The best PAM solution depends on what you protect. If most of your privileged accounts are Windows admins, service accounts and shared passwords, a vault-first suite such as CyberArk (now Idira), BeyondTrust or Delinea’s Secret Server was built for that work. If engineers and AI agents mostly reach databases, SSH hosts and Kubernetes, proxy-based products (Teleport, Delinea’s StrongDM, Formal) act on the session, or on each query, instead. This list of PAM tools puts ten products on the same criteria, with a comparison table, one entry per vendor and a dated source behind every cell.
Formal publishes this list and is one of the ten products on it. Every other vendor fact links to that vendor’s own site or docs, read in November 2026.
Best PAM solutions by use case
Each label names the job that vendor’s own pages describe best. Formal, the publisher, comes first; the rest are alphabetical.
- Formal: engineers and AI agents on databases, SSH and Kubernetes, with policy on each query and no credentials handed to users. See how Formal PAM works
- BeyondTrust: remote and vendor access to IT, cloud and OT systems, next to a password and secrets vault.
- CyberArk (Idira): PAM bought together with secrets management, endpoint privilege, governance and agent identity from the same vendor.
- Delinea: the Secret Server vault plus StrongDM’s proxy access to databases, servers and Kubernetes.
- HashiCorp Boundary: teams already running HashiCorp Vault that want identity-based session brokering.
- KeeperPAM: a password manager and PAM in one SaaS product.
- ManageEngine PAM360: on-premises deployments that want published prices and a free edition.
- Netwrix Privilege Secure: self-hosted, Windows-heavy estates working toward zero standing privilege.
- Okta Privileged Access: organizations that already run Okta for identity.
- Teleport: certificate-based access to SSH, RDP, Kubernetes and databases, with a Community Edition.
How we chose these PAM tools
We took the checklist our one-to-one comparison pages already use and ran every product through it, Formal included: what the tool reaches (servers, databases, Kubernetes, cloud, web), how it’s deployed, how it handles credentials (a vault with rotation, short-lived certificates, or credentials users never see), session recording and audit, just-in-time access and approvals, controls inside a session, support for AI agents and other non-human identities, and whether prices are public.
Every fact comes from the vendor’s own site or docs and is listed under Sources with the date we read it. We didn’t test the other nine products hands-on, and nobody paid to be listed. Formal, as the publisher, comes first in the quick picks and the comparison tables; the other nine follow in alphabetical order, and the vendor-by-vendor section is alphabetical throughout. If you work at one of these privileged access management vendors and spot an error, email hi@formal.ai and we’ll correct it and update the date.
For practitioner ratings, Gartner Peer Insights collects user reviews of privileged access management tools; we didn’t use review scores or analyst placements here. If the category is new to you, start with what privileged access management is and zero standing privileges.
PAM tools compared
The first table covers what each tool reaches and controls; the second, how it runs, how it holds credentials and whether prices are public. A cell says “not documented” when the vendor pages we read don’t describe the capability, which isn’t the same as the product lacking it. The small numbers point to the Sources list at the bottom of the page. On a narrow screen, scroll the tables sideways.
