Privileged access management used to be a back-office checkbox. In 2026 it is a boardroom topic, and the three vendors fighting hardest for that budget line are CyberArk, BeyondTrust, and Delinea. All three spent the past few months proving how fast this market moves: CyberArk is mid-transition into a new identity under Palo Alto Networks ownership, Delinea spent September patching four critical Secret Server flaws (one scored a near-maximum CVSS 9.8), and BeyondTrust is still working through remote-access bugs disclosed earlier this year. None of that is theoretical. Every one of these products sits between an attacker and the credentials that run your domain controllers, cloud consoles, and OT networks.
This comparison breaks down privileged access management across pricing, architecture, deployment risk, and the kind of organization each platform actually fits, using the vendors’ own published release notes and the vulnerability disclosures that landed in the past 60 days. If you are evaluating CyberArk alternatives, trying to understand Delinea Secret Server vulnerabilities before a renewal, or just want a straight answer on BeyondTrust vs CyberArk pricing, the data below should get you most of the way there.
CyberArk, BeyondTrust, and Delinea: the three names dominating PAM in 2026
Privileged access management (PAM) solves one narrow but critical problem: controlling, vaulting, and monitoring the credentials that grant elevated access to servers, databases, network gear, and cloud control planes. Get it wrong and a single leaked admin password becomes a full domain compromise. Get it right and even a phished help-desk account hits a wall of just-in-time approval, session recording, and automatic credential rotation.
CyberArk built its name as the enterprise default, the vendor security auditors expect to see in a Fortune 500 environment. BeyondTrust grew out of the Bomgar remote-support business and BeyondTrust’s own PowerBroker line, then merged those into what it now calls Universal Privilege Management. Delinea formed from the 2021 merger of Thycotic and Centrify and has spent the years since chasing mid-market customers who find CyberArk’s deployment timelines too long and its pricing too opaque.
What makes 2026 different is that all three stories changed at once. CyberArk’s acquisition by Palo Alto Networks is reshaping its product roadmap and brand, with reporting pointing to a rename toward “Idira.” Delinea had to disclose and patch a cluster of on-premises Secret Server vulnerabilities in September, including an authentication-bypass flaw rated CVSS 9.8. BeyondTrust, meanwhile, has already patched a set of remote-access flaws reported earlier in 2026, some described as login-bypass issues. None of these vendors is standing still, and a comparison written even six months ago is already out of date on ownership and patch status alone.
Quick comparison: CyberArk vs BeyondTrust vs Delinea at a glance
Before digging into each platform, here is the full specs table covering architecture, pricing posture, deployment options, and 2026 security events for privileged access management across all three vendors.
| Criteria | CyberArk (transitioning to Idira) | BeyondTrust | Delinea |
|---|---|---|---|
| Corporate status 2026 | Acquired by Palo Alto Networks, brand transition reportedly underway | Independent, private equity-backed | Independent, private equity-backed |
| Core strategy | Deep, broad PAM depth for complex hybrid and OT environments | Universal Privilege Management: vaulting, endpoint privilege, remote access unified | Fast deployment across traditional vaulting and cloud PAM for mid-market |
| Pricing model | Quote-based, per managed account | Quote-based, often per user/month | Quote-based, no public list price |
| Typical small-deployment cost | Roughly $7,000-$12,000 per managed account annually | Roughly $50-$70 per user per month in some deployments | No dependable public figure, module-dependent quote |
| Large-deployment cost (1,000+ accounts/users) | Can fall to roughly $1,800 per account annually at volume | Enterprise contracts vary widely by module mix | Enterprise contracts vary widely by module mix |
| Deployment model | On-premises, hybrid, SaaS vault options | On-premises, SaaS, and self-hosted SaaS | On-premises Secret Server and Secret Server Cloud |
| Endpoint privilege management | Yes, native module | Yes, core to Universal Privilege Management | Yes, via Privilege Manager |
