Report:

Magic Quadrant for Privileged Access Management

Top Vendor Products for Privileged Access Management in 2024

• BeyondTrust
• CyberArk
• Delinea

Privileged Access Management Vendor Product Comparisons 2024

• BeyondTrust - Leader
  

  Pros:

  • Product: BeyondTrust is best in class for UNIX/Linux and macOS PEDM, and a top performer for Windows PEDM, including strong methods for application controls. For the Total PASM bundle, clients comment favorably on discovery features, smart rules and ease of use.
  • Customer experience: BeyondTrust scores high for customer experience where it boasts customer support teams with a wide range of expertise. Every customer is assigned an account team that includes different levels of support, from customer success managers to technical professionals.
  • Product strategy: The bundle of PS and PRA provides strong account discovery and onboarding, privileged session management and remote access features.
  • Product and operations: Improvements in ease of deployments include analytics with correlation of identity data from identity providers (IdPs) and cloud infrastructure platforms (CIPs). Also, customers have flexibility to schedule updates when using BeyondTrust's SaaS solution. It also offers extensive out-of-the-box ITSM and other adjacent system integrations.

  Cons:

  • Product: Despite BeyondTrust's above-average performance in account discovery mechanisms for operating systems accounts, it is trailing behind some of the other vendors in this research due to its lack of discovery for shadow admin accounts and private Secure Shell keys.
  • Pricing: BeyondTrust's pricing remains higher than the market average, especially for its software PAM offerings. Enhanced JIT functionality requires the purchase of an additional product, Entitle, which further escalates costs.
  • Product: BeyondTrust's offering for workload identity and secrets management provides only rudimentary capabilities, although it is included without extra charge for all clients that purchase Password Safe stand-alone or as part of the Total PASM bundle.
  • Reporting and auditing: BeyondTrust continues to lack the ability to provide information for troubleshooting and guidance to resolve issues beyond just logging, and its provision of relevant health reporting in customer environments is immature for administrative reporting and auditing purposes.


• CyberArk - Leader
  

  Pros:

  • Product: CyberArk's PAM solution is mature and highly capable across the various use cases evaluated, mainly PASM, Windows PEDM, workload identity and secrets management.
  • Market responsiveness: CyberArk has invested heavily in workload identity and secrets management for the past few years. The outcome is a broad set of technical capabilities that can address client needs across virtually every scenario evaluated.
  • Geographical strategy: CyberArk has a robust global presence with its customers spread all across the globe.
  • Innovation: CyberArk has delivered a number of significant updates since last year's Magic Quadrant, such as improving group-membership-based JIT, and adding native database access through its Dynamic Privileged Access (DPA) module.

  Cons:

  • Product: Configuration and management of the self-hosted components of CyberArk's PAM solution are usually complex. There have been some improvements to the upgrade process, but major upgrades may require extensive vendor support.
  • Pricing: A common complaint from clients is about cost — CyberArk's products are among the most expensive on the market — and it no longer offers additional discounting for customers who opt for a multiyear deal over a one-year deal.
  • Customer experience: While customer experience is still overall positive, CyberArk customers identify customer support and timely responsiveness as areas the vendor could improve.
  • PEDM: File integrity monitoring for UNIX/Linux, as well as centralized sudo management, are limited compared to other leaders. Native AD bridging is available only for OPM (which is no longer sold for Linux). CyberArk does not support the application of Windows group policy objects (GPOs) for UNIX/Linux and macOS.


• Delinea - Leader
  

  Pros:

  • Product: Delinea has a very competent PEDM offering for UNIX/Linux that scored among the top vendors of those evaluated.
  • Overall Viability: Delinea's revenue and customer count growth was one of the highest among all vendors included in this research.
  • Customer experience: Delinea's customers consistently commend the user-friendly nature of its products. It offers unified engines and connectors to a single management plane and comprehensive coverage on health reporting.
  • Geographical strategy: Delinea has built a strong geographical presence and intends to enhance its global customer reach by strengthening local operational support in APAC, Japan and LATAM.

  Cons:

  • Product: Remote Desktop Protocol (RDP) video session metadata recording requires installation of local agents on target servers, which most other evaluated vendors don't require.
  • Pricing: Although Delinea introduced a new pricing model to consolidate all of its SaaS products into a bundled offering, pricing evaluated for a series of scenarios in this research is uneven. Pricing for small and midsize scenarios is below the market average, and pricing for large-size scenarios is above the market average. Windows PEDM pricing is one of the highest compared to alternatives.
  • Product strategy: Delinea has a strategy to present Secret Server as a 'simple to deploy and use' solution and its marketplace for available OOTB integrations grew last year. However, several requirements still need customization through PowerShell, placing an additional burden on customers. Many customers have highlighted the need for improvement in technical support response times.
  • Operations: Delinea recently made two major acquisitions (Authomize and Fastpath), and made a large number of changes to its executive team, which may cause some inconsistencies in execution until the dust settles.