| Vendor | Servers | Databases | Kubernetes | Session recording | JIT and approvals | AI agents and NHI |
|---|---|---|---|---|---|---|
 Formal | SSH (and AWS SSM), RDP 3 | PostgreSQL, MySQL, MongoDB, Snowflake, BigQuery, ClickHouse, DynamoDB and more 3 | kubectl through the Formal Endpoint 11 | SSH and kubectl exec recorded; RDP logged, recording not documented 6 | Slack-approved Workflow suspends a policy until it expires 7 8 | Agent OIDC tokens tied to the human; MCP gateway 9 10 |
 BeyondTrust | RDP, VNC, SSH through PRA 13 | PostgreSQL, MySQL, SQL Server, Oracle, MongoDB through PRA tunnels 14 | AKS and EKS through PRA tunnels 14 | PRA sessions recorded and logged 13 | Entitle, from Slack, Teams or Jira 15 | AI Agent Security on Windows and macOS endpoints 16 |
 CyberArk (Idira) | Windows (RDP) and Linux (SSH) 21 | Ephemeral users on 7 engines, PostgreSQL and Oracle among them 21 | Self-hosted, OpenShift and GKE with vaulted accounts; EKS and AKS through the idsec CLI 23 | SSH commands, SQL queries and kubectl commands audited 20 | Zero standing privileges with ephemeral users 21 | Agent Identity Security in Prisma AIRS 22 |
 Delinea | Secret Server session brokering 24; StrongDM servers 26 | StrongDM: Postgres, MySQL, BigQuery, ClickHouse and more 26 | Through StrongDM 26 | Video and SSH keystrokes in Secret Server 24 | Approval and checkout in Secret Server 24; StrongDM Access Workflows 26 | StrongDM MCP Gateway 27 and MCP Broker 28 |
 HashiCorp Boundary | SSH, RDP 31 | Any TCP target, with client helpers for PostgreSQL, MySQL, MongoDB, Redis and Cassandra 36 | kubectl through boundary connect kube 36 | Not in Community Edition 33 | JIT credentials from HashiCorp Vault; approvals not documented 31 | MCP server in public preview 34 |
 KeeperPAM | SSH, RDP, VNC 37 | MySQL, PostgreSQL, SQL Server 37 | Connect to containers in any cluster 37 | SSH, RDP, VNC, database and browser sessions 37 | Time-limited access, optional approvals 37 | JIT secrets and recorded agent sessions 38 |
 ManageEngine PAM360 | RDP, SSH, VNC 40 | MySQL, SQL Server, PostgreSQL, Oracle, Sybase 40 | Not documented as an access target 40 | Video and keystroke logging 40 | JIT elevation with approvals 40 | MCP as a sample scenario, not built in 42 |
 Netwrix Privilege Secure | Windows and Linux servers 43 | SQL Server, Oracle 45 | Not documented 43 | Video playback 43 | JIT with approvals 43 | Not documented 43 |
 Okta Privileged Access | SSH, RDP 47 | MariaDB, SQL Server, MongoDB, MySQL, Oracle, PostgreSQL 49 | Beta 50 | SSH and RDP sessions 47 | JIT with multi-level approvals 48 | Agents connect to secrets, service accounts and MCP servers 51 |
 Teleport | SSH, RDP 54 | PostgreSQL, MySQL, MongoDB, SQL Server, Oracle, Redis, Cassandra, ClickHouse, Snowflake, DynamoDB and more 56 | Any cluster, with EKS, AKS and GKE auto-discovery 57 | Record, replay, join and moderate 54 | Access Requests 54 | MCP server access, agent identity 54 |
| Vendor | Deployment | Vault and rotation | Public pricing |
|---|---|---|---|
| Formal | Hosted control plane, Connector in your cloud (ECS Fargate or Helm) 2 | No built-in vault; credentials stay on the Connector or come from your secrets manager; automatic rotation not documented 4 | Not published, scoped to your resources Get a quote |
| BeyondTrust | Cloud or appliance 12 | Password Safe, with rotation 12 | Not published 17 |
| CyberArk (Idira) | SaaS or self-hosted; SIA connector with no inbound access 21 | Vaulting and rotation 20 | Not published 20 |
| Delinea | Secret Server on premises or in Delinea’s cloud 24; StrongDM SaaS with self-hosted gateways 26 | Secret Server, with rotation 24 | Packages listed, no prices 29 |
| HashiCorp Boundary | HCP Boundary or self-managed Boundary Enterprise 31 | Brokers or injects credentials from HashiCorp Vault 31 | Pay-as-you-go per user 35 |
| KeeperPAM | SaaS plus an outbound-only gateway; self-hosted Connection Manager for air-gapped sites 37 | Vault, secrets manager and rotation 37 | Quote 39 |
| ManageEngine PAM360 | On premises; cloud in beta 40 | Password and SSH key rotation, AES-256 40 | Published, plus a free edition 41 |
| Netwrix Privilege Secure | Self-hosted on Windows servers 44 | Built-in vault with per-session rotation, or bring your own 43 | Not published; 30-day trial 46 |
| Okta Privileged Access | SaaS, with a workstation client and a server agent 48 | Scheduled rotation 47 | Partial: Essentials suite price listed 52 |
| Teleport | Self-hosted or Teleport-managed cloud 54 | Short-lived certificates instead of a vault 53 | Usage-based quote 55 |
Masking query results is left out of the tables: we haven’t checked every vendor’s docs for it. The one-to-one comparisons cover it for CyberArk, BeyondTrust, StrongDM and Teleport.
