Another week, another CISO mandating a "comprehensive PAM solution" that ends up strangling developer velocity. Let's cut through the vendor fog. When we talk PAM for DevOps—meaning engineers, CI/CD pipelines, and automated infrastructure—we're not talking about vaulting the CFO's password. We're talking about ephemeral access, just-in-time elevation, and auditing for non-human identities.
Having evaluated Delinea (formerly Thycotic), Teleport, and HashiCorp Vault in production environments, I find the choice hinges on one question: **Is your primary goal to secure traditional servers, or to enable a cloud-native workflow?** The approaches are philosophically different.
* **Delinea (Secret Server/BeyondTrust)** is the evolved enterprise suite. It's vast, covering everything from Windows desktop elevation to SaaS app passwords. For DevOps, its strength is in its breadth and granular, policy-driven access requests for traditional infrastructure. However, its complexity is its weakness. The "secret" model feels bolted-on for dynamic, short-lived cloud credentials. Needing a full-fledged Windows-based Secret Server (or its SaaS counterpart) to fetch a database password for a 5-minute Lambda function feels... over-engineered.
* **Teleport** is the infrastructure access platform built from the ground up for the cloud. It doesn't just do secrets; it's a proxy for SSH, Kubernetes, databases, and internal web apps. Its killer feature for DevOps is **identity-based access** and session recording. You don't get a static SSH key; you get a short-lived certificate because Teleport *becomes* your certificate authority. It's elegant but opinionated—it wants to be your gatekeeper for all infrastructure protocols.
* **HashiCorp Vault** is the programmable secrets engine. It's less a traditional PAM and more a foundational security primitive. Its power is in dynamic secrets (e.g., generate a unique database user with a 1-hour lease) and its extensive plugin ecosystem (AWS, GCP, PKI, etc.). For purely automated, API-driven workflows, it's unparalleled. However, for human access to servers (SSH/RDP), it often requires other components (like Teleport or Boundary) to complete the picture.
**Where they stumble in practice:**
* **Delinea** for DevOps often becomes a glorified password store. The workflow for a CI/CD pipeline to retrieve a secret can be clunky compared to a native Vault API call. You're paying for a battleship to run a ferry service.
* **Teleport** requires you to adopt its model. If your team loves their existing SSH configs or kubeconfig files, there's friction. It's fantastic greenfield, can be a battle for brownfield.
* **Vault** is notoriously complex to operate and harden correctly. Running a highly available, secure Vault cluster is a significant infrastructure commitment. The "Vault tax" is real.
**My blunt take:** If you're a startup or cloud-native shop, start with Teleport for human access and Vault for machines/secrets. If you're a large enterprise with a sprawling legacy estate (Windows, mainframes, SAP) and need a single pane for *everything*, Delinea's breadth might justify its cost and complexity, even if it's suboptimal for pure DevOps workflows.
The worst outcome is forcing a single tool to do both jobs poorly. I've seen teams build elaborate workarounds in Delinea to mimic Teleport's short-lived certs, or try to make Vault handle interactive SSH sessions. Don't. Pick the tool that aligns with the majority of your access patterns.
keep it simple
I'm a community mod and lead platform engineer at a mid-sized SaaS company running 500+ nodes on AWS/EKS. We use Delinea Secret Server for legacy on-prem credential vaulting and Teleport for all our cloud-native ephemeral access.
**Deployment Effort:** Teleport is the clear winner. We deployed the open source version in an afternoon using a Helm chart. Delinea Secret Server required a multi-day project with Windows VMs, SQL Server, and agents. Even the SaaS version had a heavier agent rollout.
**Real Pricing:** Delinea's enterprise licensing (Secret Server with DevOps features) ran us ~$50-75 per user/month. Teleport's commercial tiers (Team/Enterprise) start at roughly $20/user/month for SSH/Kubernetes database access, but the OSS core is production-viable.
**Cloud-Native Fit:** Teleport is purpose-built. A session starts with `tsh ssh` and gets a single-use certificate; the entire workflow feels native to `kubectl` and AWS. Delinea feels like an enterprise vault retrofitted with REST APIs - you're often working against a "secret" object model, not a true zero-trust proxy.
**Operational Overhead:** Teleport's weakness is state management; backing your cluster's state (for audit logs, roles) requires persistent storage and regular snapshotting. Delinea's weakness is velocity; every new resource type requires policy customization in a heavy UI, which stifles automation.
If your team's day-to-day is SSH, kubectl, and database tunnels across ephemeral cloud resources, I'd pick Teleport every time. For a clear recommendation, tell us the ratio of traditional Windows servers to cloud pods and whether you have a dedicated security team to manage policy authoring.
—AF