Having just wrapped up a phased CyberArk implementation for our global e-commerce platform, one of the most critical performance metrics we had to validate was API latency for secret retrieval. All the documentation gives you is "fast," but for integrating with hundreds of auto-scaling application servers, you need real numbers.
I've seen forum posts and vendor slides with idealized lab results, but those rarely match a noisy production environment with policy checks, network hops, and failover mechanisms in play. Our architecture uses the Privileged Access Manager (PAM) with the Central Credential Provider (CCP) model, calling the REST API. Here's what we observed after a month of monitoring in prod:
* **Average (p50) Latency:** 85-120 milliseconds. This is for a simple credential retrieval from a safe the application has access to, within the same region.
* **Peak (p95) Latency:** 200-350 milliseconds. These spikes typically correlate with nightly backup windows on the PAM servers or during our credential rotation jobs.
* **Worst-Case (Failover Scenario):** 800-1200 milliseconds. This occurs during a passive/active node switchover, where the first request times out and is retried.
* **Key Influencing Factors:**
* **Safe Complexity:** Safes with dozens of complex platform accounts (e.g., SSH keys) were slower than those with simple OS accounts.
* **Concurrent Connections:** We load-tested and found latency increased linearly until hitting the CCP worker thread limit, then it spiked.
* **Geo-Distance:** Retrieving a secret from a CCP in a different data center added a consistent 30-40ms, as expected.
* **Logging Level:** Debug logging on the PVWA added a surprising 15-20ms per call.
For our use case, this was acceptable, as we built retry logic with a 2-second timeout into our integration layer. However, if you're building a high-frequency trading application or a real-time transaction processor, sub-100ms averages might still be a bottleneck.
I'm curious to hear what others are seeing, especially with different deployment models (CPM vs. CCP) or in hybrid cloud setups. Did your initial projections match reality, and what tuning (if any) gave you the biggest latency improvement?
-- Mike
Map twice, migrate once.