CyberArk Privilege Cloud

Privileged Access Management (PAM) addresses the heightened risk created when users or systems hold elevated permissions that can materially affect infrastructure, applications, and sensitive business data. Privileged access is no longer limited to traditional IT administrators and business users; it increasingly includes developers, project teams, third-party contractors, and non-human identities such as applications and machines. Modern PAM suites have evolved beyond foundational capabilities like credential vaulting, password rotation, controlled privilege elevation/delegation, and session monitoring, toward advanced features such as dynamic secrets, replacing scripts, native access experiences, and embedding PAM into broader enterprise governance programs. Key drivers include shared credential abuse, privilege misuse (malicious or accidental), credential hijacking, third-party system exposure, and the need for attestations. Operational and compliance demands extend to discovering accounts, tracking ownership across lifecycles, enabling SSO/native sessions, recording privileged activity, and governing access by MSPs and cloud administrators.

CyberArk Privilege Cloud is CyberArk’s SaaS PAM offering, launched in 2018 and expanded with additional global data centers (Frankfurt, London, Sydney), SOC 2 Type 2 compliance, improved SLA, and hundreds of out-of-the-box integrations for credential and session management. It fits cloud and hybrid environments, integrates with vulnerability management tools (Qualys, Rapid7, Tenable) and identity/authentication providers (Duo, Okta, SecureAuth, RSA), and supports RPA platforms (Automation Anywhere, Blue Prism, UiPath) to address machine-driven privileged access. The service emphasizes rapid adoption via preconfigured best-practice policies and vendor-managed infrastructure. Its core is the CyberArk Digital Vault, using layered encryption with AWS KMS support, AES-256 and RSA-2048, and strong immutability controls even against administrators. Privilege Cloud provides MFA integration options, session brokering and recording, multi-AZ resilience, and a guided onboarding plan, while noting market resistance to PAMaaS, AWS-only backend concerns, and manual migration steps from on-premises deployments.

• Privileged users have traditionally been categorized as privileged IT users and privileged business users.
• Standard PAM capabilities include credential vaulting, password rotation, controlled elevation/delegation, and session establishment with activity monitoring.
• CyberArk Privilege Cloud was initially launched in 2018.
• Data center locations listed for the service include Northern Virginia, London, Frankfurt, and Sydney.
• The service is described as SOC 2 Type 2 compliant.
• The offering had 486 out-of-the-box integrations for credential and session management as of March 2020.
• A committed SLA of 99.5% is stated, with reporting indicating observed uptime above 99.9%.
• The Digital Vault uses AES-256 for symmetric encryption and RSA-2048 key pairs for asymmetric encryption.
• Vault data is encrypted at rest and in transit, including privileged session recordings.
• Privilege Cloud supports MFA integrations including SAML, LDAP, and RADIUS.

• “In recent years the picture has become more complicated with many more non-traditional users requiring and getting privileged access to IT and business data.”
• “PAM solutions have become more sophisticated making them robust security management tools in themselves.”
• “For a growing number of organizations PAM is no longer about regulating privileged access to human users only but increasingly for applications and machines.”
• “The solution is designed to enable organizations to get going quickly, and efficiently operate and scale a SaaS based PAM solution with most infrastructure functions taken care of by the vendor.”
• “Such levels would be hard for smaller organizations to maintain… so a SaaS solution provides availability of best in class facilities without the full investment costs.”
• “Encryption is key to successful identity and access management, and even more so for privileged accounts and credentials.”
• “All individual files in the vault are uniquely encrypted using a randomly generated encryption key.”
• “The information cannot be modified or deleted, even by a CyberArk administrator.”
• “By purchasing Privilege Cloud, all of the management and deployment of back-end infrastructure is taken care of by CyberArk, leaving customers to get on with their own business.”
• “To enable customers to derive the most value from their investment, CyberArk offers the Privilege Cloud Guided Success Plan…”