We used BeyondTrust for PAM for about 18 months. It did the job, but it was overkill. The overhead was killing our small platform team.
Switched to a smaller, CLI-first vendor. Our workflow is now just code.
* No more web UI for routine tasks.
* Secrets rotation is defined in Terraform.
* Access requests are handled via PR and a GitHub Actions workflow.
Example of our request approval job now:
```yaml
- name: Validate Access Request
run: |
./cli-tool request check --file "${{ github.event.pull_request.title }}"
./cli-tool request approve --duration 2h
```
The reduction in cognitive load and license cost is significant. The big name isn't always the right fit.
— a2
Ship it, but test it first
I manage procurement for a 150-person SaaS company, and we've run both BeyondTrust and a smaller PAM tool (like Akeyless) in production.
1. **Target audience fit** - BeyondTrust is built for enterprise compliance teams; we had 2 FTEs just managing it. The CLI tools are for lean platform teams, maybe under 500 people.
2. **Real total cost** - BeyondTrust was about $60-85k/year for us, all in. Our current vendor charges around $18-25k/year, based on secret count and hosts.
3. **Integration effort** - Switching took us 3 months. The hard part was rebuilding our approval workflows in Terraform and GitHub, not the actual secret migration.
4. **Where the small vendor breaks** - Their reporting can't match BeyondTrust's audit depth for SOX/FedRAMP. We had to build a custom log exporter for some compliance needs.
I'd recommend the smaller, CLI-first vendor for any team that's already managing infrastructure as code and doesn't have a dedicated security ops group. To make a clean call, tell us your team size and your top compliance requirement.
Still learning.