CyberArk vs Delinea for vault, privileged session, and discovery
Match session control, credential rotation, approval, just-in-time access, and deployment for CyberArk Privilege Cloud or self-hosted PAS and for Delinea Secret Server plus Privilege Control for Servers.
The PAM desk’s bad week is a pending-accounts list that keeps growing, a shared admin password still in a runbook, and an auditor asking who touched the jump host last Tuesday. Those jobs close through session control, rotation, approval, and time-bounded access, not through a market-segment label.
CyberArk Privilege Cloud (SaaS) and self-hosted Privileged Access Security (PAS) center Safes, platform rotation, and Privileged Session Manager when a connector is deployed. Palo Alto Networks completed the CyberArk acquisition on 11 February 2026 and markets the broader identity platform as Idira. Confirm the SKU name on the quote. Delinea for this shortlist is Secret Server for the vault, with approval workflows of up to 15 steps, plus Privilege Control for Servers for host login and elevation. Privilege Manager remains the workstation product and is not a column by itself. Adjacent shortlists sit under identity protection tools and PAM tools.
| Primary use case | Privilege Cloud or self-hosted PAS: Safes, rotation, PSM session control when a connector is deployed, and discovery into managed accounts | Secret Server for vault, checkout, rotation, and approval, plus Privilege Control for Servers for host login, elevation, and session recording |
|---|---|---|
| Session control | With a PSM connector, recordings are text or video. Authorized auditors can monitor, suspend, resume, or terminate a live session. SIA-only connectors do not support session monitoring | Privilege Control can record the session and can deny access when recording cannot run. Emergency Access policies skip that recording requirement. Secret Server also records vault-launched sessions |
| Approval | Dual control in the Master Policy: a request states the reason, one-time or repeated use, and the time window. Safe owners with Authorize account requests confirm. Multi-level and direct-manager modes exist, and they do not combine | A simple request is one reviewer and can be reversed. A workflow template allows up to 15 steps, each with its own reviewers and required count, plus timeouts, branching, and a ServiceNow or BMC ticket check. A finished workflow request cannot be reopened |
| Deploy | Privilege Cloud SaaS, with the PSM connector in your network if you need session monitoring, or self-hosted PAS | Secret Server Cloud on the Delinea Platform or Secret Server on premises. Privilege Control policy is enforced only where the Delinea Agent is installed, and it needs an active Command Relay on a Delinea Engine in the same domain |
| License/pricing | Sales quote for Privilege Cloud or PAS and for session components. No public self-serve total for a full vault and PSM program was on the product pages checked 3 Oct 2026 | Sales quote for Secret Server editions and for Privilege Control. No public per-user total for that stack was on delinea.com |
| Who operates it | Safe owners, dual-control confirmers, and the team that runs the PSM connector when session monitoring is in scope | Secret Server approvers, plus the team that keeps the Delinea Agent and Command Relay active for Privilege Control |
We reviewed Idira and CyberArk privileged-access packaging, the Privilege Cloud session-monitoring page, the dual-control workflow, the Privilege Cloud SSH-certificate just-in-time page, Delinea Secret Server workflow and checkout-rotation docs, and the Privilege Control for Servers policy guide, on 3 Oct 2026. We did not run either product in a paid tenant, so this is not a hands-on benchmark. A Windows just-in-time path for CyberArk was not opened. A short-lived certificate flow for Delinea was not on the Privilege Control policy page.
CyberArk
Delinea
Palo Alto Networks closed the CyberArk acquisition on 11 February 2026. Privilege Cloud and PAS capabilities continue under that lineage, and the quote should name Privilege Cloud, PAS, or Idira packaging explicitly. Delinea is the combined company from Thycotic and Centrify. Secret Server comes from the Thycotic lineage. Privilege Control for Servers carries the Centrify server-privilege lineage onto the Delinea Platform.
