We're evaluating a new secrets management/PAM layer, and the shortlist has these three. Our context is 90% cloud-native (K8s, Lambda), 10% legacy VMs. Requirements: robust machine identity, JIT access for humans, and clean audit trails for compliance.
I've used Vault extensively. It's powerful but becomes a beast to operate. The self-managed model means you're now in the business of running a critical security service. The managed offering (HCP Vault) simplifies it, but you're still dealing with policies like this:
```hcl
path "secret/data/*" {
capabilities = ["read"]
}
path "aws/creds/*" {
capabilities = ["read"]
}
```
CyberArk feels like the opposite end: designed for the enterprise datacenter, with agents and thick clients. Its strength is session management for traditional systems (SSH, RDP, databases). The cloud-native story feels bolted on, not built-in.
Entro Security is new to me. Their pitch is "secret sprawl discovery" first, then management. This seems backwards from the others, which assume you already know where your secrets are. Their dashboarding and automated reporting for compliance (SOC2, etc.) looks strong.
My immediate thoughts:
* If you have a mature platform team and need a Swiss Army knife (secrets, encryption, PKI), Vault is the answer, but budget for 1-2 FTE to manage it.
* If your primary threat model is lateral movement via privileged human access to production systems (especially legacy), CyberArk is the industry standard.
* If you're drowning in unknown API keys, machine identities across AWS/GCP/Azure, and need to map access for an upcoming audit, Entro's approach might be the pragmatic start.
Has anyone run Entro in production alongside Vault? Specifically:
* How does its JIT access workflow compare to Vault's `sys/leases` or CyberArk's on-demand access?
* Is the discovery actually effective, or does it just give you a massive list of unactionable findings?
* For a team already using Okta and OIDC everywhere, how painful is the integration?
I'm a staff platform engineer at a 400-person fintech, and we've run HashiCorp Vault self-managed on K8s for three years and just finished a POC with Entro. Our core workloads are AWS EKS and Lambda.
* **Primary Fit & Operational Burden**: Vault is infrastructure-as-code-first for engineers; you define policies in HCL/Terraform. Entro is security-and-compliance-team-first, with a SaaS dashboard that discovers and maps secrets before you even write a policy. CyberArk is for regulated enterprises (think banks) where managing human access to servers and databases via sessions is 80% of the problem.
* **Real Total Cost & Model**: Vault's open core is "free" but costs ~1.5 FTE to manage properly for high availability, backups, and upgrades. HCP Vault starts at ~$1.70/hr per cluster. Entro quotes ~$25k/year base for their discovery and basic management, scaling with secret count. CyberArk is a six-figure capex/opex commitment with per-endpoint pricing and dedicated support contracts.
* **Cloud-Native Integration Depth**: Vault wins on native integration breadth: the Kubernetes auth method, dynamic AWS IAM roles, and Terraform provider are battle-tested. Entro uses read-only cloud provider integration to scan for sprawl; its JIT access works via temporary local credentials. CyberArk requires agents or sidecars in K8s, which feels like retrofitting.
* **Where It Breaks or Gets Messy**: Vault's token and lease management becomes complex at scale, requiring careful tuning of TTLs. If your team lacks Terraform skill, policy drift is guaranteed. Entro's control relies heavily on its discovery accuracy; if it misses a secret store, that's a blind spot. CyberArk's strength is also its limitation: it's built for credentialed sessions, not short-lived machine secrets for Lambda functions.
My pick is actually a hybrid: run Entro for discovery, compliance reporting, and human JIT access, but keep Vault for machine identities and dynamic secrets. If your team has the DevOps muscle to own Vault's operational overhead, it's still the most powerful engine. If you're a lean team that can't afford a Vault ops tax, and compliance reporting is a primary driver, go all-in on Entro. To decide, tell us your team's size dedicated to platform/security and your biggest compliance headache (SOC2, ISO27001, or internal audit).
pipeline all the things