CyberArk vs BeyondTrust when the ticket is vaulted sessions or vendor and endpoint privilege

A vendor asks for weekend firewall access while the service desk still resets local admin rights on every laptop that needs a driver install. The failure is not missing a password field. It is standing shared credentials with no recording, or standing local admin on every endpoint the help desk touches.

Buy CyberArk when the program is a hardened vault and recorded admin sessions at enterprise scale. Buy BeyondTrust when vendor remote access and removing local admin on endpoints are the urgent risks.

Overview

	CyberArk	BeyondTrust
Primary use case	Privilege Cloud or self-hosted PAS for vaulted privileged accounts in Safes, rotation, and PSM session audits and video when a PSM connector is deployed	Password Safe for vaulted credentials and sessions, Privileged Remote Access and Remote Support for controlled remote work, and Endpoint Privilege Management to remove local admin rights
Day-to-day workflow	Check out or connect through the Privilege Cloud Portal, land in a brokered session, and review Monitoring recordings or live sessions that auditors can suspend or terminate	Inject vaulted credentials into Privileged Remote Access or Remote Support sessions, scope vendor Jump access, and elevate approved apps on endpoints that no longer run as standing local admin
Main buying consideration	AWS Marketplace lists a 12-month pack of 25 Standard Privilege Cloud users at USD 44,712; other Privilege Cloud, PAS, and Idira packaging remains a sales quote for session components and user types	Product pages are quote-only. Remote Support meters concurrent technicians; Password Safe, Privileged Remote Access, and Endpoint Privilege Management meter managed assets on the public AWS Marketplace capacity language reviewed

We reviewed CyberArk Privilege Cloud session-monitoring documentation for PSM recordings and live session controls, the CyberArk AWS Marketplace Privilege Access Management listing for the Standard Privilege Cloud user pack, Palo Alto Networks Idira packaging notes after the 11 February 2026 CyberArk acquisition, and BeyondTrust’s Password Safe, Privileged Remote Access, Remote Support, and Endpoint Privilege Management product pages plus the BeyondTrust AWS Marketplace private-offer capacity table, on 7 Oct 2026.

CyberArk

BeyondTrust

Editions and pricing

Both vendors sell enterprise PAM through quotes. CyberArk publishes one clear Standard Privilege Cloud user pack on AWS Marketplace. BeyondTrust publishes capacity meters (concurrent users vs managed assets) while the product pricing pages stay contact-sales.

	CyberArk	BeyondTrust
How it is sold	Privilege Cloud SaaS user types and self-hosted PAS components on a sales quote. Confirm whether the order says CyberArk Privilege Cloud, PAS, or Idira Privileged Access packaging after the Palo Alto Networks acquisition	Named modules on Pathfinder: Password Safe, Privileged Remote Access (bundled PASM SKU available with Password Safe), Remote Support, and Endpoint Privilege Management. Each module is quoted for its own capacity
Figure on the public page	USD 44,712 for 25 Standard Privilege Cloud users for 12 months on the AWS Marketplace listing sold by CyberArk Software Ltd., checked 7 Oct 2026. That figure is the published pack, not a separately negotiated Enterprise private offer	No product-only list dollar on beyondtrust.com pricing pages for Remote Support or Endpoint Privilege Management. AWS Marketplace private-offer rows mix subscription capacity with implementation and education services, so those dollars are not cited as license-only rates here
What the listing adds about payment	Custom pricing and private offers are directed to CyberArk on the same Marketplace page. Session connectors and additional user types sit outside the 25-user Standard pack unless the private offer says otherwise	Remote Support capacity is described in concurrent technicians. Password Safe, Privileged Remote Access, and Endpoint Privilege Management capacity is described in managed assets. Modules bill independently when more than one is purchased

Vault and recorded sessions

Both stacks vault privileged credentials and can record sessions. The documented CyberArk path centers Privilege Cloud Safes plus PSM. BeyondTrust splits vaulted PASM into Password Safe and remote session products that inject those credentials.

	CyberArk	BeyondTrust
Vault surface	Privilege Cloud and PAS keep privileged accounts in Safes with platform-driven rotation. Credentials are checked out or injected into brokered connections rather than left as standing shared passwords	Password Safe discovers, onboards, vaults, and rotates privileged passwords, keys, and secrets, with session management and Workforce Passwords as an add-on for non-privileged business apps
Session recording	Privilege Cloud records privileged sessions in text or video when a PSM connector is deployed. Auditors open Monitoring in the Portal, play HTML5 video, and can monitor, suspend, resume, or terminate live sessions. SIA-only connector environments do not get that monitoring	Password Safe, Privileged Remote Access, and Remote Support each document session logging and recordings for compliance review. Admins can lock or terminate suspicious Password Safe sessions in the materials reviewed
Where control runs	Privilege Cloud Portal is the SaaS control plane. PSM connectors you deploy unlock session monitoring. Self-hosted PAS remains the other deployment path on the quote	Password Safe deploys as cloud or appliance. Privileged Remote Access and Remote Support broker sessions with Jump Clients or Jumpoints. Endpoint Privilege Management enforces policy on the managed Windows, macOS, and Linux endpoints

Vendor access and endpoint least privilege

Shared PAM surface includes third-party access and host privilege. BeyondTrust documents dedicated Remote Support and Privileged Remote Access products for that work, plus Endpoint Privilege Management for standing local admin removal. CyberArk documents vendor PAM and session isolation on the Privilege Cloud / Marketplace materials, with endpoint privilege as a separate Idira / CyberArk Endpoint Privilege Manager surface rather than the vault frame on this page.

	CyberArk	BeyondTrust
Vendor and remote access	Marketplace and Privilege Cloud materials describe vendor privileged access with just-in-time workflows and session isolation for third parties, integrated with accounts managed in the vault. Confirm Remote Vendor / Advanced Remote Access packaging on the quote	Privileged Remote Access targets vendor privileged access management without a VPN, with vendor onboarding and credential injection. Remote Support covers service-desk attended and unattended support with Jump Clients and session audit trails
Endpoint local admin	Idira / CyberArk Endpoint Privilege Manager is documented as the endpoint least-privilege layer that removes standing local administrator rights. It is adjacent to Privilege Cloud, not a substitute for Safes and PSM on this shortlist	Endpoint Privilege Management removes local admin rights on Windows and macOS desktops and controls root on Linux, elevating only the approved application, command, or task for the time needed

Favor CyberArk when the documented requirement is Privilege Cloud or PAS Safes plus PSM-recorded admin sessions an auditor can play, suspend, or terminate. Favor BeyondTrust when the documented requirement is Privileged Remote Access or Remote Support for vendors and the service desk, plus Endpoint Privilege Management to remove local admin rights on Windows, macOS, and Linux. Confirm Idira packaging on the CyberArk order.