| Remote vendor/third-party access | Yes, via dedicated modules | Yes, inherited from Bomgar remote-support roots | Yes, via Connection Manager |
| OT/industrial environment support | Frequently cited as the strongest of the three | Supported but less OT-specific messaging | Supported, positioned more toward IT/cloud |
| Critical CVEs disclosed in 2026 | No major critical CVE disclosures surfaced in current research | Multiple remote-access flaws reported July 2026, including login-bypass issues | Four critical on-premises Secret Server flaws in September 2026, plus a Cloud Suite SQL-injection flaw (CVE-2026-2409) |
| Highest 2026 CVSS score disclosed | Not applicable per current research | Not scored at CVSS 9+ in current research | CVSS 9.8 (CVE-2026-19117, FIDO2 auth bypass) |
| Analyst recognition | Repeatedly cited as an enterprise/complex-hybrid leader in PAM comparisons | Cited for breadth across remote access and endpoint privilege | Cited for mid-market speed-to-deploy |
| Best-fit buyer | Large enterprises, regulated industries, hybrid OT networks | Organizations wanting one console for vaulting, endpoint, and remote access | Mid-market teams needing fast time-to-value |
CyberArk’s transition to Idira: what the Palo Alto acquisition changes
For nearly two decades, CyberArk was the PAM market’s safe choice. Procurement teams who needed to check an “enterprise-grade privileged access management” box on a security questionnaire defaulted to it, and the company built an ecosystem of integrations, OT-specific modules, and workload-identity tooling to match. That stability is now in flux. Current reporting describes CyberArk’s ownership moving to Palo Alto Networks, with a rebrand toward the name “Idira” rather than CyberArk continuing as an unchanged standalone product line.
For buyers currently running CyberArk or evaluating it against BeyondTrust and Delinea, this matters in three concrete ways. First, roadmap continuity. An acquisition of this scale almost always triggers product consolidation, and features that were differentiators under independent CyberArk could get folded into, or dropped in favor of, Palo Alto’s broader security platform. Second, licensing. Palo Alto’s enterprise agreement structures differ from CyberArk’s historical account-based model, and buyers renewing contracts in 2026 and 2027 should expect renegotiation rather than a simple rollover. Third, support continuity, since any acquisition of this size tends to shuffle account teams and support tiers during the integration period.
None of this erases CyberArk’s technical depth. It remains the vendor most frequently cited for complex hybrid environments that mix cloud workloads with on-premises OT and industrial control systems, a niche BeyondTrust and Delinea address but do not lead. According to the vendor comparison published by TechnologyMatch, that depth is precisely why large enterprises keep defaulting to CyberArk even while its corporate structure is in motion. The practical takeaway for buyers: treat any current CyberArk quote as provisional, and get the Palo Alto roadmap and pricing structure in writing before signing a multi-year renewal.
BeyondTrust’s Universal Privilege Management strategy explained
BeyondTrust pitches itself differently than the other two. Where CyberArk and Delinea both grew out of credential vaulting as the core product, BeyondTrust’s roots run through Bomgar’s remote-support tooling, and the company has spent years stitching vaulting, endpoint privilege management, and remote vendor access into a single console under the “Universal Privilege Management” label. The pitch to buyers is consolidation: instead of running a separate privileged-session vault, a separate endpoint least-privilege agent, and a separate secure remote-access tool for contractors and MSPs, BeyondTrust wants to be the one platform covering all three.
That consolidation pitch lines up with where buyer demand is actually moving. A SASE and PAM buyer survey cited in current market research found that 92 percent of respondents considered reducing security-console sprawl important or critical to their purchasing decisions, a number that explains why BeyondTrust leads with “one platform” messaging rather than competing purely on vault depth. For a mid-size IT team juggling a dozen security tools already, one login and one policy engine covering privileged credentials, endpoint rights, and third-party remote sessions is a real operational win, not just a sales pitch.