• ARCON - Challenger
  

  Pros:

  • Product: ARCON's offering is the most capable of all vendors evaluated, with every capability evaluated above — and often well-above — the average. Two core features where Arcon scores the highest are account discovery and just-in-time (JIT) PAM; Arcon demonstrated notable improvements in the ephemeral credential JIT use case.
  • Pricing: ARCON's pricing is competitive. In most pricing scenarios, especially for PASM, ARCON is more affordable than other vendor offerings in this research. In PEDM and secrets management scenarios, pricing is around average and sometimes higher than average, especially for its software offering.
  • Customer experience: ARCON excels in customer experience, earning one of the highest scores in this research. 24/7 support is included for all customers, a technical account manager is available at no additional cost as well as a complimentary product training program.
  • Overall Viability: ARCON's PAM customer growth in the last fiscal year was one of the highest among the vendors evaluated in this research.

  Cons:

  • Product: Arcon provides limited out of the box (OOTB) preconfigured integration with IT service management (ITSM) tools, or the kind of identity governance and administration (IGA) tools compared to other vendors included in this research.
  • Market responsiveness: Arcon did not demonstrate response to evolving market dynamics for new regulations or legislations this year like NIS 2 and the Digital Operational Resilience Act (DORA).
  • Geographical strategy: Though ARCON is trying to expand its customer base in the U.S., it currently lags behind other vendors within this Magic Quadrant, in terms of prominent presence in the Americas and Europe.
  • Sales strategy: Arcon's channel partner network has limited global penetration compared to most other vendors included in this research.


• ManageEngine - Challenger
  

  Pros:

  • Pricing: ManageEngine pricing is consistently less than market averages. It offers a distinctive pricing model based on the number of PAM tool administrators (and not the number of privileged users who perform administrative tasks on the target systems).
  • Product: ManageEngine offers a strong PAM 'break glass' functionality through an encrypted HTML file approach, which can be stored locally or automatically pushed to Dropbox, Box and S3 buckets using its offline access/cloud integration function.
  • Vertical strategy roadmap: ManageEngine is committed to improving its support for government-specific needs. As part of its plan, it is working on a specialized version of its PAM360 product that will include controls tailored to meet the unique requirements of government clients.
  • Business Model: ManageEngine claims to invest over 50% of its revenue into R&D initiatives, but has a product roadmap designed to catch up on product capabilities, as well as to stand out in other areas such as managing privileged access for IoT/OT devices.

  Cons:

  • Product: ManageEngine's JIT PAM capabilities are immature compared to other vendors. There were no improvements in session management and in out-of-the-box connectors for adjacent system integrations including IGA, which is a common integration among PAM vendors.
  • Product strategy: ManageEngine still does not offer a SaaS version of its PAM product, but this is included in its roadmap.
  • Operations: ManageEngine lacks certifications that are common among other vendors, such as Federal Information Processing Standards (FIPS), a focus on encryption, or the Common Criteria standards.
  • Product strategy: ManageEngine's roadmap does not address long-standing product gaps compared to the market. PAM360 is below the average of vendors evaluated for privileged credential management, workload identity and secrets management, and UNIX/Linux PEDM.


• Broadcom (Symantec) - Niche Player
  

  Pros:

  • Product: Broadcom offers a very competitive PEDM product for Windows and UNIX/Linux. Its performance and scalability, availability and recoverability capabilities are strong for PASM, including excellent clustering and high-availability features that support the addition of nodes without having to take a cluster down.
  • Pricing: Symantec PAM is priced competitively, with almost all scenario pricing below — and sometimes well below — the average for the market as a whole. In addition, Broadcom offers its top clients portfolio license agreements, which may offer additional savings.
  • Geographic strategy: Broadcom maintains a strong global presence and continues to offer dedicated support to its PAM clients in different regions.
  • Product: Broadcom scores above average for performance and availability features. It offers robust support for very large PAM implementations with a streamlined approach to scale up proxies, jump boxes or bastion servers, and it can support a large number of concurrent sessions for enterprise scalability.

  Cons:

  • Marketing strategy and execution: Given that Broadcom is focused on its top customers, market strategy and execution is relatively weaker than other vendors evaluated in this research. Broadcom has few media or marketing channels to promote its PAM products to gain new customers.
  • Product: For complex service account credential management, Broadcom customers still have to develop custom connectors, whereas other vendors offer out-of-the-box connectors. Privilege credential management and JIT PAM were also less mature compared to other vendors evaluated in this research.
  • Innovation/roadmap: Broadcom innovations since the last publication of this Magic Quadrant were limited to minor incremental enhancements of existing products like new dashboards and additional API functions.
  • Product strategy: Broadcom is the only vendor in this Magic Quadrant that has not yet provided, developed or roadmapped a SaaS offering for its PAM product.