Ten PAM vendors, one by one
Alphabetical. Each entry sums up what the vendor’s own pages describe and what to check before you put it on a shortlist.
BeyondTrust
BeyondTrust splits privileged access across several products on its Pathfinder Platform. Password Safe sets out to “unify management of privileged passwords, secrets, SSH keys, & sessions” and runs in BeyondTrust’s cloud or on an appliance (Password Safe). Privileged Remote Access (PRA) brokers and records RDP, VNC and SSH sessions, and reaches PostgreSQL, MySQL, SQL Server, Oracle, MongoDB and Kubernetes on AKS or EKS through protocol tunnels (PRA docs). Entitle handles just-in-time requests from Slack, Teams or Jira. AI Agent Security, generally available since October 21, 2026, governs agents on Windows and macOS endpoints (press release).
Check which of these you’d license, because each covers one part of the job. Prices come from sales. Our BeyondTrust alternative page goes through it row by row.
CyberArk (Idira)
Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026 (press release), and the products now carry the Idira name. Idira Privileged Access Management covers credential vaulting and rotation, isolated and recorded sessions, and zero standing privileges. Its Secure Infrastructure Access (SIA) service pairs a hosted service with a lightweight connector in your network that needs no inbound connectivity, and creates ephemeral users on SQL Server, Db2, MariaDB, MongoDB, MySQL, Oracle and PostgreSQL (Learn about SIA). Agent Identity Security in Prisma AIRS has been generally available since October 25, 2026 (What’s new).
Idira also spans endpoint privilege, identity governance and secrets (Idira), so the quote depends on the modules you take; no prices are published. Our CyberArk alternative page has the detail.
Delinea (Secret Server and StrongDM)
Delinea has sold two models since it completed its acquisition of StrongDM on March 5, 2026 (press release). Secret Server vaults privileged credentials, rotates them and brokers privileged sessions with video and SSH keystroke recording, on premises (IIS and SQL Server) or in Delinea’s cloud (architecture). StrongDM, which calls itself “a Zero Trust Privileged Access Management (PAM) platform”, proxies access to databases, servers, Kubernetes clusters, clouds and web applications through gateways and relays you host (What is StrongDM).
Agents get two pieces, both sold as part of StrongDM’s Secure AI offering: an MCP Gateway resource that sits in front of HTTP MCP servers and audits and enforces policy on their traffic, and an MCP Broker built into the StrongDM client, through which Claude Desktop, Claude Code or Codex reach whatever the signed-in user is already entitled to. Delinea lists packages but no prices. Our StrongDM alternative page compares the proxy side with Formal.
Formal
Formal is the product we build, so weigh this entry with that in mind. The Connector is a reverse proxy that runs as a container in your own infrastructure, on ECS Fargate or through Helm on any Kubernetes cluster, and the Control Plane we host can’t interact with your data (architecture). Engineers and agents keep psql, ssh and kubectl. The Connector signs in upstream as a Native User, so nobody holds the database password or the kubeconfig (Native Users). Resources include Postgres, Snowflake, SSH and Kubernetes.
The part to look at is where policy runs. Rego policies act when a session opens, on each request and on each response, so one policy can block a DELETE in production and another can mask a column before results reach the client (enforcement docs). Approvals are Workflows in Slack that suspend a blocking policy for one person until it expires.
