CyberArk (Now Idira) vs Delinea vs BeyondTrust: Choosing a PAM Platform in 2026

Every comparison of CyberArk, Delinea and BeyondTrust lands on the same summary. CyberArk wins on depth, Delinea on speed of deployment, and BeyondTrust on endpoint privilege and remote access. That summary points at real differences, yet it describes a market that changed shape in 2026.

CyberArk now belongs to Palo Alto Networks and is being renamed Idira. Delinea bought StrongDM and retired Linux support in its endpoint product. BeyondTrust and Delinea both had critical flaws exploited in self-hosted deployments this year.

When I evaluate a privileged access management (PAM) decision in 2026, three questions do more work than any feature checklist:

1. Can you run the platform safely? A PAM platform holds the keys to everything it manages.
2. Does it remove standing privilege, or only store it? A vaulted password still sits on a permanent admin account.
3. Does it match your privilege problem? Infrastructure sessions, endpoint admin rights, vendor access and machine secrets each favor a different platform.

One note on names: CyberArk and Idira refer to the same product line throughout this guide.

‍

What changed for CyberArk, Delinea and BeyondTrust in 2026

All three vendors changed shape this year through acquisitions, renames, product retirements or security incidents. Most ranking comparisons still describe the 2025 lineup.

What the Idira rebrand means for CyberArk customers

Product names keep their shape, with Idira replacing CyberArk. You will see Idira Privilege Cloud, Idira Endpoint Privilege Manager and Idira Secrets Manager in proposals and consoles, per the CyberArk is now Idira FAQ.

The certificate products from the earlier Venafi acquisition follow a separate path into Palo Alto Networks documentation.

At closing, Palo Alto Networks said in its 8-K exhibit that CyberArk solutions would stay available as a standalone platform. I found no end-of-sale or end-of-support notices for CyberArk products since the deal closed. Three changes still matter for buyers:

• Packaging moved. The Idira launch announcement includes zero standing privilege at no added cost in the IT Enterprise and Dev tiers, while IT Standard customers buy it separately.
• Endpoint customers face a deadline. Endpoint Privilege Manager must be onboarded to the Idira platform by December 31, 2026.
• Integration is still a roadmap item. Palo Alto describes integration with its wider portfolio as underway. I could not confirm generally available integrations with Cortex, Strata or Prisma.

Delinea after the StrongDM acquisition

StrongDM adds just-in-time access to servers, databases and Kubernetes through gateways you run, and Delinea is folding it into the Delinea Platform. The bigger change for many buyers is endpoint coverage.

‍Delinea's release notes set August 1, 2026 as end of life for Linux and Unix in Privilege Manager, so Linux privilege control now sits in Delinea's server products.

Delinea also bought Fastpath (identity governance for business applications) and Authomize (identity threat detection) in 2024.

BeyondTrust's Pathfinder platform and Entitle

BeyondTrust announced its Pathfinder platform in February 2025 as a shared console across its SaaS products. Entitle, acquired in 2024, handles access requests, approvals and temporary accounts across cloud and SaaS.

Remote Support and Privileged Remote Access remain core products, sold as SaaS or as a self-hosted appliance.

‍

How CyberArk (Idira), Delinea and BeyondTrust platforms are built

All three cover the PAM core: a credential vault, password rotation, session brokering and session recording. They split on help desk remote support, Linux endpoints, certificates, and how temporary access is packaged.

‍

Two deployment details matter more than they look. Idira's self-hosted PAM and self-hosted secrets manager, and Delinea's Server Suite, run only on infrastructure you manage.

BeyondTrust's self-hosted Remote Support and Privileged Remote Access appliances face the internet by design, because outside users and vendors must reach them.

PAM also inherits the condition of your identity provider. If your directory runs in a hybrid setup, the gaps that break IAM in hybrid Okta environments carry straight into privileged access, so I fix those before I scope a PAM rollout.

IT Leaders Report 2026

What are your IT peers investing in 2026?

We spoke to about 1,300 IT leaders from various organisations to understand what they're evaluating. Most of it is the kind of thing you'd only hear from a peer you know well enough to ask, so we've put it in one place.