BeyondTrust’s 2026 did include a rough patch on the security side of its own house. Reporting describes four remote-access vulnerabilities disclosed in July 2026, two of which were characterized as login-bypass issues, with SaaS and self-hosted SaaS fixes following after an earlier set of patches in April. That pattern (remote-access code bearing repeat scrutiny) is worth watching precisely because remote access is BeyondTrust’s heritage product line and the one most exposed to the internet. Pricing for BeyondTrust remains quote-based, with market estimates for some deployments landing around $50 to $70 per user per month before module add-ons for endpoint privilege management or remote support push the number higher.
Delinea’s mid-market play and the September 2026 Secret Server vulnerabilities
Delinea formed when Thycotic merged with Centrify in 2021, and the combined company has spent the years since positioning itself as the faster, more approachable alternative to CyberArk for organizations that do not have a dedicated PAM engineering team. Secret Server, its flagship vaulting product, ships in both on-premises and Secret Server Cloud editions, and Delinea’s broader portfolio adds Privilege Manager for endpoint least-privilege and Connection Manager for session proxying.
September 2026 was a hard month for that pitch. Delinea disclosed four critical vulnerabilities affecting on-premises Secret Server, tracked as CVE-2026-19117, CVE-2026-15640, CVE-2026-15639, and CVE-2026-15638. The most severe, CVE-2026-19117, scored CVSS 9.8 and involved a FIDO2 credential-registration authentication bypass carrying account-takeover risk, about as bad as a flaw in a credential vault can get. A second flaw, CVE-2026-15640, scored CVSS 9.5 and involved a SAML authentication bypass, also in the on-premises product. A separate 2026 issue, CVE-2026-2409, affected Delinea’s Cloud Suite product through a SQL-injection and argument-injection vulnerability, fixed in version 25.2 HF1.
The details matter for risk assessment. Reporting on these flaws specifies they affected on-premises Secret Server deployments rather than Secret Server Cloud tenants, so a comparison that treats “Delinea” as a single uniform exposure misreads the risk. Customers running Secret Server Cloud were not described as exposed by the same disclosures. Customers running self-hosted on-premises Secret Server needed to patch immediately. That distinction, cloud versus self-hosted exposure, is exactly the kind of deployment-model question every PAM buyer should be asking regardless of vendor, and the StartWithIdentity review of Delinea walks through how the company’s patch cadence responded once the flaws became public. Delinea’s pricing, like its competitors, is quote-based and module-dependent, with no dependable public list price to anchor expectations before a sales call.
Pricing breakdown: what each PAM platform actually costs
None of the three vendors publishes a straightforward price list, and that opacity is itself a buying consideration since it forces every evaluation into a multi-week quote cycle before anyone sees a real number. Based on current market estimates compiled across vendor comparisons, here is how the costs tend to shake out at different deployment sizes.
| Deployment size | CyberArk / Idira | BeyondTrust | Delinea |
|---|---|---|---|
| Small team (under 100 privileged accounts) | Roughly $7,000-$12,000 per account annually | Roughly $50-$70 per user/month, module-dependent | Quote-based, typically positioned as lower entry cost |
| 100 privileged users with added modules | Varies by module bundle and negotiated discount | Roughly $50,000-$150,000 annually with endpoint privilege management included | Roughly $50,000-$150,000 annually with endpoint privilege management included |
| Enterprise (1,000+ accounts) | Can fall to roughly $1,800 per account annually at volume | Custom enterprise contract, volume discounts typical | Custom enterprise contract, volume discounts typical |
| Large enterprise contract range | Roughly $150,000 to over $2,000,000 per year depending on scope | Not publicly benchmarked at this scale in current research | Not publicly benchmarked at this scale in current research |
| Pricing transparency | Quote-based, account-volume discounts documented | Quote-based, per-user estimates available | Quote-based, least public pricing data of the three |
The pattern across all three: sticker price per seat or per account drops sharply as deployment size grows, which means a small pilot quote is a poor predictor of what a company-wide rollout will actually cost. Any CyberArk vs BeyondTrust pricing comparison done at the proof-of-concept stage should be treated as directional only. Budget holders should push every vendor for a three-year total cost of ownership model that includes implementation services, not just license fees, since PAM deployments routinely run over on professional-services hours during the credential-discovery phase.
