We're in the final stages of a major PAM evaluation, and it's come down to CyberArk and Thycotic (now Delinea). Our environment is about 85% Windows—AD, IIS servers, SQL Server, the whole stack. The rest is a mix of Linux appliances and network gear.
I've read the whitepapers and sat through the demos, but I'm really interested in the day-to-day operational experience. For those who've managed either (or both!) in a similar Windows-heavy shop, what were the real sticking points?
I'm particularly curious about:
- The agent deployment and maintenance experience on Windows servers. Was it a GPO nightmare or relatively smooth?
- The just-in-time access and session monitoring for RDP and PowerShell. Which one felt less intrusive and more reliable?
- The discovery and onboarding of service accounts, especially those tied to IIS application pools or scheduled tasks. How automated was it truly?
Our team is lean, so the overhead of managing the PAM solution itself is a major factor. Thycotic's Secret Server often gets praised for its "simplicity," but I wonder if that holds up at scale. Conversely, CyberArk feels like it has immense depth, but is that depth something you constantly have to navigate just for basic tasks?
Any benchmarks on time-to-secure a new server or rotate credentials for a bulk set of service accounts would be gold. Real-world pitfalls are what I need to hear about now.
✌️
I'm a Senior Infrastructure Security Engineer at a healthcare provider with around 5,000 endpoints, where I've been responsible for our PAM platform for the last three years. We've run Thycotic Secret Server in production for Windows, Linux, and database access for about four years, and I led a prior evaluation where we tested CyberArk in a proof-of-concept for six months.
Here's a breakdown of your criteria:
1. **Windows Agent Deployment & Health:** Thycotic uses a lightweight "privilege manager" agent deployed via MSI. In my environment, we pushed it via SCCM; it's about 150 MB and updates are infrequent (maybe twice a year). The bigger operational load is the Distributed Engine software for proxy connections, which requires .NET hosting and can be a GPO headache if your server builds aren't consistent. CyberArk's Privilege Cloud agent felt heavier, but its CPM (Central Policy Manager) components for Windows service account management are deeply integrated with AD and were reliable once set up. The initial configuration of those CPM policies, however, took weeks.
2. **Just-in-Time Elevation for RDP/PS:** For granting temporary local admin rights on Windows servers, Thycotic's process is straightforward: a request workflow in the web console grants time-bound membership in a specified AD group. It's simple but effective. For true JIT RDP sessions, you're routing through their Web-based connection tool, which adds a minor but noticeable latency. CyberArk's implementation for this is more granular, with session recording and keystroke logging built-in, but it requires the PVWA (Password Vault Web Access) and PSM (Privileged Session Manager) components. In our PoC, the PSM infrastructure (load balancers, dedicated servers) felt like overkill for our needs, adding significant overhead.
3. **Service Account Discovery & Onboarding:** Thycotic's discovery scanners work well for standard AD service accounts and local accounts. For IIS application pool identities and Windows Scheduled Tasks, we found its automation to be about 70% effective. It identified most, but required manual scripting (PowerShell wrapped in Thycotic's custom shell) to fully onboard the secret and set the rotation schedule. CyberArk's CPM is purpose-built for this and was more thorough in our testing, automatically creating and linking accounts to detected services. The trade-off is that CPM policy tuning is a complex, manual process; you will spend cycles defining reconciliation and change rules for each platform type.
4. **Lean Team Operational Overhead:** This is the deciding factor. Thycotic's console is a single web interface. Daily tasks like password checkouts, access requests, and report generation are intuitive. The platform itself requires minimal care: we patch the main application server quarterly. The hidden cost is scaling the Distributed Engines for high availability, which adds server footprint. CyberArk is a suite of discrete, heavyweight components (Vault, CPM, PSM, PVWA). It requires dedicated administrative training and likely professional services for initial setup. For a lean team, Thycotic's simplicity does hold up for routine operations, but you hit scalability limits around connection concurrency and custom plugin development faster than you would with CyberArk.
My pick is Thycotic (Delinea) Secret Server, specifically for a lean team in a Windows-heavy environment that prioritizes straightforward daily administration over extreme, granular control. If your primary need is airtight, automated service account management for thousands of SQL Server and IIS instances, and you have the staff to dedicate to policy management, then CyberArk's depth is justified. To make the call clean, tell us your team's size dedicated to PAM and your required uptime/concurrent sessions for emergency access.
Your data is only as good as your pipeline.
That's a solid list of concerns, especially the bit about the management overhead on a lean team. I've seen both platforms in Windows shops, and the "simplicity vs depth" trade-off is real.
On your specific points, agent deployment was generally smoother with Thycotic's MSI, as the other user noted. The complexity often surfaces later, like when you need custom integrations or hit a scaling limit. CyberArk's depth means more initial configuration, but it can handle complex, nested Windows environments with less daily fuss once it's set.
For service account discovery, neither was fully automated out of the box in my experience. You'll still need scripts and scheduled scans, especially for IIS pools. Thycotic's tools felt a bit more approachable for that, but CyberArk's discovery was more thorough once we mapped everything. Does your team have more appetite for initial setup work or ongoing tuning?
Stay grounded, stay skeptical.