Read the report

A vaulted password is still a standing privilege

A vault protects the admin password. The admin account behind it still exists around the clock, and anyone who hijacks a session or reaches the vault can use it. Teams deploy a vault, onboard accounts, pass an audit, and still carry permanent admin rights that can be stolen.

Removing standing privilege means the rights, or the account itself, exist only for the task. Three levels of control show up across the vendors' documentation.

‍

All three vendors now document level 2 or level 3 controls. The difference sits in which targets each covers, and in how you pay for it.

• Idira creates a temporary local or domain user for each Windows session and deletes it afterward, issues short-lived SSH certificates for Linux, and creates temporary database users per session. Secure Cloud Access covers AWS, Azure and Google Cloud consoles.
• Delinea grants time-limited admin rights on Windows, Linux and Unix servers through Privilege Control for Servers, Cloud Suite and Server Suite. Temporary access to databases and Kubernetes comes from StrongDM, which is still being folded into the platform.
• BeyondTrust uses Entitle to create a temporary account per request and delete it at expiry, across servers, databases, cloud consoles and SaaS apps.

‍

Budget for temporary access as its own line item. If you buy only the vault, you buy level 1. Auditors and insurers now ask how privileged access is granted and removed, and the evidence they actually accept covers what that proof looks like.

‍

Your PAM platform is now your most valuable target

A PAM platform holds credentials to everything it manages, which makes it one of the most valuable systems an attacker can reach. The 2026 breach data points straight at it.

In the Verizon 2026 Data Breach Investigations Report, exploited vulnerabilities overtook stolen credentials as the top way attackers get in.

PAM security incidents from 2024 to 2026

The pattern across the three vendors is consistent. The exploited flaws of 2026 sat in self-hosted deployments, and SaaS customers were protected first. The exception is the most damaging incident of the period, which started inside a vendor's own SaaS service.

The December 2024 incident shows the trade-off of SaaS. BeyondTrust detected unusual activity on December 2, confirmed that a Remote Support SaaS API key had been compromised, and notified the US Treasury on December 8.

‍Treasury told Congress the attacker reached certain user workstations and unclassified documents, and attributed the activity to a China-based state-sponsored actor.

SaaS vs self-hosted PAM: who patches what

The February 2026 BeyondTrust flaw is the clearest example of the patch gap. BeyondTrust fixed its SaaS customers before it published the self-hosted patch, and Unit 42 later observed attackers dropping malware through unpatched instances.

Hardening checklist for self-hosted PAM

If you self-host any PAM component, treat it as tier-zero infrastructure. Keep it inside your vulnerability management scope and put its administrators on phishing-resistant authentication. If PAM shows up on your insurance questionnaire, your renewal is now your security roadmap explains how to plan around it.

‍

Session management and third-party remote access compared

All three platforms broker privileged sessions so users never see the password, and all three record those sessions on video.

Idira gives the widest choice of delivery: a self-hosted session manager, a SaaS vault, or native-client access to RDP, SSH and databases through Secure Infrastructure Access.

Public documentation covers similar ground for live monitoring, command logging and session termination, so I judge session depth in a hands-on trial.

Remote access is where the platforms separate. BeyondTrust's remote access products come from Bomgar, and remote access remains the center of its portfolio.

‍Privileged Remote Access serves admins and vendors, Remote Support serves the help desk, and both inject credentials without revealing them and work without a VPN. They run as SaaS or as a self-hosted appliance that faces the internet, which is exactly where the 2024 and 2026 incidents sat.

Idira's Vendor Privileged Access runs as SaaS with no VPN or endpoint agent. Delinea offers Privileged Remote Access as SaaS, plus StrongDM gateways for infrastructure access.

‍

If you want help desk remote support under the same contract as privileged access, BeyondTrust is the only one of the three that documents it. If your goal is replacing VPN access for staff, a ZTNA platform usually fits better, with PAM reserved for privileged sessions.

‍

Endpoint privilege management: Windows, macOS and Linux coverage

Endpoint privilege management removes local admin rights and grants them back per application or per task. All three vendors offer it with application control. The documented differences sit in Linux coverage and in changes already scheduled.