The gaps matter if you’re buying a vault. Formal has no built-in vault and doesn’t document automatic rotation; it has no endpoint privilege management; VNC isn’t among its resources; RDP recording isn’t documented; and Kubernetes access goes through the Formal Endpoint. Prices aren’t published. Formal PAM has the rest.
HashiCorp Boundary
HashiCorp, an IBM company (IBM pricing page), describes Boundary as “an identity-based access management tool” for reaching servers, databases and applications (What is Boundary). Workers proxy SSH, RDP, TCP, HTTPS and Kubernetes sessions with no agent on the target, and it runs as HCP Boundary or self-managed Boundary Enterprise. Just-in-time credentials come from HashiCorp Vault, a separate product. We didn’t find approval workflows in its docs.
Community Edition installs from HashiCorp’s site, but session recording, credential injection and multi-hop deployments are enterprise features (install page). A Boundary MCP server is in public preview. IBM publishes pay-as-you-go prices per authorized user.
KeeperPAM
Keeper Security calls KeeperPAM “the modern AI-enabled PAM platform for securing and managing access to critical infrastructure and endpoints” (KeeperPAM). It runs on Keeper’s cloud-native, zero-knowledge platform, with a vault, a secrets manager and rotation, plus a gateway you install that only connects outbound; Keeper Connection Manager is the self-hosted option for air-gapped sites. It reaches SSH, RDP, VNC, MySQL, PostgreSQL, SQL Server and Kubernetes, records SSH, RDP, VNC, database and browser sessions, and covers web apps through remote browser isolation. Access can be time-limited, with ephemeral accounts and optional approvals.
Keeper’s agent page describes just-in-time secrets and recorded agent sessions (Secure AI Agents). Pricing is by quote.
ManageEngine PAM360
ManageEngine positions PAM360 as one platform for human, non-human and AI identities (PAM360). The server installs in your environment, with a cloud version in beta, and an application gateway gives remote access without agents on the targets. The AES-256 vault rotates passwords and SSH keys; RDP, SSH, VNC and SQL sessions are recorded as video with keystrokes; just-in-time elevation comes with approvals. Supported databases include MySQL, SQL Server, PostgreSQL, Oracle and Sybase. Kubernetes appears only as a CI/CD secrets integration.
PAM360 publishes subscription and perpetual license prices, and a Free Edition covers one administrator and up to 10 resources (pricing). MCP shows up as a sample scenario rather than a built-in feature.
Netwrix Privilege Secure
Netwrix leads with zero standing privilege: “Stop attackers with Zero Standing Privilege. Provide just-in-time access, monitor privileged activity, and remove leftover credentials” (Privilege Secure). It’s self-hosted on Windows servers, with a session proxy on Windows, Linux or Docker (getting started); we didn’t find a SaaS edition. Targets include Windows and Linux servers, network appliances, websites and Entra ID, and for databases, SQL Server and Oracle. The built-in vault rotates credentials per session, or you can bring your own vault, and sessions are recorded for video playback.
Its product pages don’t document AI agent support. Pricing is on request, with a 30-day, 10-user trial.
Okta Privileged Access
Okta describes Privileged Access as “unified access and governance for privileged resources, whether on-prem or cloud” and as “the evolution of ASA”, its earlier Advanced Server Access (Okta Privileged Access). It runs inside Okta’s cloud, with a client on workstations, a server agent on targets and an optional gateway. It covers SSH and RDP to Linux and Windows servers, six database engines (supported databases), Kubernetes in Beta and SaaS service accounts, with vaulting, scheduled rotation, session recording and just-in-time access through Okta Access Requests.
Okta for AI Agents can connect an agent to Privileged Access secrets, service accounts and MCP servers (docs). Okta lists a per-user price for its Essentials suite, which includes Privileged Access; higher tiers are by inquiry.
