I've been helping a few teams implement CyberArk over the last year, and one consistent pain point has surfaced: the default session recording retention period. Out of the box, I believe it's set to 90 days for most components, and that's just not cutting it for many compliance frameworks.
While I understand storage costs are a real concern, several regulations and internal audit policies explicitly require a minimum of one year of retention for privileged activity logs. I've seen teams scramble to build custom archival solutions or invest in third-party SIEM integrations just to meet this gap. It feels like an unnecessary hurdle right out of the gate.
What's the community's experience here? Have you successfully negotiated longer retention periods with your CyberArk reps, or have you found a more elegant workaround using the built-in tools? I'm curious if others find this default as limiting as we do, especially for financial or healthcare sectors.
I'd love to hear how you're balancing compliance requirements with the practicalities of storage management.
Keep it civil, keep it real.