‍

The common claim that BeyondTrust leads on endpoint privilege can't be verified as a ranking from documentation. The documented difference is narrower and more useful.

BeyondTrust's endpoint product covers Unix and Linux, with a long history as a sudo replacement, and Delinea is now the only one of the three whose endpoint product excludes Linux.

Delinea still has strengths on the desktop. Its release notes document approvals that work while a device is offline, including on macOS. If your Linux estate is mostly servers, Delinea covers it through Privilege Control for Servers and Server Suite rather than the endpoint agent.

For Idira Endpoint Privilege Manager customers, the December 31, 2026 platform deadline is the item to plan around. Ask what changes in the console, policies and agent rollout before you renew.

‍

Secrets management and non-human identities

Service accounts, pipeline credentials, API keys, certificates and AI agents carry a growing share of the privilege in a modern estate. Palo Alto Networks states that machine and AI identities outnumber human identities 109 to 1. Treat that as a vendor figure; the direction is the useful part.

The three vendors cover this ground very differently.

• Idira documents the broadest set: a secrets manager offered as SaaS or self-hosted, Secrets Hub to govern cloud-native secret stores, certificate and SSH key management from Venafi, and controls for AI agents, some due later in 2026.
• Delinea offers DevOps Secrets Vault for pipelines, Account Lifecycle Manager for service accounts, and positions StrongDM for AI agent access.
• BeyondTrust handles application passwords through the Password Safe API and documents no separate secrets manager or certificate product.

‍

If machine identities are your main privilege problem, scope this as a secrets and certificate program first and a PAM program second. That ordering changes which vendor fits.

‍

PAM deployment and onboarding effort

Deployment time depends more on SaaS versus self-hosted, and on how many account types you onboard, than on the brand. The published timelines are unreliable.

One ranking page says CyberArk takes one to three months and BeyondTrust two to six weeks, while another gives a range of a few days to four months for the same products.

The vault going live is the first milestone. The long tail is onboarding: discovering accounts, confirming rotation works on each system, and untangling the applications that depend on those accounts.

‍

Vendor speed claims are marketing until proven in your environment. Delinea says agencies are up and running in weeks rather than months, and BeyondTrust says Entitle can deliver zero standing production access in under a week.

All three sell professional services, and none of the documentation I reviewed makes them mandatory.

Before you sign, ask each vendor which account types and platforms its discovery covers on day one. That answer predicts your onboarding timeline better than any quoted range.

‍

FedRAMP and compliance authorizations for PAM

Authorizations apply product by product, so a vendor holding FedRAMP High for one product tells you nothing about the next. BeyondTrust has the broadest documented FedRAMP coverage of the three.

‍

If you buy for a federal agency, or for a contractor working under FedRAMP or CMMC requirements, confirm that the exact product and deployment model you plan to buy is the one authorized. The SaaS edition and the self-hosted edition of the same product are separate questions.

‍

Standalone PAM or part of a larger security stack

Ownership now shapes the roadmap for each platform. Idira sits inside Palo Alto Networks, Delinea is an independent vendor assembling a platform from acquisitions, and BeyondTrust ties its products together through Pathfinder.

• Idira within Palo Alto Networks. The consolidation case rests on integrations with Cortex, Strata and Prisma that Palo Alto describes as underway. If you already run a large Palo Alto estate, ask for generally available dates before you price that integration into your decision.
• Delinea's platform. The Delinea Platform pulls together Secret Server, the server privilege products, StrongDM (integration in progress), Fastpath for identity governance, and Authomize for identity threat detection. If governance sits in the same program, compare it against dedicated tools in our Okta vs SailPoint vs Omada comparison.
• BeyondTrust's platform. Pathfinder gives one console across BeyondTrust's SaaS products, with Identity Security Insights adding identity threat detection across identity providers and cloud.

Consolidation helps when you want fewer vendor relationships and your security operations team already works in that vendor's console. A standalone PAM vendor fits better when your stack is deliberately multi-vendor, or when you want the PAM roadmap set by a company whose main business is privileged access.

