BeyondTrust sells a privileged access management suite: Password Safe for vaulted credentials, Privileged Remote Access (PRA) for brokered sessions, Entitle for just-in-time access, and a newer AI Agent Security product for agents on employee laptops. If you need a BeyondTrust alternative for engineers and AI agents reaching databases, SSH and Kubernetes, this page puts Formal next to it.

Formal publishes this page, and we’re one of the two products on it. Every BeyondTrust fact links to BeyondTrust’s own pages or docs, read on November 3, 2026, and both columns of the table use the same criteria. The checklist at the end works for any BeyondTrust competitors on your shortlist, Formal included. One scope note: this page covers privileged access to infrastructure, so BeyondTrust Remote Support, its help desk product, is out of scope.

What does BeyondTrust offer for privileged access?

BeyondTrust groups its products on the BeyondTrust Pathfinder Platform, which puts them under a single console (AI Agent Security page). For privileged access to infrastructure, four products matter:

  • Password Safe discovers and onboards privileged accounts, vaults and rotates passwords, secrets and SSH keys, and manages live sessions (product page).
  • Privileged Remote Access (PRA) gives employees and vendors access to IT, cloud and OT systems without a VPN, injects credentials and records every session (product page).
  • Entitle grants just-in-time access to cloud infrastructure and SaaS through requests in Slack, Teams or Jira (product page).
  • Identity Security Insights covers identity posture and identity threat detection and response (ITDR) (Modern PAM).

BeyondTrust also sells Endpoint Privilege Management, which enforces least privilege on Windows, macOS and Linux endpoints (AI Agent Security page), and BeyondTrust AI Agent Security, covered below.

Put simply, BeyondTrust PAM is organized around the privileged account and the session: find the account, vault its credential, broker the session, record it. Formal is organized around the request: a proxy that reads each query or command and decides what happens to it.

How is Formal different from BeyondTrust?

The two privileged access management products put the control point in different places, and that decides what each one can enforce. Here’s where they differ for engineers’ access to databases, servers and clusters.

Where the control point sits

PRA reaches systems through a Gateway in your network. Its asset types include RDP and VNC desktops, SSH shells, websites, and protocol tunnels for PostgreSQL, MySQL, SQL Server, Oracle, MongoDB and Kubernetes clusters on AKS or EKS (PRA docs: Use Assets). For a database tunnel, an admin sets the host, the username and database, and an optional session policy per asset.

Formal PAM runs on the Connector, which you deploy as a container inside your VPC. It parses each protocol, identifies the person or agent behind the connection and evaluates policies against the traffic itself. Formal hosts the Control Plane, but only the Connector and Endpoint touch your data (architecture docs). Engineers keep psql, ssh and kubectl, plus VS Code or Cursor Remote SSH, SCP/SFTP and rsync (SSH docs).

Because the Connector sees each protocol, session recording comes with it: SSH sessions and kubectl exec or attach sessions are recorded, each scored with a risk level from 1 to 5, and every query and command lands in the log (sessions docs). Setup lives on our SSH and Kubernetes pages.

Policies on each query and response

Each policy is Rego code, the same language Open Policy Agent uses, evaluated at three points: when a session opens, before a request reaches the resource, and after the response comes back. A request policy can block or rewrite a query; a response policy can filter rows, mask columns or block the result (enforcement docs). This example from the docs stops DELETE statements on production resources:

package formal.v2

import future.keywords.if

# Block all DELETE statements in production
request := {
  "action": "block",
  "type": "block_with_custom_message",
  "message": "DELETE operations are not allowed in production",
  "reason": "Production data protection policy"
} if {
  input.resource.environment == "production"
  input.sql_query.statement_type == "DELETE"
}

A rewrite policy can instead cap unbounded SELECT queries at 1,000 rows. BeyondTrust’s PRA docs describe how a tunnel connects and which credentials it uses, but we found no way to block, rewrite or mask a single query inside one, so the table marks that “not documented”. Our data masking page covers the response side in depth.