Deployment models: cloud vaulting vs on-premises risk
Every one of these three platforms now offers both on-premises and cloud-hosted deployment, and the September 2026 Delinea disclosures are a clean case study in why that choice matters more than feature checklists. The critical flaws landed in on-premises Secret Server specifically. Secret Server Cloud customers were not described as carrying the same exposure. That is not a coincidence unique to Delinea. Self-hosted software of any kind inherits the patch-management discipline of the customer running it, while cloud-hosted SaaS inherits the vendor’s own patch cadence, which is generally faster and more consistent because the vendor controls every instance.
That tradeoff cuts both ways. On-premises deployment gives security teams full control over network segmentation, keeps the credential vault inside a perimeter the organization already monitors, and avoids sending privileged session data to a third-party cloud, a real consideration for regulated industries and OT networks that air-gap critical systems. Cloud-hosted PAM trades some of that control for faster patching, lower operational overhead, and quicker time-to-value, which is exactly why Delinea and the other vendors push cloud editions hard for mid-market buyers who lack dedicated security operations staff.
BeyondTrust’s own 2026 vulnerability history illustrates the same split. Fixes for its remote-access flaws rolled out to SaaS and self-hosted SaaS editions on a different timeline than on-premises installs, with the April 2026 patches landing before the broader set disclosed in July. Any organization comparing CyberArk, BeyondTrust, and Delinea in 2026 should ask each vendor directly: what is your median time from CVE disclosure to patch availability, separated by deployment model? That single question surfaces more real risk difference between these three platforms than any feature matrix.
Benchmarks and analyst recognition: how the three stack up
Independent benchmarking of PAM platforms is harder to come by than for, say, antivirus engines, because privileged access management does not lend itself to a clean lab test. What exists instead is a mix of analyst evaluations and practitioner comparisons, and the picture they paint is fairly consistent across sources.
CyberArk is repeatedly named the enterprise and complex-hybrid leader across current PAM comparisons, a position reinforced by its longstanding presence in analyst evaluations of the category, though buyers should verify that positioning directly given the Palo Alto transition. The buyer’s guide published by GBHackers ranks CyberArk highest for breadth of feature coverage among the three, while flagging deployment complexity as the tradeoff. A separate ranking from CiphersSecurity places BeyondTrust and Delinea closer together on ease of deployment, with Delinea scoring better on time-to-first-value for smaller teams. A third data point, the vendor profile compiled by CyberCompanyProfiles, frames Delinea’s competitive strategy explicitly around out-executing CyberArk on deployment speed rather than matching it feature-for-feature.
Put those three independent sources together and a consistent pattern emerges: CyberArk wins on depth, BeyondTrust wins on console consolidation, and Delinea wins on speed and accessibility for teams without a dedicated PAM engineering function. No single source ranks all three identically, which is itself useful information, since it tells buyers that the “best” platform genuinely depends on deployment complexity and in-house expertise rather than one vendor being objectively superior across every dimension.
Integration ecosystem: identity providers, SIEM, and workload identity
A privileged access management platform rarely operates on its own. It sits in the middle of an identity stack that usually already includes a directory service, a single sign-on provider, a SIEM pulling audit logs, and increasingly a workload-identity layer covering service accounts, CI/CD pipelines, and cloud-native workloads that never have a human typing a password. How well each PAM vendor plugs into that surrounding stack often matters more day-to-day than any single feature on a spec sheet.