‍

CyberArk vs Delinea

CyberArk (now Idira) and Delinea both started as vault-first PAM vendors. In 2026 they separate on endpoint scope, how temporary access is delivered, and where their recent security events sat.

• Linux endpoints: Idira's endpoint product covers Linux. Delinea's dropped Linux on August 1, 2026, and Delinea now handles Linux through its server products.
• Temporary accounts: Idira documents temporary accounts for Windows, Linux and databases today. Delinea's equivalent comes from StrongDM, still being folded into its platform.
• 2026 security events: Delinea's on-premises Secret Server had four critical flaws in September, one reported as exploited. Idira's critical 2026 flaw sat in a secrets manager component, with no exploitation reported.
• Federal authorization: Delinea Secret Server holds FedRAMP High. The Idira listing found covers its endpoint product.

‍

CyberArk vs BeyondTrust

CyberArk (now Idira) and BeyondTrust differ most on remote access and machine identity. BeyondTrust's portfolio grew out of remote access; Idira's has grown toward secrets and certificates.

• Remote access exposure: BeyondTrust's self-hosted remote access appliances face the internet and had flaws in CISA's exploited catalog in 2024 and 2026. Idira's vendor access runs as SaaS.
• Help desk: BeyondTrust includes Remote Support. Idira documents no equivalent.
• Cloud temporary access: Idira uses Secure Cloud Access and BeyondTrust uses Entitle, both separate components.
• Machine identity: Idira includes certificate and SSH key management from Venafi. BeyondTrust documents no certificate product.

‍

Delinea vs BeyondTrust

Delinea and BeyondTrust are both independent PAM vendors. The documented gaps between them sit in endpoints, remote support and cloud access.

• Linux endpoints: BeyondTrust covers Unix and Linux endpoints. Delinea covers Linux through server products only.
• Remote support: Only BeyondTrust offers a help desk remote support product.
• 2026 exploited flaws: BeyondTrust's February flaw hit SaaS and self-hosted, with SaaS fixed first. Delinea's September flaw hit on-premises only.
• FedRAMP High: Delinea for Secret Server; BeyondTrust for Endpoint Privilege Management and Password Safe.

‍

Which PAM platform fits your privilege problem?

Answer four questions to see how each platform fits your situation. A self-hosting requirement adds the patching and exposure checklist to the result, and a structural mismatch, such as Linux endpoints on Delinea, marks a platform as a poor fit.

‍

How to choose a PAM platform on technical fit

Start from your privilege problem and your deployment constraint, then check each platform against both. These conditions come from documented capabilities, so test them in a trial before you sign.

Idira (CyberArk) is the stronger fit when:

• You want temporary accounts on Windows, Linux and databases without adding another product
• Linux endpoints need admin rights control and SaaS delivery is acceptable
• Secrets, certificates and AI agent identities belong in the same program as human admin access
• You already run Palo Alto Networks and can confirm integration dates in writing

Delinea is the stronger fit when:

• You need a FedRAMP High vault
• Your endpoints are Windows and macOS, and Linux privilege is a server problem
• You want on-premises options for both the vault and endpoint control
• Infrastructure access through StrongDM matches your roadmap and you can wait for platform integration

BeyondTrust is the stronger fit when:

• The help desk needs remote support from the same vendor as privileged access
• Unix and Linux endpoints need admin rights control
• You need temporary access across cloud consoles and SaaS admin roles today
• You can run remote access as SaaS, or patch self-hosted appliances fast

Whichever platform you shortlist, get three things in writing.

‍

Other PAM vendors outside this comparison

Several other platforms show up on PAM shortlists. This guide stays with the three that dominate head-to-head searches, and each of the others deserves its own evaluation.

• StrongDM now belongs to Delinea, so it appears in this guide inside the Delinea column.
• One Identity sells PAM alongside identity governance under its Safeguard line.
• Saviynt delivers PAM as part of its cloud identity governance platform.
• Keeper extends its password manager into privileged access with KeeperPAM.
• HashiCorp Boundary brokers identity-based access to infrastructure and pairs with HashiCorp Vault for secrets. It tends to serve platform engineering teams more than traditional PAM buyers.