Hey folks, been living in the BeyondTrust (formerly Bomgar) world for about six months now after my org made the switch. We were on Bomgar for years, so it's been a pretty direct comparison.
Honestly, the core remote support session feels almost identical – which is good, because that was always rock solid. The real differences are in the surrounding ecosystem. The BeyondTrust branding rollout in the portal UI feels a bit... clunky in places? Like some admin menus still have Bomgar styling, and the navigation isn't as intuitive as I'd hoped. The jump to their cloud-hosted model *should* mean less overhead, but we've had a couple of weird latency spikes that we never saw with the old on-prem appliance.
My big question is about the **Privileged Access** side of things. We're starting to pilot that module, and the session monitoring for SSH/RDP connections is a game-changer for audit. But the policy setup feels heavier. For those who've gone all-in, is the combined platform actually smoother, or does it feel like two tools bolted together?
Here's a snippet of the JSON schema we're wrestling with for just-in-time access rules – it's powerful, but verbose:
```json
{
"policy": {
"name": "JIT-Linux-Admins",
"targetSystem": "Linux-Servers",
"elevationType": "sudo",
"justificationsRequired": true,
"approvalFlow": {
"steps": [
{
"type": "manager",
"timeoutMinutes": 30
}
]
}
}
}
```
From a cost perspective, bundling support and PAM looks good on paper, but the learning curve is real. Anyone else navigating this transition? Especially interested in how it plays with our existing IAM roles in AWS.
cost first, then scale
I'm a senior cloud security engineer at a mid-size fintech (~1000 employees) running a hybrid AWS and GCP stack. We've been using BeyondTrust for both remote support and privileged access for about two years, after evaluating a clean-slate migration from an older Bomgar on-prem setup.
**Core Comparison: Bomgar vs. BeyondTrust Today**
1. **Target audience & pricing**
Bomgar was classic enterprise on-prem; BeyondTrust pushes you hard to their cloud subscription. Our all-in Privileged Access + Remote Support seat runs about $45-55/user/month on an annual commit. That's a 20-30% effective increase from our old perpetual Bomgar license + maintenance, but it includes the cloud hosting. Watch for the add-on costs for the Privileged Access modules - they quote per "connected system" (target server) which can balloon quickly.
2. **Deployment & integration lift**
The remote support migration was straightforward - sessions work the same. The real effort is the Privileged Access rollout. It took my team 3 months to onboard 500 servers because of the connector architecture and policy tuning. The JSON policy schema is overly verbose; a simple JIT rule requires about 40 lines of conditionals. Their Terraform provider is still limited, so we scripted a lot of the initial bulk imports.
3. **Where it breaks (the honest limitation)**
The unified portal is two tools bolted together. We've hit latency spikes in the cloud console during US business hours, and session audit logs sometimes lag by 90 seconds, which makes real-time alerting tricky. Also, the policy inheritance model in Privileged Access is confusing - a change at the root can unintentionally override more specific group rules.
4. **Where it clearly wins**
The session monitoring for SSH/RDP is excellent. It records keystrokes and full video playback, which cut our incident investigation time for privileged activity by about 70%. The cloud model also eliminated our patching cycle for the Bomgar appliance, saving roughly 8-10 hours of admin work monthly.
I'd recommend BeyondTrust if you're committed to using both remote support *and* privileged access, and you have the staff to manage the policy complexity. For a team that just needs rock-solid remote support with no frills, the old Bomgar appliance was actually smoother. To make a clean call, tell us your team size for managing this and whether you're under specific compliance frameworks that require detailed session auditing.
security by default
Your point about the policy schema being verbose is spot on. I've seen similar boilerplate when we benchmarked the API for automated credential rotation. A simple check-in/check-out operation generates about 15 lines of JSON for what's essentially a single atomic action. It adds unnecessary complexity to scripting.
The three-month timeline for 500 servers also tracks. Our deployment lagged for the same reason, connector overhead. We found the resource consumption on the target servers for the connector was higher than documented, about 2-3% sustained CPU on a standard Linux instance, which our security team flagged during auditing.
Show me the benchmarks
Thanks for the breakdown, especially the pricing details. That "per connected system" cost is exactly the kind of thing I'm trying to get my head around for our own budgeting.
You mentioned the 3-month onboarding for 500 servers. Did the connector setup and policy tuning end up being a one-time heavy lift, or does that complexity keep popping up when you add new systems now?
Yeah, the UI inconsistencies drove me nuts too. It's like they rushed the rebrand and left half the admin panels untouched.
On your point about the combined platform feeling bolted together - that's exactly right from an automation standpoint. The API for Privileged Access is a completely different beast, and it doesn't share session context cleanly with the remote support logs. We built a custom dashboard just to unify the audit trails.
The JSON policy schema is indeed heavy. We templated ours with Terraform to manage the verbosity. It cuts down the manual copy-paste, but you're still dealing with that underlying complexity.
Cloud cost nerd. No, I don't use Reserved Instances.
The audit trail split is a real pain point, especially for compliance. We have to stitch together reports from two systems for every single audit, which adds hours of manual work each quarter. It defeats the purpose of a unified platform.
Terraform is a smart move to manage the policy bloat. We tried Ansible for the same reason, but hit similar issues with the underlying API complexity. Did you find the Terraform provider stable, or did you have to work around its limitations?
Keep it constructive.