Hey everyone. I've been lurking here for a bit, trying to get a handle on all this PAM stuff. My team (small e-commerce infra) used Thycotic (now Delinea) Secret Server for a few years, and we recently moved to BeyondTrust because of a bigger company-wide security push. Everyone talks about BeyondTrust like it's the obvious upgrade, but honestly? For our specific needs, it feels like a step backwards.
In Thycotic, the main thing we loved was how straightforward it was to manage our Shopify API keys, database passwords, and server logins. We could set up a secret, assign it to a group, and people could request access with a click. The approval workflow was simple and right there. With BeyondTrust, everything feels... scattered. The interface is way more complex, and what we used to do in one or two clicks now takes navigating through multiple modules. It feels like it's built for massive enterprises, not for a small team where everyone wears multiple hats.
Our biggest pain point is the session management for our cloud servers. In Thycotic, launching a connection was quick. In BeyondTrust, the jump client setup and the extra policy layers have added so much friction. Our developers are complaining that it takes them twice as long to get into a system for routine checks. Also, the reporting feels overcomplicated for what we need—sometimes we just need a simple "who accessed what" list, not a dozen different audit reports.
I guess I'm wondering if we set it up wrong? Or is this just the reality of moving to a "more powerful" platform? Has anyone else made this switch and found workarounds to make it feel simpler? I keep feeling like we're not using it "right," but the learning curve is pretty steep. Maybe it's just not the best fit for a smaller use case?
I'm a lead cloud engineer at a 150-person SaaS company, and we've been running Delinea Secret Server for about three years to handle secrets for our Python and Node services across AWS and GCP.
Here's a direct breakdown from my experience with both platforms:
1. **Target User Fit:** Delinea is built for teams of 20-500 who need secrets and session access without a dedicated PAM admin. BeyondTrust is designed for enterprises with 1000+ employees and dedicated security analysts; its policy granularity creates overhead for smaller teams.
2. **Real Pricing:** Delinea's tiered SaaS model is clearer. At our scale, we landed around $7-9 per user per month for the core secret management and session recording. BeyondTrust often quotes a per-*asset* or per-*connection* model in initial talks, which for a cloud-heavy shop can balloon costs 30-40% over the user-based quote once you map everything.
3. **Session Connection Friction:** This was our dealbreaker too. A Delinea RDP session launches in the browser in about 8 seconds. BeyondTrust's architecture, with its Jump Clients and Connection Brokers, added 20-25 seconds of latency and required a separate agent health dashboard we had to monitor.
4. **API and Automation Clunkiness:** For managing our CI/CD secrets, Delinea's REST API is straightforward and aligns with modern app patterns. BeyondTrust's API feels like a later addition; we had to make 2-3 calls to accomplish what was one call in Delinea, and the PowerShell module was our only option for some tasks.
For a small e-commerce infra team managing Shopify keys and cloud logins, I'd stick with Delinea every time. It's the right tool for the job. If your company mandate forces a switch, I'd need to know the exact size of your secret inventory and whether you're required to use BeyondTrust's full privileged remote access for compliance, as there are ways to minimize the module sprawl.
Prompt engineering is the new debugging