identity scored well in customer experience, assigning an account manager and a success manager to each One Identity account.
Product: Customers consistently call out the ease of use and deployment for One Identity's Safeguard products.
Sales and geographic strategy: One Identity has new sales strategies focusing on improved partner assets. Due to a revamped vendor-to-partner information delivery system, providing immediate on-demand updates and release information, it has seen an uptick in new partners. If executed properly, this could lead the product revenue back to growth.

Cons:

Viability: One Identity's PAM revenue has hardly grown over the last year.
Operations: The vendor has gone through significant changes in its executive team over the last year.
Offering strategy: This year, One Identity's roadmap is less focused on core PAM improvements like JIT use cases. It is more focused on catch-up items, such as enhancing its privileged account discovery capabilities and adding System for Cross-Domain Identity Management (SCIM) support to simplify managing users for the PAM tool.
Product bundling/packaging: Clients looking for a single tool for comprehensive PAM functionality, may find One Identity's strategy confusing. One Identity's core PAM tool is dependent on additional One Identity products for extending functionality. For example, Active Roles is required for JIT privileged access, and the One Identity IGA tool is required to expand life cycle management and auditing.

Saviynt - Niche Player

Pros:

Product: Saviynt does well in the areas of privileged account life cycle management, account discovery and onboarding, ease of deployment, administration and maintenance, adjacent system integration performance and scalability, availability, and recoverability, and CIEM functionality.
Product: Unique to Saviynt, CPAM users get Saviynt IGA functionality for all licensed privileged users at no additional cost.
Customer experience: Customers consistently called out appreciation for advanced features such as threat monitoring and comprehensive JIT privilege management.
Business model and operations: Saviynt scored well for its business model, landing new funding in the past year, and achieving FedRAMP authorization (moderate) for CPAM. It also aspires to expand its global footprint.

Cons:

Product: Saviynt's session management capabilities are below average, lacking specialized controls for databases and file transfers. In addition, its CPAM product leverages a built-in, open-source version of HashiCorp's Vault, which places an additional burden on its operation when the solution is privately managed.
Pricing: Saviynt's pricing is consistently among the highest of the vendors in this Magic Quadrant across multiple pricing scenarios.
Market responsiveness: The broader PAM market addresses continuous client interest in host-based PEDM tools for UNIX/Linux and Windows, however, Saviynt does not and does not have them roadmapped.
Product strategy: Saviynt still lacks native secrets management capabilities, although they are roadmapped.

WALLIX - Visionary

Pros:

Product: WALLIX offers a mature and feature-rich session management product and has extensive capabilities for filtering session controls, recording and live session auditing. It also evaluated well for adjacent system integration and has advanced capabilities for managing file transfers, including the ability to authorize inbound and outgoing transfers through workflows, and automatic scanning of files.
Product: WALLIX has a best-in-class tool for OT/process control networks with the ability to tunnel through proprietary OT protocols.
Pricing: Pricing is highly competitive, with quotes below the average for all evaluated scenarios.
Customer experience: Clients often highlight efficient and timely support, and also comment positively on the solution's ease of use.

Cons:

Product: WALLIX continues to lack password rotation connectors for most noninteractive machine and service account scenarios, and has no plans to address this shortcoming. WALLIX also has limited account discovery features as it is focused mostly on AD scanning.
Operations: While the overall number of employees remained essentially the same, Gartner has noted a reduced number of staff devoted to R&D compared to last year.
Product strategy: SaaS versions of the Bastion and BestSafe products have been on the roadmap for several years now, and investments in PAM seem to be mainly focused on expanding the functionality of the OT PAM offering.
Geographic strategy: Although WALLIX is popular in EMEA, its footprint in other regions is still small.

FAQs

Q: Which vendors are Leaders in 2023?

A: BeyondTrust, CyberArk, Delinea

Q: What does "Leader" mean in MQ terms?

A: PAM Leaders deliver a comprehensive toolset for administration of privileged access. These vendors have successfully built a significant installed customer base and revenue stream, and have high viability ratings and robust revenue growth. Leaders also show evidence of superior vision and execution for anticipated requirements related to technology, methodology or means of delivery. Leaders typically demonstrate customer satisfaction with PAM capabilities and/or related service and support.

Q: How do I interpret a Gartner Magic Quadrant?

A: https://www.gartner.com/en/research/methodologies/magic-quadrants-research

Report:

Top Vendor Products for Privileged Access Management in 2023

Privileged Access Management Vendor Product Comparisons 2023

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2023?

Q: What does "Leader" mean in MQ terms?

Q: How do I interpret a Gartner Magic Quadrant?

Reference