• Netwrix - Niche Player
  

  Pros:

  • Product: JIT privileged access functionality is among the most capable of all vendors evaluated. Privileged session management and Windows PEDM functionality is also competitive.
  • Innovation: Netwrix had one of the highest scores for innovation in this research. Notable innovations since the last Magic Quadrant include a JIT approach for database access, and new health checks for privileged access review and auditing.
  • Marketing understanding: Netwrix has a unique angle on the PAM market with a bring-your-own-vault approach, allowing the company to position itself as an enhancement to existing PAM tools as opposed to just a replacement for those tools.
  • Marketing execution: Netwrix has developed a solid narrative around its brand and specifically targets its marketing toward the benefits of zero standing privileges, rapid deployment and ease of use.

  Cons:

  • Product: Apart from JIT privileged management, Netwrix's offering underperforms in most other evaluated technical capabilities, and is especially weak in privileged credential management and remote access.
  • Pricing: Netwrix is priced above the market average compared to other vendors included in this research, across multiple pricing scenarios.
  • Product strategy: Netwrix still does not offer a SaaS version of its PAM products and it pushed a few roadmap items planned for 2024 to 2025, which includes promised out-of-the-box integration with ITSM tools.
  • Overall viability: Netwrix's PAM revenue and customer count growth in the last fiscal year were some of the lowest among the vendors evaluated in this research.


• One Identity - Visionary
  

  Pros:

  • Product: One Identity received some of the highest scores in the market for privileged session management, account discovery and onboarding, and for PEDM for UNIX/Linux and macOS.
  • Customer experience: One Identity's PAM solution receives praise from customers for its user interface, deployment process and management features.
  • Innovation: One Identity scores above average for innovation, which includes a new lightweight PAM SaaS-based offering for midsize enterprises and enhancements to its existing remote PAM features.
  • Sales and geographic strategy: One Identity scores above average for sales and geographic strategy. It offers an extensive channel partner network across the globe due to a revamped vendor-to-partner information delivery system, providing immediate on-demand updates and release information. It has also seen an uptick in new partners.

  Cons:

  • Product bundling/packaging: Clients looking for a single tool for comprehensive PAM functionality, may find One Identity's strategy confusing. One Identity's core PAM tool is dependent on additional One Identity products for extending functionality. For example, One Identity IGA tool is required to expand life cycle management and auditing, and to provide CIEM functionality, and Active Roles is required for extending JIT functionality, such as mapping network drives.
  • Pricing: One Identity's pricing remains higher than the market average, especially for its SaaS PAM offerings.
  • User experience: One Identity offers only separate interfaces for its PASM, PEDM, RPAM, CIEM and secrets management tools.
  • Overall viability: One Identity had some of the lowest revenue and customer count growth among the vendors evaluated in this research for its PAM products in the last fiscal year.


• WALLIX - Visionary
  

  Pros:

  • Product: WALLIX received one of the highest scores in the market for privileged remote access and session management. For RPAM, its WALLIX One Remote Access is one of the strongest in the market offering support for all major session management protocols including universal tunneling through TCP. Identity administration, authorization, session collaboration and file transfer capabilities for remote privileged scenarios are also mature.
  • Vertical industry strategy: WALLIX stands out with one of the highest scores for its vertical strategy, demonstrating a significant presence across a wide range of industry verticals (with best-in-class support for operational technology and industry control systems), as well as manufacturing, banking, securities and insurance, and government.
  • Product: WALLIX offers a meaningful PAM break-glass approach where it can run a scheduled task to send break-glass credentials over encrypted emails periodically.
  • Customer experience: Clients often highlight efficient and timely support, and also comment positively on the solution's ease of use.

  Cons:

  • Pricing: WALLIX changed its pricing model in 2024 and increased the price of its PAM products. As a result, its pricing is consistently above market averages compared to competitors across various pricing scenarios evaluated in this research.
  • Product: WALLIX continues to lack password rotation connectors for most noninteractive machine and service account scenarios, and has no plans to address this shortcoming. WALLIX also has limited account discovery features (it is focused mostly on active directory scanning) and has stopped offering them as a separate tool for free download.
  • Geographic strategy: WALLIX has a strong presence in Europe, but its geographical expansion is nascent in comparison to other vendors in this research.
  • Product: WALLIX has relatively immature JIT PAM capabilities, where it is still dependent on workflow/ITSM integrations.

Reference

• Gartner, Magic Quadrant for Privileged Access Management, 09-Sep-2024, ID G00802036

View Market Definition
View Vendor Movements