I'm setting up a lab to manage network device access for a small team. We're using Cisco gear, so their native TACACS+ solution is the obvious starting point. But I keep seeing CyberArk's Privileged Session Manager (PSM) mentioned for this.
I understand PSM is more about proxying and monitoring sessions, while TACACS+ is straight-up AAA. For those who've used both, where does PSM really add value in a network context? Is it mainly for the session recording and keystroke logging, or are there integration benefits I'm missing?
On the flip side, TACACS+ seems simpler and is baked into the platform. I'm trying to weigh the overhead of a full PAM suite against a more focused vendor tool.
I run infrastructure security for a 3000-person global manufacturer. We have Cisco TACACS+ in production for our network devices, and we've tested CyberArk PSM alongside it.
- **Deployment and Upkeep:** Native Cisco TACACS+ is a 2-3 day rollout for a standard set of device types. CyberArk PSM's connector model for network devices adds a proxy hop, which is a 2-week project for initial configuration and testing. Every IOS upgrade needs a PSM connector review.
- **Audit and Compliance Value:** TACACS+ gives you command logs. PSM gives you full session video and keystroke logs. For us, that meant PSM cut our forensic time for access investigations from hours to under 10 minutes. If you're in a regulated industry, that's the entire business case.
- **True Cost:** Cisco TACACS+ is effectively "free" if you have ISE or an ACS appliance. CyberArk PSM is part of their PAM suite, which starts around $50k for a minimal deployment. The licensing is based on privileged accounts, not users.
- **The Breaking Point:** PSM's session proxying adds 80-120ms of latency to every connection. For most CLI work it's fine, but it breaks automated scripts that use SNMP or NETCONF with tight timeouts unless you adjust them globally. TACACS+ has no perceptible latency.
I'd pick TACACS+ for a lab or a team just needing reliable AAA. I'd only go for PSM if you have a compliance requirement for immutable session recording. To decide, tell us if you need to pass audits like PCI DSS 8.x or SOX, and whether your team runs any automated network config scripts.
Your CRM is lying to you.
Your framing is correct, but you're undervaluing the workflow integration. The session recording is the visible output, but the core addition is the policy engine that sits between the user and the TACACS+ server.
You can use PSM to inject real-time command vetting or require a ticket number for specific high-risk commands. TACACS+ authenticates and logs, but it doesn't actively interrupt a session based on live context. For a lab, this might be overkill, but it's the difference between passive logging and active session control.
The overhead is real, though. You're not just managing Cisco IOS, you're managing CyberArk's interpretation of it through connectors. That abstraction layer is where the extra value and the extra maintenance both live.
The point about it being more focused is key. In a lab, the overhead of managing those PSM connectors might outweigh the session recording benefits, especially if your team is small and you're focused on learning the AAA fundamentals.
But does anyone use PSM specifically for a lab's audit trail? I'm curious if the session replay has value when you're trying to show a new team member why a config change broke something, versus just having the command logs.
Using PSM for lab audit trails is solving a problem you don't have. The "why" a config broke is in the command log and the resulting config diff, not a video of someone typing.
If your goal is learning AAA fundamentals, the extra abstraction layer will teach you more about managing CyberArk connectors than about TACACS+ itself.
Your stack is too complicated.