Privileged Access Management

This report surveys the Privileged Access Management (PAM) platform market and provides comparative guidance for buyers, including updated 2021 ratings and reviews of 26 products. PAM is positioned as a critical cybersecurity control because privileged account misuse underpins many successful attacks, often enabled by weak tools and processes; one cited industry report attributes 74% of privileged access anomaly detections to potentially malicious privileged access from an unknown host. After roughly two decades of PAM maturity, demand has accelerated due to digital transformation, cloud adoption, DevOps/CI-CD, and the pandemic-driven shift to remote work, pushing vendors to strengthen Endpoint Privilege Management (EPM) and Remote Privileged Access (RPA), expand automation, and significantly improve user experience to reduce administrative burden.

The market is also evolving structurally through mergers and acquisitions (notably Centrify and Thycotic), experimentation by Identity Providers (IDP) and Identity and Access Management (IAM) vendors entering PAM, and broader “identity security” positioning that blends IAM, PAM, risk, and task controls. Architectural themes include increased PAM-as-a-Service (PAMaaS), SMB-focused and cloud-native platforms, and growing interest in Zero Standing Privilege (ZSP) and Just-in-Time (JIT) access—tempered by operational realities that keep vaults and standing privileges relevant for many organizations. Core PAM capabilities remain password management (vaulting and control), session management (auditing/monitoring, sometimes SSO), and EPM; optional capabilities increasingly differentiate vendors (PADLM, AAPM, CPEDM, RPA, JIT, SSO integrations, PUBA, and account discovery).

KuppingerCole’s leadership views emphasize that buyers should combine standardized comparisons with deeper evaluation and proof-of-concept testing, balancing product richness, innovation trajectory, and market solidity across diverse deployment models (on-premises, appliance/virtual appliance, cloud, and PAMaaS).

• Ratings and reviews cover 26 PAM products, fully updated for 2021.
• Potentially malicious privileged access from an unknown host accounted for 74% of privileged access anomaly behavior detections in a cited 2020 industry report.
• New vendors included in the 2021 Overall Leadership view are Ekran and Heimdal.
• Centrify and Thycotic merged, and the combined company asked to have both product suites considered separately in this report.
• The “Big Four” PAM vendors are identified as CyberArk, BeyondTrust, Thycotic, and Centrify, with the merger expected to reshape this into a “Big Three.”
• No “Followers” appear in the 2021 Overall Leadership view, indicating market maturation in baseline capabilities.
• Classical PAM capabilities are defined as Password Management, Session Management, and Endpoint Privilege Management (EPM).
• Delivery models assessed include on-premises appliance/virtual appliance, cloud deployment, and vendor-delivered PAMaaS.
• Overall Product Leaders listed include Arcon, BeyondTrust, Centrify, CyberArk, Hitachi ID, One Identity, Senhasegura, SSH.COM, Broadcom (Symantec), Thycotic, WALLIX, and Xton.
• Market Leadership evaluation factors include customer numbers, transactions evaluated, customer-to-managed-identity/device ratios, deployment size, ecosystem distribution, and financial health.

• “Ease of Use is no longer a ‘nice to have’ but increasingly seen as essential to cope with the growing demands on PAM.”
• “Hackers are actively targeting privileged accounts as the best way to get inside an organization.”
• “For PAM futures, flexibility will be key in purchasing, delivery, deployment and usage.”
• “When two players join forces in the same market there is always some uncertainty for new and existing customers as mergers take time to bed down.”
• “The term Zero Standing Privilege (ZSP) is also gaining traction.”
• “Zero Trust is an extension of this approach, but it should be remembered that for PAM to work efficiently, a level of trust must still be priced into operations.”
• “There is not always a need for a specialized PAM for DevOps, but for a PAM solution that supports the hybrid reality of your business.”
• “Step back and rethink your PAM needs before making decisions.”
• “Innovation is not about delivering a constant flow of new releases.”
• “Size is no impediment to innovation or specialization.”