CyberArk alternative: Formal for engineers and AI agents

On February 11, 2026, Palo Alto Networks closed its purchase of CyberArk, and today www.cyberark.com sends visitors to the Idira pages on paloaltonetworks.com. CyberArk built its name on credential vaulting, isolated sessions and zero standing privileges. Teams mid-contract or mid-evaluation are now asking what the change means and what else is out there. We build Formal and publish this page, so read it as a vendor’s view; every CyberArk detail below comes from Palo Alto Networks or Idira pages we read on November 3, 2026.

CyberArk, now Idira, is a wide suite: on top of infrastructure access it reaches into workforce endpoint privilege, identity governance and secrets. Formal goes deeper on infrastructure and data access (databases, SSH, Kubernetes, RDP and APIs), with policy on every query and response, plus egress control for AI agents on laptops and in sandboxes. The rest of this page walks through the acquisition, the design differences, how agents get access, and a checklist you can run against any CyberArk alternative on your list.

What changed when Palo Alto Networks acquired CyberArk?

The acquisition completed on February 11, 2026. CyberArk shareholders received $45.00 in cash plus 2.2005 Palo Alto Networks shares for each CyberArk share. Palo Alto Networks says the Identity Security solutions “will continue to be available as a standalone platform” and that “Existing customers will experience no disruption”.

The product line now carries the Idira name. Palo Alto Networks lists Idira Privileged Access Management, and docs.cyberark.com is titled Idira Docs, naming products such as Idira Secure Infrastructure Access and Idira Privilege Cloud. As of November 2026, www.cyberark.com redirects to the Idira pages on paloaltonetworks.com. For a team heading into a renewal, that means a new name, a new owner and a quote that now comes from Palo Alto Networks: a natural point to compare.

How is Formal different from CyberArk?

Both sit in the path between people and infrastructure, but they broker access in different ways. CyberArk’s Secure Infrastructure Access stands up a connector that forwards each session to the target and grants it with either a throwaway user or a vaulted credential drawn from a Safe. The proxy behind Formal PAM, the Connector, runs as a container in your own network, and engineers and agents reach it with ordinary psql, ssh and kubectl sessions under their own identity.

What separates the two is how much the proxy can do to the traffic in flight. Formal writes its policy in Rego, the language behind Open Policy Agent, and runs it at three points in a session. As a session opens, a policy can permit it, stop it, demand MFA, quarantine or suspend it, or impersonate a Kubernetes user. On the way in, it can permit, stop, rewrite (say, append a row LIMIT) or decrypt the request. On the way back, it can permit, stop, drop rows, mask columns, encrypt or rewrite the response.

A short policy makes it concrete. This one, from our enforcement docs, stops any DELETE against a production database and returns a message the engineer or agent reads:

package formal.v2

import future.keywords.if

# Block all DELETE statements in production
request := {
  "action": "block",
  "type": "block_with_custom_message",
  "message": "DELETE operations are not allowed in production",
  "reason": "Production data protection policy"
} if {
  input.resource.environment == "production"
  input.sql_query.statement_type == "DELETE"
}

The same engine masks a column as results stream back, or caps an unbounded SELECT. CyberArk’s SIA documents isolating, monitoring and auditing SSH commands, SQL queries and kubectl commands, but none of the Idira pages we read describe masking query results, so the table marks that “not documented”. Secrets never leave the proxy either: through Native Users, the Connector logs in to a target with a password, SSH key, cloud IAM role or kubeconfig, and the people and agents behind it never see it.

How do zero standing privileges work in CyberArk and Formal?

Zero standing privileges means no one carries production access until a task calls for it. CyberArk’s SIA takes that literally: it creates an ephemeral user when a session begins and removes it at the end, issuing a short-lived SSH certificate on Linux targets instead. For databases it provisions ephemeral users on SQL Server, Db2, MariaDB, MongoDB, MySQL, Oracle and PostgreSQL, and uses RDS IAM ephemeral credentials on MariaDB, MySQL and PostgreSQL.

Formal reaches the same end from the other direction: it keeps a blocking policy in force and lifts it briefly for one person. A Workflow turns a Slack form or API call into an approval and a policy suspension with a built-in expiry, so the block snaps back the moment the window closes. The just-in-time access explainer has the background.

How do AI agents get access in CyberArk and Formal?