CyberArk’s longer market history gives it the broadest set of pre-built connectors, something that shows up repeatedly in enterprise shortlists where the buyer already runs a large, heterogeneous identity environment spanning Active Directory, multiple cloud directories, and legacy mainframe access. That breadth is also the product of years of enterprise deployments feeding back into the connector catalog, and it is one of the assets large enterprises will be watching closely as the company moves under Palo Alto Networks ownership, since a shift in integration priorities toward Palo Alto’s own ecosystem could narrow that advantage over time.
BeyondTrust’s integration story leans into its remote-access and ticketing-system heritage. Teams that already run ServiceNow or a similar ITSM platform for change approvals tend to find BeyondTrust’s workflow hooks a more natural fit, since privileged session requests can route through the same approval chain already used for every other change ticket. Delinea’s integration catalog is smaller than CyberArk’s but has grown quickly, particularly around cloud-native identity providers like Okta and Microsoft Entra ID, reflecting its mid-market, cloud-first customer base rather than the legacy on-premises directory environments CyberArk still serves heavily.
Workload identity is the newest battleground. As more privileged “accounts” are actually service principals, API keys, or short-lived cloud role assumptions rather than human logins, all three vendors have pushed to extend vaulting and rotation logic beyond human credentials. This is worth asking about directly in any 2026 evaluation, since a platform that handles human privileged access well but treats machine-to-machine secrets as an afterthought will leave a real gap as CI/CD pipelines and cloud automation keep expanding the number of non-human identities that need governance.
Compliance and audit readiness across the three platforms
For most organizations, the business case for privileged access management is not abstract security hygiene, it is a specific audit requirement. SOC 2, PCI DSS, HIPAA, and ISO 27001 all include controls that effectively mandate some form of credential vaulting, session recording, and access review for privileged accounts, and auditors increasingly expect to see automated evidence rather than a spreadsheet updated once a quarter.
All three platforms generate the session recordings, access logs, and rotation histories that satisfy these frameworks on paper, but the practical difference shows up in how easily that evidence can be pulled during an actual audit. CyberArk’s maturity in large regulated environments means its reporting modules are generally well understood by external auditors who have seen the product before, reducing the back-and-forth during an audit cycle. Delinea and BeyondTrust both offer comparable reporting capability, but organizations should specifically test the export and reporting workflow during a proof-of-concept rather than assume it will match what an auditor expects, since this is one of the areas where marketing material and real-world audit friction can diverge.
PCI DSS compliance adds a wrinkle specific to this comparison. Organizations handling cardholder data need to document that privileged access to systems storing payment data is tightly scoped and monitored, and the September 2026 Delinea vulnerabilities are a reminder that the vault itself becomes part of the PCI scope once it touches cardholder-data-environment credentials. Any organization using on-premises Secret Server in a PCI scope should treat September’s patch cycle as a mandatory compliance event, not just a routine security update, and should document the remediation timeline for the next assessment.
HIPAA-covered entities face a similar dynamic around session recording for anyone with privileged access to systems holding protected health information. The core requirement, demonstrating who accessed what and when, is satisfied by any of the three platforms, which pushes the real decision back toward deployment model, integration fit, and total cost rather than compliance capability alone.
Security track record 2026: critical flaws and patch speed
Vulnerability history in a credential vault carries more weight than in almost any other software category, because a flaw in the product designed to protect your most sensitive secrets is a flaw in your last line of defense. Here is how the three vendors’ disclosed 2026 security issues compare directly.
