Let's cut through the marketing haze. I've seen three different small to mid-size shops in the last year convinced by a sales rep that they needed BeyondTrust's Privileged Remote Access (formerly Bomgar) gateway for their RDP/SSH management. In each case, after the initial sticker shock wore off, they spent six figures on licensing and dedicated VMs only to achieve what a few lines of configuration and a fraction of the cost could have accomplished.
The core value proposition—a secure, audited, web-based gateway for remote access to internal systems—is sound. For a sprawling enterprise with thousands of admins and regulatory tape, maybe. For a team of 10-50 engineers managing a couple hundred servers? It's architectural overkill, a classic case of buying a sledgehammer to hang a picture.
Consider what you're actually paying for:
* A reverse proxy that tunnels RDP/SSH over HTTPS.
* Session recording and audit logging.
* A basic permission model (who can access which host).
* A centralized jump host/bastion pattern.
Now, let's look at a cloud-native, operational cost approach for a small team already on AWS. You could build the functional equivalent in an afternoon. A simple architecture leveraging services you're likely already paying for:
```yaml
# Simplified CloudFormation / Terraform concept:
# 1. An Application Load Balancer (SSL termination, ~$20/month)
# 2. Targets: AWS Systems Manager Session Manager (no inbound ports!)
# 3. Or, targets: EC2 running Apache Guacamole (open-source HTML5 gateway) in an ASG.
# 4. IAM policies & SSO for authentication/authorization.
# 5. CloudTrail + S3 for audit logs of IAM calls (already enabled).
# 6. Cost: ALB + minimal compute. Likely under $100/month all-in.
```
The auditing argument falls flat when you realize CloudTrail, AWS Config, and native OS logging (sent to a central SIEM) give you more granular data without a proprietary format. The "no open ports" security claim? AWS SSM Session Manager has done that for years, for free beyond your EC2 costs.
The real pitfall is the operational lock-in and the perpetual licensing. Your workflow now bends to their portal. Need to automate a bulk session? Better hope their API fits your use case. The moment you scale or change your infra pattern, you're back at the negotiation table.
I'm not saying BeyondTrust is *bad*. It's a polished product. But for a small team, the cost-to-value ratio is severely misaligned. You're paying for a monolithic, all-in-one suite when you likely need two or three discrete, composable services. That capital is better spent on training your team on secure, native cloud patterns or funding actual feature development.
keep it simple
Lead SRE at a 150-person SaaS shop on AWS, and I've managed both vendor and DIY bastion setups for our ~200 node EKS clusters and other internal services.
**Real Fit:** BeyondTrust is built for F500-scale with dedicated security teams. Our 10-person platform team hit a 6-figure quote for 25 admins. For teams under 50, you're paying for air traffic control to manage a dozen paper airplanes.
**Cost Reality:** The license cost was ~$175/user/month for the Privileged Remote Access module. That's before the 3-4 dedicated m5.xlarge VMs (~$250/mo each) they require for HA, making the true operational cost over $600/user/year. A DIY alternative runs on infra you already have.
**Deployment & Integration:** Standing up their virtual appliance took us two days. Integrating it with our existing IdP (Okta) for SAML was straightforward, but syncing host inventories or defining fine-grained access policies required constant API fiddling. It's not "set and forget."
**Where the DIY Approach Breaks:** You lose the polished, unified audit trail. With separate tools, correlating an SSH session log from OpenBastion, an RDP recording from Guacamole, and a k8s exec session from a kubectl-oidc setup is manual work. BeyondTrust's session replay is its one killer feature for compliance.
My pick: For a small team that just needs secure access without a compliance checkbox, build on what you've got. Use AWS Session Manager for SSH/SCP to EC2 and ECS, and Apache Guacamole for the odd Windows RDP need. If you have auditors demanding a single pane of glass for session recording, then look at BeyondTrust. Tell us if you're in a regulated industry and what your team's tolerance is for maintaining your own access glue code.
> You lose the polished, unified audit trail.
That's the central trade-off. For us, that audit trail isn't worth six figures a year.
We standardized on SSM Session Manager for EC2 and AWS CLI for EKS (`kubectl` execs go to CloudTrail). It's not a single pane, but the logs are in one place (CloudWatch) and tagged with the same IAM identity. For the handful of non-AWS systems, a small OpenBastion instance covers it.
The cost difference funds two extra headcount on the team. The audit trail is good enough for our compliance requirements (SOC2). If it wasn't, we'd be in enterprise territory anyway.
Trust, but verify
Exactly. That functional equivalent you mentioned is often hiding in plain sight within the cloud platform you're already using. I've seen teams reach for a vendor appliance before fully exhausting the native capabilities they're already paying for.
The real kicker for me is the operational drag of those dedicated VMs. They become another set of pets to manage, patch, and backup, adding silent cost beyond the license. Even a simple HAProxy setup on existing, auto-scaled compute can achieve the same reverse proxy goal without introducing new snowflake infrastructure.
The sales pitch around a single pane of glass is powerful, but at a small scale you're often just trading one kind of fragmentation (multiple logs) for another (a separate management silo). Why not spend that afternoon scripting a unified query across CloudTrail, VPC flow logs, and your existing IDP instead?
~jason