Teleport
Teleport’s homepage headline is “Unified Identity Securing Classic & AI Infrastructure” (Teleport). Instead of vaulting passwords it issues short-lived certificates, and it protects SSH and Windows servers, Kubernetes clusters, databases, cloud consoles, web apps, TCP endpoints and MCP servers (feature matrix). Sessions can be recorded, replayed, joined and moderated, Access Requests handle just-in-time elevation, and it runs self-hosted or as a Teleport-managed cloud.
MCP server enrollment and per-tool audit events are in every edition, Community Edition included. Pricing is usage-based, on monthly active users and protected resources, and quoted on request (pricing). Our Teleport alternative page compares it with Formal.
Are there free or open source PAM tools?
Free PAM tools exist, with conditions. Teleport is the closest thing to open source PAM on this list: the source is AGPL-3.0 on GitHub, while the Community Edition binaries carry a commercial license that’s free only below 100 employees and US$10M of annual revenue (feature matrix). Our Teleport alternative page covers those terms.
HashiCorp offers Boundary Community Edition on its install page, without session recording, credential injection or multi-hop deployments. ManageEngine’s PAM360 Free Edition covers one administrator and up to 10 resources, with no time limit. For KeeperPAM, Okta Privileged Access, Netwrix Privilege Secure and Formal we found no free edition or public source code; they’re sold through trials, demos or quotes.
Which PAM vendors cover AI agents and non-human identities?
Eight of the ten products, Formal included, document some form of AI agent support, and they put the control in different places. BeyondTrust’s AI Agent Security runs on Windows and macOS endpoints and tells human actions from agent actions. CyberArk’s version, Agent Identity Security in Prisma AIRS, issues a unique identity per agent, backed by short-lived OAuth 2.1 tokens. StrongDM, Teleport and Boundary proxy MCP servers, Boundary’s still in preview. Keeper describes just-in-time secrets for agents, and Okta for AI Agents connects them to secrets, service accounts and MCP servers. ManageEngine documents MCP only through a sample scenario, and Netwrix’s product pages don’t mention agents.
Privileged access management for AI agents comes down to two questions: whose identity the agent acts under, and whether anything checks what it sends. Our view, for agents that query production data, is that the second matters more. A valid agent identity with a broad grant still gets every row back, so we check each statement.
In Formal, an agent presents an OIDC token from AWS, Azure, GCP, GitHub Actions or SPIFFE and gets a short-lived Formal credential (OIDC docs). The Devin guide shows the flow end to end: nothing goes through until the engineer who launched Devin approves a single session in Slack, and the Connector records that engineer as the end user. For MCP, the MCP gateway holds the upstream credential and logs every tool call an agent makes. That’s how Cursor runs its cloud agents: each gets a narrowly scoped Formal identity, and the log adds the employee who started the task (Cursor case study).
“Without Formal, we couldn’t have agents with access to sensitive data. With Formal, because we are able to inspect all traffic and enforce controls, we are able to provide a safe environment for the agents to get the job done.”
— Travis McPeak, Head of Security @ Cursor
How to choose a PAM solution
Start from your resources and identities, then shortlist. These are the questions we’d put to every vendor, Formal included:
- What does it reach? List every protocol you use today (Postgres, Snowflake, SSH, RDP, Kubernetes, cloud consoles) and look each one up in the vendor’s docs.
- Who holds the credential? A vault with rotation, short-lived certificates, or a proxy that signs in for the user. Stolen credentials are a standard attacker technique (MITRE ATT&CK T1078), and each model changes what a stolen laptop gives away.
- Can policy act inside a session? A recording tells you what happened. Blocking a statement or masking a column changes what happens, which is least privilege applied to each query. Ask for the docs page.
- How does access end? Just-in-time access should expire on its own, without a ticket to revoke it.
- Are agents first-class identities? Each agent should show up in the log next to the person it acts for.
- What does the audit trail hold? Per session or per query, and where it lands: your SIEM, S3 or Datadog. Database activity monitoring covers what to log.
- Where does it run? SaaS, your VPC or your data center, and what the vendor’s cloud can see.
Then pilot one team on one resource and read a week of logs before you widen it.
