Delinea vs BeyondTrust when the vault, the vendor tunnel, and local admin all land in one PAM project

A contractor still connects over a shared VPN account, 40 servers still share one local admin password, and the audit request asks who approved last Tuesday’s session. Both vendors sell privileged access management for that exact list. They package it differently: Delinea around a vault with deep approval workflows, BeyondTrust around named modules that start at the remote session.

Delinea is the company formed from Thycotic and Centrify, and Secret Server remains its vault. BeyondTrust sells Password Safe, Privileged Remote Access, Remote Support, and Endpoint Privilege Management as separately quoted modules, with a single SKU bundling Password Safe and Privileged Remote Access.

Buy Delinea when vault approvals need multi-step workflows and host elevation runs through an agent. Buy BeyondTrust when vendor remote access and service desk sessions are the first exposure to close.

Overview

	Delinea	BeyondTrust
Primary use case	Secret Server vault for checkout, rotation, and approval, plus Privilege Control for Servers for host login, elevation, and session recording	Password Safe vaulting, Privileged Remote Access and Remote Support for controlled remote sessions, and Endpoint Privilege Management to remove standing local admin
Day-to-day workflow	Request a secret, pass a workflow of reviewers, check out, and let rotation run on check-in. Server policy applies only where the Delinea Agent is installed with an active Command Relay on a Delinea Engine	Vendor admins onboard their own users, request access to pre-approved Jump items, receive injected credentials, and every action is logged from login to logout
Main buying consideration	Sales quote for Secret Server editions (Secret Server Cloud on the Delinea Platform or on-premises) and for Privilege Control. No public per-user total on delinea.com when checked 10 Oct 2026	Product pages are quote-only. Remote Support meters concurrent technicians. Password Safe, Privileged Remote Access, and Endpoint Privilege Management meter managed assets per the AWS Marketplace capacity language

We reviewed Delinea Secret Server workflow and checkout-rotation documentation, the Privilege Control for Servers policy guide, and a Delinea Swiss bank case study, plus BeyondTrust Privileged Remote Access, Password Safe, Remote Support, and Endpoint Privilege Management product pages, the City of Midlothian case study, and the BeyondTrust AWS Marketplace capacity table, on 10 Oct 2026.

Delinea

BeyondTrust

Editions and pricing

Neither vendor prints a list price on its own site. BeyondTrust publishes capacity meters on AWS Marketplace; Delinea packaging is edition plus add-on on a quote.

	Delinea	BeyondTrust
How it is sold	Secret Server editions on the Delinea Platform or on-premises, with Privilege Control for Servers, Privilege Manager for workstations, and Remote Access as separate products	Named modules, each quoted for its own capacity. Password Safe plus Privileged Remote Access available as one PASM and VPAM bundle SKU
Figure on the public page	No USD on delinea.com pricing pages when checked 10 Oct 2026	No product-only USD on beyondtrust.com. AWS Marketplace private offers describe capacity in concurrent users or managed assets rather than a printed list price
Deployment that changes the quote	Secret Server Cloud or self-hosted Secret Server. Privilege Control requires the Delinea Agent and a Delinea Engine Command Relay in the same domain	SaaS or self-hosted appliances for Remote Support and Privileged Remote Access. Endpoint Privilege Management covers Windows, macOS, and Linux

Vault, approval, and recording

Both products vault credentials, require approval, and record sessions. The split is approval depth and where the recording is enforced.

	Delinea	BeyondTrust
Approval object	Simple request with one reviewer, or a workflow template of up to 15 steps with per-step reviewers, required counts, timeouts, branching, and ticket validation. A finished workflow request cannot be reopened	Access requests through Password Safe and Privileged Remote Access, with internal and external request steps scoped to specific Jump items
Session recording	Privilege Control can deny host access when recording cannot run. Emergency Access policies skip that requirement. Secret Server records vault-launched sessions	Privileged Remote Access logs every action from login to logout and records sessions with injected credentials so the vendor never sees the password
Rotation	Secret Server rotates on check-in and on schedule for managed accounts	Password Safe automates cycling of server passwords and discovered accounts

Remote access and endpoint privilege

Both companies also sell remote access and endpoint least privilege. The documented split is which module the program usually starts with.

	Delinea	BeyondTrust
Vendor access	Delinea Remote Access provides browser-based sessions launched from the vault	Privileged Remote Access removes VPN for vendors, with Vendor Onboarding that delegates vendor user management to vendor admins
Service desk	Not a separate service desk product in this pair	Remote Support meters concurrent technicians for attended and unattended support sessions
Endpoint least privilege	Privilege Manager removes local admin on workstations with application control policies	Endpoint Privilege Management removes local admin rights on Windows, macOS, and Linux and elevates approved applications

Favor Delinea when the documented requirement is Secret Server workflow templates with up to 15 approval steps, ticket validation, and Privilege Control recording enforced on hosts through the Delinea Agent. Favor BeyondTrust when the documented requirement is Privileged Remote Access with Vendor Onboarding and credential injection, Remote Support for the service desk, and Endpoint Privilege Management across three operating systems.