Idira’s release notes mark Agent Identity Security as generally available in Prisma AIRS on October 25, 2026: each agent gets a distinct identity and short-lived OAuth 2.1 tokens, the Prisma AIRS AI Gateway checks access, and logs name both the agent and the person. That covers who the agent is and what it can reach. None of the Idira pages we read describe masking or rewriting what an agent’s queries return.

That’s where Formal differs: an agent’s SQL can be stopped, capped with a LIMIT, or returned with masked columns, under the same policies as an engineer’s. Formal handles an agent as one more identity on the Connector, with policy on every request and a log line per query. Our Devin guide shows Devin signing in with a short-lived OIDC token that Formal ties to both a machine user and the engineer who kicked off the run; it stays denied until that engineer approves a single-session window in Slack. For MCP, the MCP gateway fronts remote MCP servers at a Formal address, attaches the upstream credential, applies policy and records each tool call.

Which teams run Formal for privileged access?

Cursor swapped its in-house access proxies for the Formal Connector, which checks policy on every request and attributes each agent action to the engineer behind it. The Cursor case study lays out the setup and the scale it runs at.

Notion runs Formal to govern database access across its RDS estate, trading broad, long-lived grants for narrow group rules and wiring Okta in for just-in-time approvals.

“We did a vendor bakeoff between a number of products and Formal came out on top.”

— Daniel Pyykonen, Head of Security Engineering @ Notion

The Notion case study describes how the rollout went.

What does CyberArk pricing look like?

As of November 2026, www.cyberark.com and its pricing path both redirect to the Idira pages on paloaltonetworks.com, and the Idira pages we read list no prices, only a “Request a Demo” path. We don’t put numbers here: ask Palo Alto Networks for a quote that covers the Idira capabilities you use. To size Formal against the resources you run, get a demo.

Which CyberArk competitors cover databases, SSH and Kubernetes?

Most CyberArk competitors fall into two camps: vaulting-first PAM suites such as Delinea and BeyondTrust, and proxy-based access products such as Teleport and Formal. Settle your criteria before you shortlist vendors: where the control point sits, whether native clients stay, whether policy reaches inside a session, how approvals run, and how agents are identified.

CyberArk vs Delinea

Delinea is a PAM vendor often weighed against CyberArk. It completed its acquisition of StrongDM on March 5, 2026, which folded StrongDM’s proxy-based infrastructure access into the Delinea Platform. If StrongDM is on your list under the Delinea name, our StrongDM alternative page puts Formal beside it on the same criteria.

CyberArk vs BeyondTrust

BeyondTrust is another PAM vendor teams line up against CyberArk. Our BeyondTrust alternative page sets Formal beside BeyondTrust on the same criteria, with every BeyondTrust fact cited to its own pages.

CyberArk vs Teleport

Teleport is a proxy-based access product that also spans SSH, Kubernetes and databases. Our Teleport alternative page lines Formal up against Teleport, with every Teleport fact cited to its own documentation and pricing.

How should you evaluate a CyberArk replacement?

Put every candidate through the same checks. Here’s the set we’d use:

• Resources. Write down every protocol you reach today and line it up against Formal’s supported resources: Postgres, MySQL, MariaDB, MongoDB, Snowflake, BigQuery, ClickHouse, DynamoDB, Redis, S3, HTTP and gRPC APIs, SSH, RDP and Kubernetes, among others.
• Credential model. CyberArk mints ephemeral users or hands out vaulted credentials from Safes; Formal keeps a Native User secret on the Connector. Formal doesn’t document automatic rotation of upstream passwords, so expect to rotate them yourself or fetch them at connection time from your secrets manager.
• Controls inside the session. Decide whether you need to act on a single query or response, not just open the connection.
• Approvals. Rebuild each access request as a Formal Workflow with a requester, an approver and a duration.
• Agents. Inventory the agents and MCP servers that touch production, and pin each one to the person it acts for.
• Audit. Formal ships logs out to the observability stack, data lake or SIEM you already run.
• Scope. Idira also covers endpoint privilege elevation and identity governance; Formal doesn’t. Decide which of those you keep, and move the infrastructure access layer to Formal where query-level control earns its keep.

Pilot one resource with one team, then widen out. If the category is new to you, the PAM explainer is a good place to start.