We've been evaluating PAM solutions for our SaaS company. Our small IT team manages around 200 servers (mix of cloud and on-prem) and developer access to production databases.
Currently using a mix of shared accounts and basic SSH key management, which is becoming a compliance headache.
We've looked at CyberArk but it's overkill. Delinea seems more our size. Specifically wondering:
* How is the day-to-day for a small team? Is the administrative overhead manageable?
* Their pricing model for small businesses – any gotchas?
* How seamless is the integration with cloud platforms (AWS, Azure) and common databases?
* Did it actually reduce your team's toil, or add another complex system to manage?
Would appreciate any real-world insights from teams of a similar size.
I'm the lead cloud architect at a fintech with about 300 employees, managing a similar-sized fleet of 250+ instances across AWS and co-lo. We've had Delinea's Secret Server (now part of their Privilege Manager suite) in production for two years, handling all our service account and database credential rotation.
* **Team Overhead for SMBs:** For a team of five, the ongoing admin is maybe two hours a week once it's baked in. The initial policy setup and connector configuration is the real lift, about 80-100 hours of work to get all our servers, AWS roles, and PostgreSQL databases onboarded. The daily work is just approving access requests, which are automated via Slack webhooks.
* **Pricing Gotchas:** They'll quote you a core "user" license for your admins, but the real cost is in the "privileged account" licenses for each machine or service identity you vault. For 200 servers, you're looking at that many licenses. In my last renewal, that worked out to roughly $12-15k annually. The hidden cost is in the integrations: their out-of-the-box AWS Secrets Manager integration is just a sync job, not a true dynamic secret, so you might need to build custom PowerShell scripts for full rotation, adding dev time.
* **Cloud & DB Integration Reality:** It's an API-first system, so integration is about calling their REST endpoints. For AWS, we used the EC2 Systems Manager plugin to inject secrets at runtime, which added about 20% more config time per instance template. For PostgreSQL and MySQL, the integration is solid for password rotation but requires the database to be accessible from the Delinea server; we had to open specific firewall rules we didn't love. It doesn't natively handle NoSQL DBs like Redis or MongoDB - you're back to custom scripts.
* **Toil Reduction vs. Complexity:** It eliminated our shared root Excel spreadsheet and reduced credential-related incident tickets to zero. But it added a new failure domain: the Delinea cluster itself. We had to build a warm standby node ($4k extra in licensing) because when the primary was down for patching, our deployment pipelines halted. It's less toil, but it's now a critical, complex system you have to monitor and maintain like a database.
My pick is Delinea, but only if your primary need is straightforward SSH key and Windows local admin password vaulting with a basic audit trail. If your use case is more about dynamic, short-lived cloud access (like AWS IAM roles for EC2), look at a cloud-native tool like AWS Secrets Manager paired with Boundary, and tell us your exact split between cloud versus on-prem servers and your compliance framework (SOC2, HIPAA, etc).
APIs are not magic.
We rolled out Delinea's Secret Server about a year ago for a team our size managing a similar stack. The biggest win was getting rid of shared root passwords and static database creds. Our devs love the one-click, time-bound SSH sessions.
The day-to-day is light after the initial setup, but that setup is a real project. Don't underestimate the time to configure all the discovery scanners and session recording policies. It took us a solid month of side work to get it right.
On integration, it works well with AWS Secrets Manager and our PostgreSQL instances. The rotation engines are solid, but I'll warn you, setting up the heartbeat checks for all your on-prem Linux boxes is fiddly.
We're about your size and in a similar boat, looking to clean up access. Your point about CyberArk being overkill really hits home.
What would you recommend for the initial setup phase? Is it better to try and onboard everything at once, or start with one piece, like the cloud servers, and expand? I'm worried about that month-long side project derailing our sprints.
It sounds like we're in a very similar position. That initial month of configuration you mentioned is exactly what I'm trying to scope out. My main concern is the phased approach versus the big bang.
Based on what I've read from others and our own planning, I'm leaning towards starting with the cloud servers and one critical database. The thinking is that it lets our team learn the policy quirks and webhook integrations on a smaller, more controlled set of assets. The compliance pressure is high, but trying to onboard all 200 servers and every database at once feels like a recipe for misconfigured policies that we'd have to fix later under pressure.
Can I ask how you handled the communication and training for your developers during that initial rollout? Did you enforce the switch for everyone on day one for the initial assets, or was there a grace period where both the old and new methods worked? I'm worried about pushback if it disrupts their workflow too abruptly.
Yeah, that's a critical point about the "privileged account" licenses. We found the same thing when modeling costs. It scales linearly with your infrastructure, so while the admin license seems affordable, the total cost can sneak up on you.
Your note about the AWS integration being just a sync job is spot on. We ended up building a couple of lightweight Lambda functions to handle the dynamic credential creation for our serverless components, because the native sync felt like a half measure. It added a bit to that initial setup time but works much better for our workflows now.