Formal StrongDM

StrongDM alternative: Formal for engineers and AI agents

Formal is a reverse proxy in your VPC for databases, SSH and Kubernetes. Engineers and AI agents connect with their own identity, policies mask or block each query, and Slack approvals grant access that expires. Here's how it compares with StrongDM, now part of Delinea.

Get a demo › Read the docs ›

Formal publishes this comparison. Updated Nov 2, 2026.

Formal vs StrongDM at a glance

Criteria	Formal	StrongDM
Architecture	Formal Connector, a reverse proxy deployed as a container in your infrastructure. The Formal-hosted Control Plane cannot interact with your data.	A local client tunnels to StrongDM nodes (proxy clusters, or gateways and relays) on servers in your infrastructure.^[4]
How users connect	Native clients such as psql, ssh and kubectl, pointed at the Connector, with each person's or agent's own identity.	The StrongDM desktop app or CLI, installed on the user's Linux, macOS or Windows workstation.^[4]
Upstream credentials	Native Users: the Connector authenticates to the resource (password, SSH key, cloud IAM, kubeconfig). Formal identities never need to know or send these credentials.	Nodes authenticate users to the resource without exposing resource credentials to the user.^[5]
Policy model	Policies in Rego, evaluated when a session opens, before each request and after each response.	Context-aware policies written in Cedar, on top of roles that grant standing access.^[5]
Query and result controls	Inline, per query: block, rewrite (for example add a row LIMIT), filter rows, or mask columns in the response.	For some resource types, policies block particular commands or require MFA or approval steps. Result masking: not documented.^[5]
Just-in-time access	Workflows: a Slack form or API trigger, an approval in Slack, then a policy suspension that expires on its own.	Access workflows: request in the Admin UI, CLI, Slack or Teams, approved automatically or by one or more approvers.^[5]
Session audit	Every query and command logged per session. SSH and Kubernetes sessions recorded, with a risk score from 1 to 5.	Audit, logging and replays of all supported protocol sessions.^[4]
AI agents	Agents get their own identity, tied to the person who started them. The MCP gateway enforces policies and logs every tool call.	Docs describe agent-to-resource access through controlled MCP connections, and identifying AI-initiated activity.^[6]
Deployment	ECS Fargate, or Helm on Kubernetes (EKS, GKE, AKS, on-premises). Optional AWS PrivateLink to the Control Plane.	Nodes on Linux, Docker, EC2, ECS Fargate, Kubernetes, GCP, Azure VMs or Nomad. Proxy clusters on ECS Fargate or Kubernetes.^[7]

Delinea completed its acquisition of StrongDM on March 5, 2026, and strongdm.com now redirects to Delinea. If you run StrongDM, or had it on a shortlist, it’s a reasonable moment to look at a StrongDM alternative. Formal wrote this comparison, and every StrongDM fact on it comes from StrongDM’s or Delinea’s own pages, read on November 2, 2026.

Below: what the Delinea StrongDM deal changed for customers, how Formal’s approach to privileged access differs, how AI agents fit in, and a checklist you can apply to any of the StrongDM competitors on your list, Formal included.

What changed when Delinea acquired StrongDM?

Delinea announced a definitive agreement to acquire StrongDM on January 15, 2026 and completed the acquisition on March 5, 2026. Both press releases say the financial terms were not disclosed. Delinea describes the combination as StrongDM’s just-in-time (JIT) runtime authorization extending the Delinea Platform, powered by Delinea Iris AI, across cloud infrastructure, production databases, containers and CI/CD pipelines.

For existing customers, Delinea’s StrongDM page says: “Your deployment, login and support channels work the same way today. Nothing changes on your end.” We take that at face value. Nothing on Delinea’s pages says StrongDM is going away, so this page doesn’t argue that you have to move. It’s for teams that want to compare before a renewal or a new purchase.

How is Formal different from StrongDM?

Both products put a proxy in your network between people and infrastructure. StrongDM’s docs describe a client (desktop app or CLI) on each workstation that tunnels to StrongDM nodes, which fetch credentials and connect users to resources. Formal Connector, the proxy behind Formal PAM, is a reverse proxy you deploy as a container: engineers and agents point native clients like psql, ssh and kubectl at it, with their own identity.

The difference that matters most is what the proxy can do to the traffic. Formal policies are written in Rego, the Open Policy Agent policy language, and run at three stages, each with its own actions:

Session, when a connection opens: allow, block, MFA, quarantine, suspend, or Kubernetes impersonation.
Request, before the query reaches the resource: allow, block, rewrite (for example adding a row LIMIT), decrypt.
Response, after data comes back: allow, block, filter rows, mask columns, encrypt, rewrite.

That response stage is where a SELECT on a users table returns masked emails instead of failing outright (enforcement docs).

StrongDM’s docs describe context-aware policies written in Cedar that forbid or allow access based on signals such as location or device trust and, for some resource types, block particular commands or require MFA or an approval step. We didn’t find result masking in the StrongDM docs we read, so the table marks it “not documented”.

Upstream credentials stay with the Connector. With Native Users, the Connector authenticates to the resource with a password, SSH key, cloud IAM identity or kubeconfig, picked per identity (for example read-only for everyone outside an admins group). Formal identities never need to know or send those credentials.

How does Formal handle just-in-time access and zero standing privileges?

Formal grants just-in-time access by suspending a blocking policy for one person, for a set time. A Workflow chains a trigger to actions: a Slack form submission, an approval in Slack, a policy suspension with an expiry, and a message back to the requester. Workflows are defined in YAML and managed in the Control Plane, through the API or with Terraform.

