Best PAM for mid-market companies under 500 users

Having spent considerable time architecting integrations for mid-market ERP and CRM systems, I've observed a significant gap in Privileged Access Management (PAM) solutions that cater specifically to the 100-500 user segment. The enterprise-grade tools are often over-engineined and administratively heavy, while lighter solutions lack the robust API and event-driven capabilities necessary for seamless integration into existing security and IT workflows.

When evaluating CyberArk for this context, several architectural considerations come to the forefront:

* **Core PAM Capabilities vs. Administrative Overhead:** The vaulting, session management, and credential rotation are industry-standard. However, the critical question is the operational cost. For a mid-market company, the ratio of privileged accounts to total users is often different, and the internal team managing the PAM is likely wearing multiple hats.
* **API-First Design for Automation:** This is my primary lens. Can the entire lifecycle—onboarding of new systems, account discovery, access request workflows—be automated via REST APIs? A mid-market company cannot afford manual provisioning.
* Example: Automating the onboarding of a new SaaS admin account should be a single API call or a webhook event from your IdP, not a manual form submission.
* **Webhook & Event-Driven Integration:** The system must publish granular, actionable security events (e.g., `privileged.session.started`, `password.rotated.failed`) to a message bus or webhook endpoint. This is non-negotiable for building a cohesive security posture. For instance:
```json
{
"eventType": "vault.account.checkedout",
"accountName": "aws-root-account",
"requestingUser": "admin@example.com",
"system": "AWS-Production",
"timestamp": "2023-10-26T15:45:12Z"
}
```
* **Data Synchronization & Middleware:** How does CyberArk's PAM data (users, accounts, sessions) sync with other systems of record (e.g., ITSM, SIEM, HRIS)? Is there a clean, bi-directional sync, or does it require complex, fragile middleware? The "connector" ecosystem is vital.
* **Pricing & Scaling Model:** The per-feature modular pricing of enterprise suites can become prohibitive. A transparent, user-based (or better yet, privileged-account-based) scaling model is crucial for predictable budgeting.

I am interested in concrete experiences from those who have implemented CyberArk in environments under 500 users, particularly regarding the following integration points:

* The practical use of the **REST API** and **CLI** for daily automation versus reliance on the GUI.
* Building a **custom approval workflow** that ties into existing communication channels (e.g., Slack, Teams).
* Real-world data on **time-to-value** and the FTE commitment required for ongoing maintenance.
* Any experiences with their **Cloud Platform** offering versus self-managed infrastructure in this market segment.

The ideal tool would provide enterprise-grade security primitives but with the integration and operational simplicity of a modern SaaS platform. Does CyberArk's evolution in this direction align with the mid-market's practical constraints and resource realities?

-- Ivan