Privileged Access Management for DevOps

The report surveys the Privileged Access Management (PAM) market through the specific lens of DevOps and agile delivery, arguing that traditional PAM was built around relatively stable privileged IT administrators and privileged business users, but that digital transformation has multiplied privileged actors to include developers, contractors, temporary staff, services, and machine identities. As CI/CD accelerates, applications may be updated many times per day, and DevOps teams routinely need continuous privileged access to tools, runtimes, containers, APIs, and sensitive data. Without purpose-built controls, teams may resort to risky shortcuts such as locally storing or embedding credentials, sharing passwords, and allowing ad hoc privilege grants that lead to privilege creep.

PAM is presented as a fast-growing security segment, with roughly 40 major vendors and an estimated combined annual revenue of about $2.2bn, forecast to reach $5.4bn by 2025. Standard capabilities now commonly include vaulting, rotation, privilege elevation/delegation, session management and monitoring; increasingly, advanced functions such as privileged analytics, risk-based monitoring, and threat protection are expected. For DevOps, the report emphasizes embedding “transparent security” into the CI/CD lifecycle, adding a feedback mechanism, and supporting high-velocity, ephemeral access patterns, including certificate-based authentication and just-in-time access that minimizes standing privilege.

KuppingerCole defines required DevOps-oriented capabilities (toolchain/runtime/finished app support, certificates, HA/break-glass, non-human users, shared accounts, base PAM features) and additional functions like PADLM, CPEDM evolving toward Privileged Task Management, EPM, SRM, privileged SSO, and privileged behavior analytics. Vendor leadership is assessed across product, innovation, and market reach, noting tight clustering among established leaders and highlighting more specialized innovators and “underperformers” in market adoption relative to product maturity.

• The PAM market includes around 40 major vendors with combined annual revenue of about $2.2bn.
• Combined annual revenue in PAM is predicted to grow to about $5.4bn by 2025.
• Applications are updated many times a day in some modern organizations.
• Credential vaulting, password rotation, controlled elevation/delegation, session establishment, and activity monitoring are now almost standard PAM features.
• Advanced PAM capabilities described include privileged user analytics, risk-based session monitoring, and advanced threat protection.
• Overall Leaders listed are BeyondTrust, Centrify Corporation, CyberArk, SSH Communications Security (SSH.COM), and Thycotic Software.
• Market Leaders listed are BeyondTrust, Centrify Corporation, CyberArk, and Thycotic Software.
• HashiCorp Vault saw almost 16 million downloads in 2020.
• SSH.COM PrivX has been on the market since 2017.
• Symantec claims its PAM appliances can get basic PAM running in 2–3 days using auto-discovery of privileged accounts.

• “Transparent Security platforms including PAM must be embedded within the CI/CD lifecycle that DevOps teams work within.”
• “The challenge is finding a PAM solution that can work at the pressure and speed that DevOps already work to and keep all secrets secure.”
• “It must not get in the way - it must be secure and accountable through integrated tools or via third-party integrations.”
• “In a world seeking perfection, nothing is ever finished.”
• “Developers committed to their job, will often perform actions that make their operations quicker but introduce security risks.”
• “Just-in-time (JIT) privileged access management can help drastically condense the privileged threat surface and reduce risk enterprise-wide…”
• “Innovation is not about delivering a constant flow of new releases.”
• “Vendors above the line are said to be ‘overperforming’ in the market.”
• “The core product is deliberately lean…”
• “Accounts are not accessible by any other means as there are no credentials available.”