Editions and pricing
Neither vendor publishes a credit-card total for a program that covers vault, session control, and discovery together. Quotes still turn on named users, managed accounts or servers, session options, and whether workstation elevation is on the same order. No reseller unit price is printed here, because a current Marketplace row with currency, unit, period, commitment, and included product was not re-checked for this revision.
| How you buy it now | Contact sales for Privilege Cloud or self-hosted PAS. Confirm whether the quote says CyberArk Privilege Cloud, PAS, or Idira Privileged Access packaging | Request a quote for Secret Server Cloud or an on-premises edition, and add Privilege Control for Servers when host login and elevation are in scope |
|---|---|---|
| Public price (3 Oct 2026) | No list price on the public Idira and CyberArk PAM pages for a vault plus PSM program. A Marketplace unit is not cited here | No public per-user list price on delinea.com for Secret Server plus Privilege Control. Edition tables describe capability tiers, not a checkout total |
| What the invoice covers | Safe capacity, named users, PSM or session options, discovery, and any endpoint module written on the order | The Secret Server edition, plus Privilege Control for Servers, Privilege Manager, or other platform products as separate lines when they are on the quote |
| Main buying consideration | Does the quote include a PSM connector, or only a path that the monitoring doc says cannot record sessions? | Does the quote include Secret Server only, or also Privilege Control for Servers with the agent and Command Relay? |
Session control
| What gets recorded | Privilege Cloud records privileged sessions in text or video when a PSM connector is deployed. Search can filter by user, target, connection type, commands, and keystrokes. SIA-only connectors do not support this monitoring | On Privilege Control, session recording is a policy control. Marking it Required denies access when the endpoint cannot record. Emergency Access profiles allow access without recording. Secret Server records sessions launched from the vault |
|---|---|---|
| Live control | An authorized auditor can monitor an active session, take part in controlling it where the platform allows, and suspend, resume, or terminate it. The Auditors group can view all recordings. Narrower rights come from Account Safes and Recording Safes | Privilege Control can also require MFA at login or elevation, and an Endpoint Login policy can limit Windows access to console, RDP, remote PowerShell, or a combination. A live suspend and terminate control matching the PSM auditor actions was not in the policy guide checked for this revision |
| Main buying consideration | Is the requirement a brokered session that an auditor can suspend or terminate, which means a PSM connector is on the quote? | Is the requirement host recording that can refuse the login when recording is down, plus MFA at elevation? |
The comment is about not handing out the SSH or RDP password, and about rotating a shared password. It matches the documented PSM path, where the session is brokered, and platform rotation of managed passwords. It does not rank operational effort.
Rotation and approval
| Rotation | Privilege Cloud / PAS rotates managed accounts from platform policy. Accounts inherit the platform’s secrets-rotation settings. The SSH-certificate CA key is the documented exception: automatic management is disabled and the key pair is replaced by hand | Secret Server remote password changing can rotate on check-in when checkout is also enabled. The secret gets an exclusive-access interval. Change Password Now is available on a checked-out secret, and a pending change has to finish before check-in |
|---|---|---|
| Approval before access | Dual control is off until you set Require dual control password access approval on a platform exception. The requester gives a reason and a time period. One confirmer, several confirmers, two levels, or the direct manager from Active Directory can be required. Direct-manager mode cannot be combined with multi-level approval or with more than one confirmer. Idira Mobile can confirm or reject. When the access window ends, timeframe expiration can terminate the session | Require approval on the secret or on a workflow. Simple requests use one reviewer and can later be denied after an approval, or approved after a denial. Workflow templates lock the outcome once the request is approved, denied, or canceled. Steps can time out, branch, and require a ServiceNow or BMC ticket |
| Main buying consideration | Do you need platform rotation for managed accounts, plus a counted set of Safe confirmers before the password or the session is released? | Do you need checkout that rotates the password on the way back in, with either a one-step approval or a multi-step workflow? |
The comment names Secret Server for API keys and break-glass accounts, and points at other PAM tools when the need is more granular. It is one person’s scope note from September 2024. It is not a measurement of which product takes more operational work.