BeyondTrust’s Modern PAM page lists “Proxy-Based Deployment” under classic PAM and “API-Based Deployment” under modern PAM (Modern PAM). Entitle works the API way: it automates provisioning of time-bound permissions, including temporary accounts and SSH keys on systems without federation (Entitle). In our view, that’s a different control, not a newer one. An API grant decides what a session may touch, then steps out of the path. Only a proxy in the path can read each statement and act on it: block the DELETE, cap the SELECT, mask the column in the result. That matters most for AI agents, whose next query nobody knows when access is granted.

Credentials: a vault or the proxy

Password Safe is a vault. It finds privileged accounts and stores and rotates their passwords, secrets and SSH keys, including the ones AI agents, bots and scripts use (Password Safe). PRA injects credentials into sessions from its own in-appliance vault or from Password Safe (PRA).

Formal has no vault to run. A Native User tells the Connector how to sign in upstream: a password, an SSH private key with an optional certificate, cloud IAM credentials or a kubeconfig. The person or agent on the other end of the connection never holds that secret. Rotation stays in the tool you already use: update the Native User’s secret, or have the Connector fetch it at connection time with a hook from your secrets manager or vault.

How do AI agents get access through Formal?

Agents need two kinds of control: what they can reach in production, and what they do from the laptop or sandbox where they run. Formal covers both, with the same policy engine.

Agents reaching databases, SSH and Kubernetes

An agent gets its own identity at the Connector, tied to the person it works for. Workloads on AWS, Azure or GCP, GitHub Actions jobs and SPIFFE identities sign in with their own OIDC tokens, which the Formal Endpoint swaps for short-lived Formal credentials (OIDC docs). In our Devin guide, Devin’s machine user is blocked by default. Each session needs a Slack approval from the human who launched it, and the log records that human as the end user.

Remote MCP servers sit behind the Connector’s MCP gateway, which authenticates MCP clients with Formal, injects the server’s credential and records each tool call. At Cursor, this kind of control is what let the security team connect agents to internal data:

“Without Formal, we couldn’t have agents with access to sensitive data. With Formal, because we are able to inspect all traffic and enforce controls, we are able to provide a safe environment for the agents to get the job done.”

— Travis McPeak, Head of Security @ Cursor

On the BeyondTrust side, Password Safe handles agents as credential holders: it vaults the secrets agents use, and its access rules can weigh day, time and location when a user, machine or AI agent requests access (Password Safe).

Agents on laptops: an endpoint agent or an egress proxy

BeyondTrust AI Agent Security installs the Pathfinder agent on Windows and macOS endpoints. Its docs say it finds the agents on each endpoint along with their MCP servers and skills, tells agent processes apart from the person running them, and enforces policy at the kernel and network level before an action completes. It doesn’t inspect or block the prompt. To add it to a tenant, the docs say to contact your BeyondTrust account team (AI Agent Security docs).

Formal handles the same problem with an egress proxy, as described in AI agent security at the egress. Network rules recognize Claude Code, Cursor, Codex, GitHub Copilot CLI, Devin, Windsurf, Amp and other agents, along with every process they start. On macOS that identity comes from the code signature; on Linux, from the process name of the installed binary (network rules docs). For LLM traffic it intercepts, Formal logs requests, responses, tool calls and token usage (LLM docs).

The two designs see different things. A kernel-level agent sees processes and file access on the machine; an egress proxy sees every request that leaves it. The same Formal Endpoint also runs as a Kubernetes or Amazon ECS sidecar, for cloud agents that never touch a laptop.

How does Formal handle just-in-time access and zero standing privileges?

Formal models temporary access as a pause in a blocking policy that covers a single person during a fixed window. A Workflow starts from a Slack form or an API call, asks an approver in Slack, then suspends the policy for that one person until a set expiry (Workflows docs). Once the suspension ends, the default policy is back in force. Nobody has to remember to remove a role.