Because access is an exception to a default rule, not a role someone has to remember to remove, the default policy applies again as soon as the suspension expires. Each suspension records the identity, the expiry and a reason for the audit trail. The just-in-time access explainer covers the concept.

How do AI agents get access through Formal?

An agent gets the same treatment as an engineer: its own identity, policies on every request and a log entry for every query. In our Devin guide, Devin authenticates with a short-lived OIDC token that Formal maps to a machine user and to the person who started the session. A policy blocks Devin by default. The requester approves access in Slack, and the suspension covers only that Devin session.

For MCP, the Connector’s MCP gateway puts remote MCP servers behind a Formal address. MCP clients sign in with Formal, and the Connector adds the upstream credential, enforces policies and logs every tool call.

Which teams run Formal for privileged access?

Cursor replaced its homegrown access proxies with Formal Connector, which enforces policy on every request and ties each agent action to the employee who started it. Formal secures 1,000+ resources across 10+ technologies at Cursor, with 40M+ logs and 600K+ sessions per week. The Cursor case study has the details.

Notion uses Formal for database access governance across 100+ RDS instances. The security team replaced broad, long-lived permissions with fine-grained, group-based rules, and uses an Okta integration for just-in-time access. The Notion case study covers the rollout.

What does StrongDM pricing look like now?

As of November 2026, strongdm.com/pricing redirects to Delinea’s Delinea Platform packages page. It lists three packages (Essentials, Standard and Enterprise) with the admins, users and storage each one includes, and no StrongDM-specific price list. We don’t quote numbers here: ask Delinea for a quote that covers the StrongDM capabilities you use today. To scope Formal for the resources you run today, get a demo.

How does Teleport compare with StrongDM and Formal?

If Teleport is also on your shortlist, our Teleport alternative page puts Formal next to Teleport on the same criteria, sourced from Teleport’s own docs and pricing pages. Read the two pages together for a StrongDM vs Teleport vs Formal view.

How should you evaluate a StrongDM replacement?

Whichever StrongDM alternatives you shortlist, run the same checks on each. These are the ones we’d run:

Resources. List every resource type you reach through StrongDM and check it against Formal’s supported resources (Postgres, MySQL, MongoDB, Snowflake, BigQuery, ClickHouse, DynamoDB, S3, HTTP APIs, SSH, RDP, Kubernetes and more).
Roles. StrongDM roles grant standing access. Map each one to Formal policies and Native User selections, then decide which access should become just-in-time instead.
Clients. StrongDM users connect through the StrongDM client. With Formal, they point native clients at the Connector, so plan the hostname and username change per team.
Approvals. Rebuild each access workflow as a Formal Workflow: request, approver, duration.
Agents. List the agents and MCP servers that reach production, and decide which person each one acts for.
Audit. Formal forwards logs to your SIEM, data lake or observability platform.

Start with one resource and one team, then widen. New to the category? The PAM explainer is a good primer.

StrongDM, now part of Delinea (strongdm.com redirects here), read Nov 2, 2026
Delinea and StrongDM to Unite to Redefine Identity Security for the Agentic AI Era (Delinea press release, January 15, 2026), read Nov 2, 2026
Delinea Completes StrongDM Acquisition (Delinea press release, March 5, 2026), read Nov 2, 2026
What Is StrongDM? (StrongDM docs), read Nov 2, 2026
How StrongDM Works (StrongDM docs), read Nov 2, 2026
StrongDM Docs home, Secure AI section, read Nov 2, 2026
StrongDM documentation index, read Nov 2, 2026
Delinea Platform Packages (strongdm.com/pricing redirects here), read Nov 2, 2026

Frequently asked questions

Who owns StrongDM now?

Delinea owns StrongDM. Delinea announced the deal on January 15, 2026 and completed the StrongDM acquisition on March 5, 2026. As of November 2026, strongdm.com redirects to a Delinea page that says StrongDM is now part of Delinea, and the StrongDM pricing and compare pages redirect to Delinea pages too.

Does StrongDM still work for existing customers?

Yes, according to Delinea. Its StrongDM page tells existing customers: “Your deployment, login and support channels work the same way today. Nothing changes on your end.” Nothing on the Delinea StrongDM pages we read says the product is being retired, so you can compare alternatives on your own timeline.

How much did Delinea pay for StrongDM?

The price wasn’t made public. Both Delinea press releases, the January 15, 2026 announcement and the March 5, 2026 completion notice, state that financial terms of the transaction were not disclosed. Neither Delinea nor StrongDM has published a figure for the Delinea StrongDM acquisition since.

What are the main StrongDM competitors for database and Kubernetes access?

StrongDM alternatives include other proxy-based access products such as Teleport and Formal. Pick criteria before vendors: where the proxy runs, what users install, whether policies can mask results, how approvals work, and how AI agents are identified. We compare Formal with Teleport on the same criteria.

How does Formal handle just-in-time access?

Formal grants just-in-time access as a time-bound exception to a policy. A Workflow takes a request (for example a Slack form), asks an approver in Slack, and creates a policy suspension for that person that expires on its own. When it expires, the default policy applies again. The just-in-time access explainer covers the concept.

Can Formal control what AI agents do in a database?

Yes. An agent connects through the Connector with its own identity, and policies apply to every query it sends: block a DELETE, add a row LIMIT, or mask an email column in the result. In our Devin guide, Devin is blocked by default and gets time-bound access once the person who started the session approves it in Slack.

“With Formal, we can finally manage least privilege access across our entire infrastructure through a single control plane.”

Tom Daniels

CISO, Cursor

10+Technologies secured

1,000+Resources secured

40M+Logs per week

600K+Sessions per week

Read the full story ›

Ready to (zero) trust your agents?

One network security layer for every agent and human, from the laptop to production.

Get a demo ›