Platform Model
Breadth of native coverage
Single platform converging IAM + IGA + PAM. Privileged sessions are automatically correlated with governance policies and cloud entitlements no separate product required.
4-in-1 Native Platform
PAM-first platform. IGA is referenced only in a news article title on their homepage, it is not listed as a core product pillar. CIEM is not a distinct offering.
IGA / CIEM Not Core Pillars
IGA Coverage
Identity governance and administration
Full IGA pillar: access certifications, role management, Separation of Duties, and lifecycle policies. IGA data is natively correlated with PAM session data for unified risk view.
Full IGA Native
IGA capabilities are not listed as a core pillar on their product pages. Customers requiring full IGA must procure a separate governance tool and integrate it independently.
Requires Separate IGA Tool
Architecture
Technical design
Agentless-first architecture. No agent deployment or maintenance overhead. Privileged access managed through connectors, not endpoint agents. Scales without agent sprawl.
Agentless-First
Agent-based architecture for endpoint privilege security. Agent deployment and maintenance across endpoints adds significant operational overhead and complexity.
Agent-Based Overhead
Time to Value
Speed to find production use
5-5-5 Rapid Deployment Program: 5 apps connected in 5 weeks for $5K. A contractually committed, fixed-price entry point with immediate production value.
5 Apps, 5 Weeks, $5K — Fixed Price
No deployment timeline or time-to-value metric is published on their website. Complex agent-based deployments typically require specialized expertise and extended timelines.
No Public Timeline Commitment
Connector Count
Pre-built integrations
250+ connectors spanning IAM, IGA, and PAM targets. Cross-pillar coverage in one catalog. Connector SLAs are defined and published.
250+ Cross-Pillar Connectors
300 out-of-the-box integrations focused primarily on PAM-relevant targets. Coverage for IGA and CIEM targets requires separate product integrations.
300 Integrations, PAM-Focused
Vendor Independence
Ecosystem neutrality
Purpose-built independent identity security company. No parent platform dependencies. Roadmap driven entirely by identity security outcomes.
Fully Independent
Recently acquired by Palo Alto Networks. Platform roadmap and integration priorities may shift to align with the acquiring company's broader security portfolio.
Palo Alto Networks Acquisition
IGA Capabilities
Governance depth
Full IGA module: AI-assisted User Access Reviews, role mining, Separation of Duties, access request workflows, and audit-ready compliance reporting.
Full IGA Module
IGA is not a core pillar. Lifecycle Management is listed as a feature under their workforce access product but full governance (SoD, certifications, role mining) requires a separate tool.
Full IGA Requires Separate Tool
Compliance Frameworks
Regulatory coverage
Pre-built reports for SOX, HIPAA, PCI-DSS, GDPR, and SOC 2. Continuous monitoring ensures audit readiness at all times.
Pre-Built Compliance Reports
Compliance reporting for PAM-specific requirements (privileged access audit trails) is strong. Cross-domain compliance (IGA + PAM + CIEM) requires separate tooling.
PAM Compliance Only
AI Capabilities
Intelligence across pillars
Generative + Agentic AI Assistant: AI-powered User Access Reviews, role mining, anomaly detection, and natural language queries across IAM, IGA, and PAM.
Generative + Agentic AI
Intelligent privilege controls and AI-driven identity security are claimed focused on privilege-specific threat detection. Cross-pillar AI intelligence is not detailed.
Privilege-Focused AI
Threat Detection
ITDR and monitoring
Continuous monitoring with ITDR: real-time threat detection, automated response, and Identity Threat Detection and Response across all identity pillars.
Continuous Monitoring + ITDR
User Behavior Analytics is listed as a feature focused on privileged account behavior. Cross-domain ITDR (spanning IGA, PAM, and CIEM) is not a distinct offering.
UBA for PAM Only
All-in-one flat pricing. Single subscription covers IAM, IGA, and PAM. No per-module add-on costs. No pricing gates by capability tier.
No Module Upsells
No pricing published on website. No pricing page linked from homepage. Pricing is negotiated per engagement. Total cost of ownership is consistently cited as very high.
High TCO, No Transparency
Support and Services
Customer support model
24/7 dedicated support included. No additional PS fees for standard operations. Expert identity and security assistance available at any time.
24/7 Always-On Support
Support available but complex agent-based deployments and custom integrations typically require specialized CyberArk-certified professional services at additional cost.
Specialized PS Required