| Vendor | CVE | CVSS score | Flaw type | Affected deployment |
|---|---|---|---|---|
| Delinea | CVE-2026-19117 | 9.8 | FIDO2 credential-registration auth bypass | On-premises Secret Server |
| Delinea | CVE-2026-15640 | 9.5 | SAML authentication bypass | On-premises Secret Server |
| Delinea | CVE-2026-15639 | Not specified in current research | Part of September 2026 disclosure batch | On-premises Secret Server |
| Delinea | CVE-2026-15638 | Not specified in current research | Part of September 2026 disclosure batch | On-premises Secret Server |
| Delinea | CVE-2026-2409 | Not specified in current research | SQL injection / argument injection | Cloud Suite, versions before 25.2 HF1 |
| BeyondTrust | Not individually named in current research | Not specified in current research | Remote-access flaws, two described as login-bypass | Reported July 2026, SaaS/self-hosted SaaS fixed earlier |
| CyberArk / Idira | No major critical CVE disclosures surfaced | Not applicable | Not applicable | Not applicable |
The absence of a major disclosed critical CVE for CyberArk in current research should not be read as proof the product is inherently more secure. It may just as easily reflect fewer disclosed findings during this window, different research coverage, or the fact that the company’s attention is currently split across an acquisition. What the table does show clearly is Delinea absorbing the roughest 2026 so far on the disclosure side, with two flaws scoring in the 9-point range within the same disclosure batch, a pattern serious enough that any team running on-premises Secret Server should have already applied September’s patches and should audit FIDO2 and SAML configuration specifically before the next scheduled audit.
Five real-world scenarios where each platform wins
Specs and pricing only tell part of the story. Here are five common deployment scenarios and how the choice between CyberArk, BeyondTrust, and Delinea typically plays out in practice.
- A regional bank with OT and branch infrastructure. A mid-size bank running core banking systems alongside ATM networks and branch hardware needs PAM that spans both IT and operational technology. CyberArk’s depth in hybrid and OT environments makes it the default shortlist entry here, even with its ownership transition in progress, because few competitors match its industrial-protocol coverage.
- An MSP managing hundreds of client environments remotely. A managed service provider whose technicians need secure, logged remote access into dozens of customer networks lines up naturally with BeyondTrust, whose Bomgar-derived remote-support heritage was built for exactly this use case, bundled now with vaulting and endpoint privilege controls.
- A 200-person SaaS company replacing spreadsheet-based admin credentials. A fast-growing software company that just failed a security audit for storing root passwords in a shared document needs rapid time-to-value more than deep OT coverage. Delinea’s mid-market positioning and faster deployment timeline fit this scenario better than a multi-month CyberArk rollout.
- A healthcare system under HIPAA session-recording requirements. A hospital network needing documented session recording for every privileged database access can satisfy that requirement with any of the three, but the deciding factor is usually integration with existing identity infrastructure. Whichever vendor already has a certified connector for the hospital’s identity provider typically wins procurement, which argues for checking existing IAM compatibility before evaluating PAM features in isolation.
- A retail chain consolidating a sprawl of point security tools. A retailer running separate vaulting, endpoint privilege, and remote-access tools from three different vendors, and paying for three separate consoles and three separate support contracts, is the exact buyer BeyondTrust’s Universal Privilege Management pitch targets, with the 92 percent console-sprawl concern cited earlier directly applicable to this scenario.
Migration guide: moving from one PAM platform to another
Switching privileged access management platforms is riskier than most software migrations because a misconfigured cutover can leave credentials exposed during the transition window. Whether moving from a legacy CyberArk deployment to Delinea for cost reasons, or from Delinea to BeyondTrust to consolidate remote-access tooling, the sequence below reduces the chance of a gap in coverage.
- Inventory every privileged account first. Run a full credential discovery pass across servers, databases, network devices, cloud consoles, and service accounts before touching the new platform. Most PAM failures trace back to accounts nobody knew existed.
- Map policy logic, not just credentials. Document existing approval workflows, session-recording rules, and rotation schedules in the legacy system so the new platform’s policy engine can replicate them rather than starting from a blank slate.
- Stand up the new vault in parallel, never in place of the old one. Run both systems simultaneously during migration so a rollback is always available if the new platform’s onboarding reveals gaps.
- Migrate low-risk accounts first. Start with service accounts and non-production credentials to validate the new platform’s rotation and session-recording behavior before touching domain admin or OT credentials.
- Re-point integrations one at a time. Identity providers, SIEM connectors, and ticketing-system integrations for approval workflows should move individually with validation at each step, not in a single cutover event.
