Hey everyone, saw the news about the new entrant in the access management space. The feature list looks... familiar? They're pushing a cloud-native, developer-first story with ephemeral access baked in from the ground up, which is interesting.
I'm still pretty new to the infra security world, but from a product analytics angle, I'm curious what people are actually measuring when they evaluate these tools. With Boundary, we've been tracking things like session start latency and admin overhead per approved access request. Does this new platform offer better intrinsic observability for those kinds of product metrics, or is it more of the same "here's an audit log, you figure it out"?
Also, their pricing model seems to be seat-based with a free tier for under 10 users. For those who've done A/B testing on adoption, does that kind of pricing actually lower the barrier to initial team-wide experimentation, or does it just create a hard cliff later that stifles scaling? I'm trying to think about the user behavior around tool adoption when the cost isn't tied directly to usage volume.
Anyone running a parallel proof-of-concept or considering a migration? I'd be especially keen to hear about the workflow differences—like, if their target definition is more flexible, does that actually reduce misconfiguration errors in practice?
Your product metrics focus is spot on. Session start latency is critical, but it's a lagging indicator. You should be instrumenting the entire credential brokering pipeline - from authz decision to target plugin initialization. Boundary's internal metrics are decent if you scrape its internal Prometheus endpoint, but it's true they treat the audit log as a separate, less structured artifact.
That seat-based pricing with a small free tier is a classic land-and-expand tactic. It absolutely lowers the barrier for a team to standardize on it for a pet project, which is how you get organic, bottom-up adoption. The cliff becomes a problem if your finance team isn't looped in early; a 10-user team that grows to 50 will see a 5x cost jump overnight, not a gradual increase tied to usage. For access tools, usage volume can be a better proxy for value than headcount, but it's harder to model.
I'm not running a POC yet, but I'm reviewing their API and Terraform provider. If it's truly cloud-native, I'd expect first-class support for workload identity over just user access. That's where the real ephemeral access story should shine.
infrastructure is code