Just-in-time access and deployment
| Time-bounded access | PSM for SSH can sign a short-lived SSH certificate. The default time to live is five minutes, the certificate is discarded, and it does not reach the user’s workstation. The target needs OpenSSH 5.3 or higher and the CA public key. This flow does not support Telnet, CPM rotation of the CA key, or AD Bridge in PSM for SSH. A Windows just-in-time path was not opened in this revision | Privilege Control policies can carry a local time-range condition. With no time range, the policy applies at all times. Granular Privilege Elevation grants named commands, through dzdo on Linux or Run with Privilege on Windows, instead of standing root or local admin. A short-lived certificate flow was not on the policy page checked for this revision |
|---|---|---|
| Where the control runs | The Privilege Cloud portal is the SaaS control plane. Session monitoring, suspend, and terminate require a PSM connector you deploy. Self-hosted PAS is the other deployment on the quote. Confirm which one the order names after the Idira packaging change | Secret Server Cloud or on-premises holds the vault. Privilege Control shows Activating, Active, or Activation Failed per policy. Targets without the Delinea Agent are listed as not enforced. At least one Command Relay workload must be Active on a Delinea Engine in the same domain. Windows local-admin emergency access is on by default so the first policies do not lock administrators out |
| Discovery into the control | Account discovery feeds Windows and Unix privileged accounts toward Safes. Privilege Cloud 14.7, September 2025, pointed classic Discovery Scanner and Onboarding Rules toward Discovery SaaS scanning. A discovered account still has to be onboarded before rotation and PSM apply | Secret Server discovery inventories privileged accounts for vault management. Privilege Control targets can include computers that do not yet have the agent. The policy starts enforcing when the agent is installed and the computer is joined to a domain and zone |
| Main buying consideration | Do the Unix targets you care about fit short-lived SSH certificates through PSM for SSH, with a connector in your network? | Do the servers you care about fit an agent, a Command Relay, and either a time window or command-level elevation? |
Discovery without onboarding is a list. The useful test is whether a found admin account becomes a rotated, approved, session-controlled account. Both products document that path. Which components are on the quote decides whether the path is actually licensed.
Where they overlap
Both are commercial privileged access platforms: an encrypted vault, automated rotation, approval before access, discovery of privileged accounts, and session recording when the session component is deployed. An RFP that only says “replace shared admin passwords” will get adjacent demos.
The split that is documented, rather than inferred, is the session mechanism and the time-bounded mechanism. CyberArk session monitoring, suspend, and terminate are PSM connector features, and the just-in-time flow checked here is a five-minute SSH certificate. Delinea session recording and MFA sit on Privilege Control policy, checkout can rotate the password on check-in, and approval is either one reviewer or a workflow of up to 15 steps. Broader PAM shortlists sit under PAM tools. Workforce identity provider decisions are a different hire on Okta vs Microsoft Entra ID.
When to use both
Running both vaults for the same admin accounts splits checkout and rotation across two owners. A split that stays coherent is by system class: one product vaults and records a named tier of servers, and the other is not also the system of record for those same passwords. Privilege Manager on workstations can sit beside either server vault only if workstation elevation is a separate scope. If one team would approve requests in both products for one account, pick the packaging you will staff.
Choose CyberArk when the quote names Privilege Cloud or self-hosted PAS, a PSM connector for recorded sessions that an auditor can suspend or terminate, platform rotation, dual-control approval, and, for Unix, short-lived SSH certificates. Choose Delinea when the quote names Secret Server for checkout, rotation on check-in, and approval workflows, plus Privilege Control for Servers for agent-based recording, MFA, and command or time-bounded elevation. Confirm the Idira name on the CyberArk order. Do not treat a market segment as a substitute for those lines.
FAQs
Is CyberArk still CyberArk after the Palo Alto Networks deal?
Palo Alto Networks completed the CyberArk acquisition on 11 February 2026 and markets the broader identity platform as Idira. Privilege Cloud and PAS capabilities continue under that lineage. Confirm whether the quote says CyberArk Privilege Cloud, PAS, or Idira Privileged Access packaging.
What is Delinea’s relationship to Thycotic and Centrify?
Delinea is the combined company from Thycotic and Centrify. Secret Server comes from the Thycotic lineage. Privilege Control for Servers carries the Centrify server-privilege lineage onto the Delinea Platform. Buy the current product names.
Does CyberArk Privilege Cloud include session recording?
Session monitoring and recording are documented when a PSM connector is deployed. Auditors can monitor, suspend, resume, or terminate a live session. Environments that use only Secure Infrastructure Access connectors do not get that monitoring. Confirm the connector on the quote.
How does approval differ?
CyberArk dual control is a Master Policy exception. Confirmers are Safe owners, and the choices include a set number of confirmers, two levels, or the direct manager, but not those modes combined. Delinea simple requests use one reviewer and can be reversed. Workflow templates allow up to 15 steps and lock the outcome once the request is finished.
What just-in-time access is actually documented?
CyberArk PSM for SSH signs a certificate with a default five-minute time to live, then discards it. A Windows just-in-time path was not opened for this revision. Delinea Privilege Control uses local time-range conditions and command-level elevation. A short-lived certificate flow was not on that policy page.
Do either publish list prices?
Not for a full vault, session, and discovery program on the public product pages checked for this revision. No reseller unit price is cited. Expect a sales quote scoped to users, accounts or servers, and modules.