- Rotate every migrated credential immediately after cutover. Never assume a credential’s security posture carried over cleanly. Force a rotation the moment an account lands in the new vault.
- Decommission the old vault only after a full audit cycle. Keep the legacy platform live in read-only or monitoring mode for at least one full compliance audit cycle before fully retiring it, in case gaps surface during the first external review.
- Re-certify every privileged account post-migration. Use the migration as a forcing function to review whether each account still needs the access it has, rather than simply recreating the old entitlement structure in the new tool.
Budget real calendar time for this. Organizations moving off CyberArk toward Delinea for cost reasons, or consolidating onto BeyondTrust’s Universal Privilege Management console, typically need three to six months for a mid-size environment, longer if OT or air-gapped networks are involved. Rushing the credential-discovery phase is the single most common cause of post-migration security incidents in PAM transitions.
Pros and cons: CyberArk, BeyondTrust, and Delinea
CyberArk / Idira
- Deepest feature coverage for complex hybrid and OT environments among the three platforms
- Long track record with regulated industries and large-enterprise deployments
- Volume pricing can drop sharply at scale, roughly $1,800 per account annually for 1,000-plus accounts
- Palo Alto acquisition and rebrand to Idira introduce roadmap and licensing uncertainty for current renewals
- Historically longer deployment timelines than Delinea for mid-size teams
- Entry-level pricing (roughly $7,000-$12,000 per account annually) is the highest of the three at small scale
BeyondTrust
- Strongest console consolidation story, unifying vaulting, endpoint privilege, and remote access under Universal Privilege Management
- Remote-access heritage from Bomgar makes it a natural fit for MSPs and third-party vendor access
- Per-user pricing (roughly $50-$70/month in some deployments) is more transparent than CyberArk’s or Delinea’s module-based quotes
- Multiple remote-access vulnerabilities disclosed in 2026, including login-bypass flaws reported in July
- Less OT-specific messaging and tooling than CyberArk
- Enterprise-scale pricing benchmarks are less publicly documented than CyberArk’s
Delinea
- Fastest time-to-value for mid-market teams without dedicated PAM engineering staff
- Secret Server Cloud edition was not affected by the September 2026 on-premises vulnerabilities, giving cloud customers a cleaner 2026 security record
- Formed from Thycotic/Centrify merger, giving it a broader combined feature set than either predecessor alone
- Four critical on-premises Secret Server vulnerabilities disclosed in September 2026, including a CVSS 9.8 authentication bypass
- Least publicly available pricing data of the three, making budget planning harder before a sales call
- Generally viewed as less suited to deep OT/industrial environments than CyberArk
Who should choose which platform: five use-case recommendations
- Choose CyberArk / Idira if you run OT, industrial control systems, or a hybrid environment spanning legacy on-premises infrastructure and multiple clouds, and you have the budget and timeline for a thorough deployment, while keeping a close eye on the Palo Alto integration roadmap.
- Choose BeyondTrust if your highest priority is collapsing vaulting, endpoint privilege, and third-party remote access into a single console, especially if you are an MSP or manage large numbers of external vendor connections.
- Choose Delinea Secret Server Cloud if you need fast deployment, want to avoid the patch-management burden of self-hosted software, and your team lacks dedicated PAM engineering headcount.
- Avoid on-premises Delinea Secret Server until you confirm current patch status if you are running an older build that predates the September 2026 fixes for CVE-2026-19117 and CVE-2026-15640.
- Run a parallel proof-of-concept with at least two vendors if your organization has never deployed PAM before, since first-time buyers consistently underestimate the credential-discovery workload regardless of which platform they end up choosing.
