CyberArk Privileged Access Manager (On-Premise) is one of the most mature and comprehensive PAM platforms that I have evaluated and deployed. Within an organization that operates across hybrid cloud environments and with a multitude of legacy on-premise servers and accounts that still remain, CyberArk PAM provides centralized control over privileged credentials, session recording, automatic password rotation/management, and platform integrations that other light-weight tools could not. The on-premise deployment and architecture is solid - however the journey to get there was not trivial. The implementation required significant upfront planning, dedicated resources, and close collaboration with both internal company teams and CyberArk Professional Services. Time-to-value was measured in months, not weeks. Speaking specifically to the on-premise offering, the platform delivers on its promise, but you have to be prepared for the investment - both financially and operationally.

Customers want a PAM solution, so we looked at Cyber Ark to reduce the risks associated with privilege sprawl. It provides advanced auditing, video recording and credential rotation capabilities that are intended to add value to a secure by design methodology. The journey thus far has been mixed. While the platform offers strong features, there are technical gaps. Password rotation only works in specific setups - don't expect it to work with all configurations. If you use scanners or zealot firewalls in your own environment, expect some features such as 365 access etc to not work as it requires an add-on in your browser which most environments will look to block. Check-ins and check-outs don't work reliably. Administrators have to constantly unlock accounts, even while following best practices. Support is okay - they do help but to a point, as if it's hosted on your own environment they can't help as much. When it does work, and in the right setups (PAM servers hosted locally in the customer's environment), it works fine for the most part (minus check in/outs).