Entitle, BeyondTrust’s product for this, takes requests in Slack, Teams or Jira and revokes access after a set duration, a ticket resolution or an on-call rotation (Entitle). For the concept itself, see the just-in-time access explainer.

Where does BeyondTrust fit well?

BeyondTrust covers ground that Formal doesn’t. It’s a reasonable choice when:

  • Vendors need access. PRA’s vendor privileged access management (VPAM) onboards vendor users, lets you delegate their management and removes shared accounts (PRA).
  • You run OT systems. PRA lists operational technology next to IT and cloud environments (PRA).
  • You need VNC or shared desktop sessions. PRA proxies RDP and VNC sessions through a Gateway, with session sharing and session recording (PRA docs). Formal proxies RDP through the Connector (RDP docs), not VNC.
  • You need a vault with rotation. Password Safe discovers accounts and rotates passwords, secrets and SSH keys (Password Safe).
  • Endpoint least privilege is on the list. Endpoint Privilege Management covers Windows, macOS and Linux endpoints (AI Agent Security page).

For those needs, Formal runs next to BeyondTrust rather than replacing it.

Which teams run Formal for privileged access?

At Cursor, Formal Connector replaced homegrown access proxies. Cloud Agents connect through a dedicated Formal identity with limited access, and end-user identity propagation adds the employee who started the task, so policies check both. Before Formal, Cursor didn’t connect its Cloud Agents to internal systems at all. More in the Cursor case study.

Notion governs developer database access across 100+ RDS instances with Formal, using short-lived credentials and fine-grained, group-based rules, and rolled it out in under a week. The Notion case study covers how.

How is BeyondTrust priced?

BeyondTrust pricing isn’t published. As of November 2026, the Password Safe pricing page and the PRA pricing page both ask you to contact sales for a custom quote. PRA offers a free trial (PRA), and Password Safe and PRA are sold together under one SKU if you need both.

We don’t quote numbers here. If you want a Formal quote for your own resources, get a demo.

Which BeyondTrust competitors cover databases, SSH and Kubernetes?

If you’re comparing BeyondTrust competitors and other PAM tools for engineers’ infrastructure access, three more names usually come up:

  • CyberArk. If you’re weighing CyberArk vs BeyondTrust, the criteria in the table above apply the same way, and our CyberArk alternative page puts Formal beside CyberArk.
  • Delinea, which completed its acquisition of StrongDM on March 5, 2026 (Delinea press release). For a BeyondTrust vs Delinea view on infrastructure access, our StrongDM alternative page covers StrongDM, now part of Delinea.
  • Teleport. Our Teleport alternative page applies these criteria, with sources from Teleport’s docs and pricing pages.

How should you evaluate BeyondTrust competitors, Formal included?

Run the same checks on every one of the BeyondTrust alternatives you shortlist. Here’s the list we’d work through:

  • Assets. Export your PRA assets and Password Safe managed systems, then check each type against Formal’s supported resources.
  • Credentials. Decide which vaulted accounts become Native Users and which stay in a vault, fetched at connection time.
  • Policies. Map PRA asset and session policies to Rego, then pick the queries that need a block, rewrite or mask rule.
  • Approvals. Rebuild each Entitle request flow as a Workflow: trigger, approver, duration.
  • Vendors, OT and desktops. List vendor access, OT systems and VNC desktops: that’s where BeyondTrust fits well. RDP hosts can move to the Connector.
  • Agents. Inventory which agents and MCP servers touch production, and name the human accountable for each.
  • Deployment. PRA runs as PRA Cloud or on an on-premises B Series Appliance (PRA docs). The Formal Connector runs on ECS Fargate or on Kubernetes with Helm, in your infrastructure (deployment docs).
  • Audit. Check where logs land: Formal forwards them to a SIEM, a data lake or an observability tool.

Pilot on one resource with one team before rolling out further. If the category is new to you, our privileged access management guide explains the basics.