The verdict: which PAM platform wins in 2026
There is no single winner across every dimension in this privileged access management comparison, and that is the honest conclusion. CyberArk remains the technical depth leader, particularly for OT and complex hybrid networks, but its Palo Alto acquisition and transition toward the Idira brand add genuine uncertainty that buyers cannot ignore heading into 2027 renewals. BeyondTrust offers the cleanest console-consolidation story and the most transparent per-user pricing, but its 2026 remote-access vulnerability disclosures are a reminder that the product line built for internet-facing third-party access carries proportionally higher exposure. Delinea wins on speed and accessibility for mid-market buyers, and its cloud edition came through September’s disclosure batch largely unscathed, but its on-premises Secret Server product had the roughest security year of the three, with two flaws scoring in the 9-point CVSS range in a single month.
If forced to rank by scenario fit: large regulated enterprises and OT-heavy networks should lead with CyberArk despite the ownership transition, MSPs and console-fatigued security teams should lead with BeyondTrust, and resource-constrained mid-market teams should lead with Delinea’s cloud-hosted Secret Server rather than its on-premises edition. Whichever platform wins your evaluation, the single highest-leverage question to ask every vendor before signing is not about features at all. Ask for their median time from CVE disclosure to patch availability, broken out by deployment model, and ask for it in writing.
Frequently asked questions
Is CyberArk being renamed to Idira?
Current reporting describes CyberArk’s acquisition by Palo Alto Networks and a brand transition reportedly moving toward the name Idira. Buyers evaluating or renewing CyberArk contracts should confirm the current roadmap and licensing structure directly with the vendor rather than assuming the standalone CyberArk product line continues unchanged.
What caused the Delinea Secret Server vulnerabilities in September 2026?
Delinea disclosed four critical flaws in its on-premises Secret Server product: CVE-2026-19117 (CVSS 9.8, a FIDO2 credential-registration authentication bypass), CVE-2026-15640 (CVSS 9.5, a SAML authentication bypass), and two additional flaws, CVE-2026-15639 and CVE-2026-15638, disclosed in the same batch. Secret Server Cloud tenants were not described as affected by these specific issues.
How much does CyberArk cost compared to BeyondTrust and Delinea?
All three use quote-based pricing. Market estimates place small CyberArk deployments around $7,000-$12,000 per managed account annually, dropping to roughly $1,800 per account at volumes above 1,000 accounts. BeyondTrust estimates run around $50-$70 per user per month in some deployments. Delinea does not have a dependable public price point, with cost varying heavily by module selection.
Which PAM platform is best for small or mid-size businesses?
Delinea is generally positioned as the faster, more accessible option for mid-market organizations without dedicated PAM engineering staff, particularly via its Secret Server Cloud edition. BeyondTrust is also a reasonable fit for mid-size teams that want vaulting, endpoint privilege, and remote access unified under one console.
Is BeyondTrust or CyberArk better for remote vendor access?
BeyondTrust, which grew out of the Bomgar remote-support business, is generally the stronger fit for organizations whose primary need is secure, logged remote access for contractors, MSPs, or third-party vendors, though it did disclose multiple remote-access vulnerabilities in 2026 that buyers should factor into risk assessments.
What is the difference between Secret Server and Secret Server Cloud?
Secret Server is Delinea’s on-premises, self-hosted credential vault, while Secret Server Cloud is the SaaS-hosted edition. The September 2026 critical vulnerabilities affected the on-premises Secret Server product specifically. Secret Server Cloud tenants were not described as exposed by those same disclosures.
How long does a PAM migration between vendors typically take?
A mid-size organization migrating between CyberArk, BeyondTrust, and Delinea should generally plan for three to six months, covering credential discovery, parallel vault operation, phased integration cutover, and a full audit cycle before decommissioning the legacy platform. Environments with OT or air-gapped networks typically take longer.
Are CyberArk, BeyondTrust, and Delinea recognized by industry analysts?
All three are regularly covered in analyst and practitioner evaluations of the privileged access management category, with CyberArk most frequently cited for enterprise and OT depth, BeyondTrust for console consolidation, and Delinea for mid-market deployment speed. Buyers should request current analyst positioning directly given how quickly ownership and product roadmaps are shifting in 2026.