Why CyberArk - CyberArk

How CyberArk Compares to the Competition

Don’t just take our word for it. Here is an analysis from IDG on how CyberArk stacks up to the competition.

Security, Recoverability, and Auditability
The solution is an “All- In-One” appliance that is built upon third-party software components that may present a wider attack surface. Passwords and audit security utilize the native security found in the MS SQL database.	Hardened secure server provides storage for credentials. HA/DR is provided with a clustered server deployment. Does provide audit capabilities	Isolated vault, hardened, and secured for credentials and privileged session recordings. Multiple HA and DR options without 3rd party dependencies Full audit trail protected by same vault security.	No hardening out of the box provided by the vendor. Local admin can export and decrypt entire DB including historic entries. (http://seclists. org/fulldisclosure/2017/ Apr/83)
Comprehensive and Flexible Password Rotation for Users, Applications, and DevOps tools
Password rotation for the web, customer, and Commercial-off-the- Shelf (COTS) applications is limited. Integration with DevOps tools is fairly basic and narrow with support for only a generic API. There is no certified integration with specific DevOps tools.	Password rotation on Windows requires additional components and support for applications is limited and requires extensive customization. Limited integration with DevOps tools — only through generic API. No certified integration.	Largest number of system, COTS, and custom applications supported. Enterprise ready. Integration with security tools via the CyberArk C3 Alliance program. Connectors and plug-ins available including customization. Deep integration with DevOps applications.	Limited support for custom and COTS applications. Limited integration with DevOps tools — only through generic API.
Privileged Attack Detection and Prevention for On-premises, Cloud, and DevOps
The solution has no built-in analytics capabilities. The product can only aggregate and correlate known events for credentials contained within the solution. There is no discovery and mapping of privileged accounts risks.	Analytics is based on add-on to Privileged Access Manager. No privileged account attack detection and prevention.	Detection and prevention of privileged account attacks such as Pass the Hash and Golden Ticket. Integration with session management and endpoint privileged management provides greater visibility. Mapping between suspicious privileged account activities and their corresponding session recordings identifies potential attack.	Analytics is based on add-on to SecretServer. No privileged account attacks detection and prevention.
Flexible and Scalable Architecture
To provide scalability and growth, multiple nodes need to be deployed using an SQL AlwaysOn Availability Group (AG). AG may be a difficult product to patch in production, and vulnerabilities have been identified in the past for SQL Server.	New release offers improvements to the appliance to support better scaling. Improvements to clustering have also improved scaling. Flexibility is a bit limited with current solution.	Component-based architecture allows flexible architecture and deployment. Software-based components are less complex to deploy and maintain. This also facilitates flexibility and easier scaling of hardware. Distributed networks and multi-site deployments are easily scalable.	Scalability is not yet completely proven in enterprise organizations.

Security, Recoverability, and Auditability

The solution is an “All- In-One” appliance that is built upon third-party software components that may present a wider attack surface.

Passwords and audit security utilize the native security found in the MS SQL database.

Hardened secure server provides storage for credentials.

HA/DR is provided with a clustered server deployment.

Does provide audit capabilities

Isolated vault, hardened, and secured for credentials and privileged session recordings.

Multiple HA and DR options without 3rd party dependencies

Full audit trail protected by same vault security.

No hardening out of the box provided by the vendor.

Local admin can export and decrypt entire DB including historic entries. (http://seclists. org/fulldisclosure/2017/ Apr/83)

Comprehensive and Flexible Password Rotation for Users, Applications, and DevOps tools

Password rotation for the web, customer, and Commercial-off-the- Shelf (COTS) applications is limited.

Integration with DevOps tools is fairly basic and narrow with support for only a generic API. There is no certified integration with specific DevOps tools.

Password rotation on Windows requires additional components and support for applications is limited and requires extensive customization.

Limited integration with DevOps tools — only through generic API. No certified integration.

Largest number of system, COTS, and custom applications supported.

Enterprise ready. Integration with security tools via the CyberArk C3 Alliance program. Connectors and plug-ins available including customization.

Deep integration with DevOps applications.

Limited support for custom and COTS applications.

Limited integration with DevOps tools — only through generic API.

Privileged Attack Detection and Prevention for On-premises, Cloud, and DevOps

The solution has no built-in analytics capabilities. The product can only aggregate and correlate known events for credentials contained within the solution.

There is no discovery and mapping of privileged accounts risks.

Analytics is based on add-on to Privileged Access Manager.

No privileged account attack detection and prevention.

Detection and prevention of privileged account attacks such as Pass the Hash and Golden Ticket.

Integration with session management and endpoint privileged management provides greater visibility.

Mapping between suspicious privileged account activities and their corresponding session recordings identifies potential attack.

Analytics is based on add-on to SecretServer.

No privileged account attacks detection and prevention.

Flexible and Scalable Architecture

To provide scalability and growth, multiple nodes need to be deployed using an SQL AlwaysOn Availability Group (AG).

AG may be a difficult product to patch in production, and vulnerabilities have been identified in the past for SQL Server.

New release offers improvements to the appliance to support better scaling.

Improvements to clustering have also improved scaling.

Flexibility is a bit limited with current solution.

Component-based architecture allows flexible architecture and deployment.

Software-based components are less complex to deploy and maintain. This also facilitates flexibility and easier scaling of hardware.

Distributed networks and multi-site deployments are easily scalable.

Scalability is not yet completely proven in enterprise organizations.

Secure Privilege Everywhere

Privilege is Everywhere

#1 Leader in Privileged Account Security

Most Comprenhensive Privileged Account Security Portfolio

How CyberArk Compares to the Competition

Trusted by the Leading Enterprises

Request a Demo

Learn More

Privileged Account Security Solutions: A Competitive Review

CyberArk Privileged Account Security Solution

Rapid Risk Reduction: A 30-Day Sprint to Protect Privileged Credentials