CyberArk Portfolio Overview

Privileged accounts are a persistent, high-impact security risk because they enable systemic change across on-premises and cloud environments, making them central targets in advanced external and insider attacks. With administrative access, an attacker can expand control by creating additional accounts, changing privileges, and evading detection through altered configurations and modified or deleted logs. This risk is amplified in public cloud consoles such as AWS and Azure due to their breadth of administrative capability. Many organizations lack basic visibility into how many privileged accounts exist or who can use them, and some still rely on shared admin accounts that undermine auditing and individual accountability.

Service accounts add another major weakness: credentials are often embedded in scripts or configuration files, sometimes in clear text, rarely rotated, and frequently overprovisioned or repurposed beyond original intent. External privileged access introduces further exposure, especially via business partners using unmanaged devices, illustrated by contractor compromise leading to a major retail data release. Operational technology is also increasingly vulnerable as industrial control systems become more integrated with IT networks and are sometimes managed by vendors, increasing third-party risk.

CyberArk, founded in Israel in 1999 and publicly listed in 2014, positions its Privileged Account Security solution as an enterprise-grade PAM platform spanning on-premises, cloud, hybrid, and DevOps. Capabilities include a password vault that brokers access without revealing credentials, discovery and rotation of passwords and SSH keys, agentless privileged session monitoring and recording, application credential management to remove hard-coded secrets, behavioral analytics to detect anomalies and automate response, granular command control for Unix/Linux, and endpoint privilege reduction. Strengths include breadth, integration, and cross-platform coverage; challenges include differentiating from rudimentary OS features and framing adoption around risk management.

• A user with administrative privileges has complete control over a computer system in on-premises or cloud environments.
• Attackers with admin rights can create additional accounts in other systems and alter security monitoring configurations or activity logs to avoid detection.
• Some organizations still use shared accounts for system administration and lack effective auditing for individual accountability.
• Public cloud management consoles such as Amazon Web Services (AWS) and Microsoft Azure provide extensive capability to cloud administrators.
• Service account credentials often reside in unencrypted configuration files and text scripts.
• CyberArk was formed in Israel in 1999, and its co-founder remains active in the company.
• CyberArk listed on the NASDAQ Exchange in 2014.
• CyberArk acquired Cybertinel and Viewfinity in 2015.
• A 2016 CyberArk survey found that 62% of organizations had not removed local administrator rights from Windows endpoints.
• CyberArk’s Privileged Session Manager is agentless and provides access via a proxy server.

• “As a principle, no one should have access to a system or application which exceeds that required for them to do their job.”
• “Most cyberattacks involve exploiting privileged accounts, and cybersecurity due diligence requires the use of Privileged Access Management solutions.”
• “Someone with full administrative rights can add accounts or change privileges on existing accounts such that they have unique access rights which can be difficult to detect and remove.”
• “A competent attacker can modify logs and virtually remove evidence of their activity.”
• “CyberArk’s traditional approach to managing privileged accounts is based on a password vault that intercepts login requests and logs the user into the target system with a managed password.”
• “This means that a user does not actually know the password being used, so that a complex password can be employed that is much less susceptible to cracking.”
• “Managing sessions that are using elevated privileges is a core requirement for a PAM product.”
• “The Privileged Session Manager solution is agentless, meaning that it is not necessary to install a software client.”
• “The threat analytics functionality provided by CyberArk provides behavioral analysis which seeks to detect potentially damaging activity without the need to establish complex policies.”
• “CyberArk recommends a ‘grey-listing’ approach whereby a combination of ‘blacklisting known malware and placing limits on the permissions available to applications that are not ‘whitelisted’ i.e. explicitly trusted.”