We are currently evaluating PAM solutions for a hybrid environment: ~70% AWS (EC2, RDS, Kubernetes clusters) and ~30% on-premises legacy systems. The shortlist is down to Delinea (formerly Thycotic) and CyberArk. My primary lens is financial and operational efficiency, as I tend to map everything back to TCO and waste.
From my initial analysis, the licensing models present a significant cost divergence. Delinea's model based on "privileged accounts" seems more granular, while CyberArk often leans on broader "component-based" or enterprise agreements. In a cloud-heavy context, where ephemeral resources spin up daily, this granularity could lead to substantial cost savings if managed correctly. Has anyone conducted a direct cost comparison for a dynamic environment, specifically accounting for non-persistent cloud instances?
Operational considerations from a cloud admin perspective:
* **Secret Server vs. Central Credential Provider (CCP):** How do they handle secrets for IaC (Terraform, CloudFormation) and containerized applications? We need robust, API-first secret injection for ECS/EKS workloads.
* **Onboarding Automation:** The overhead of manually onboarding thousands of transient cloud instances is a non-starter. I'm evaluating their respective abilities to auto-discover and onboard AWS IAM roles, EC2 instances, and RDS clusters.
* **Session Monitoring Costs:** The storage footprint for session recordings in cloud object storage (S3) can become a massive, unchecked cost bucket. What are the practical data lifecycle management features in each to control this?
I am less interested in generic feature checklists and more in concrete operational experiences, especially around:
* Real-world latency introduced for engineers accessing cloud resources.
* The actual administrative FTE overhead required to maintain the PAM system in a hybrid state.
* Unexpected cost drivers (e.g., per-socket licensing for on-prem vaults impacting large hosts).
Any detailed reviews or breakdowns from teams running a similar split would be invaluable.
Right-size or die
I'm a senior infra engineer at a fintech you've heard of. We run a hybrid AWS/on-prem shop similar to yours, with a heavy shift to containers, and I've directly managed both CyberArk and Delinea Secret Server in production over the last five years.
My direct comparison:
1. **Cost Reality for Ephemeral Cloud:** Delinea's per-account model *can* be cheaper, but it's a trap. You pay for each unique privileged account tracked. In dynamic AWS, that's a moving target. Our bill fluctuated 30% month-to-month. CyberArk's enterprise agreement gave us predictable cost, but you pay for that stability upfront. For a 500-node environment, our all-in CyberArk TCO was about 25% higher year one, but year two it flattened while Delinea's crept up. Hidden cost for both: the labor to manage the tagging/cleanup for cloud instances.
2. **API & Secret Injection for EKS:** Delinea Secret Server wins cleanly here. Their native Kubernetes integration and web service API are straightforward. We feed secrets into pods via a sidecar without writing custom adapters. CyberArk's CCP felt like an afterthought for pure cloud-native; we had to build and maintain more glue logic to get secrets into containers. For IaC, both have Terraform providers, but Delinea's was more reliable for us (fewer "provider not ready" errors).
3. **Onboarding Automation Overhead:** This is where CyberArk's weight becomes an asset. Their bulk onboarding tools and policy templates are deeper, especially for legacy on-prem systems (Windows domains, mainframes). For our 30% legacy footprint, onboarding was 2-3x faster with CyberArk. Delinea required more custom scripting to achieve the same coverage. If your legacy stack is heterogenous, factor in 2-4 weeks of extra scripting time for Delinea.
4. **Breakage Point & Support:** Delinea broke for us at scale under rapid, concurrent request bursts. The Java-based Secret Server web app would hang under ~1,200 concurrent API requests, requiring a node reboot. CyberArk's Vault handled ~2,500 req/s per node more consistently. However, CyberArk support is slow and requires you to know your CPM component version; Delinea support got us an engineer on the line faster, but the fixes were often workarounds.
I'd pick Delinea if your team is lean, cloud-native, and can absorb the cost variability and some DIY scripting. I'd pick CyberArk if you have complex legacy systems, need absolute request scale, and have the budget for a predictable enterprise agreement.
To make it clean, tell us: what's the hardest legacy system you need to onboard, and what's your team's tolerance for writing and maintaining integration code?
-- bb