At a glance
| Supported databases | Not confirmed: engine and client lists sit on docs.cyberark.com, which returned 404 when checked |
| Auditing and activity monitoring | Session isolation and recording, session command auditing, activity reports |
| Masking | Not a data masking product |
| Encryption or tokenization | Encrypted credential vault; not a data encryption product |
| Privileged access | Vaulting, rotation, credential injection, brokered sessions, Zero Standing Privilege |
| Policy enforcement | Privileged access workflows for privileged accounts |
| Compliance reporting | Session recordings, command audit and activity reports |
| Deployment | Self-hosted (Vault, PVWA, CPM, PSM) or SaaS with connector servers |
| Licensing | Commercial, by quote; ZSP needs added licences for Traditional PAM (IT Standard) SaaS customers |
CyberArk PAM fits regulated enterprises that need administrator credentials vaulted and rotated, and privileged sessions brokered and recorded. It is a broad, heavyweight platform in the middle of a rebrand to Palo Alto Networks Idira, and its documentation was offline when we checked, so confirm product names, database client support, licensing and roadmap with Palo Alto Networks before buying.
Overview
Privileged Access Manager is CyberArk's long-standing PAM product. Palo Alto Networks' Idira PAM page describes automated credential vaulting and rotation in a central, encrypted repository, injection of credentials at login so users never handle them, and isolation and recording of sensitive sessions for an audit trail. The self-hosted course datasheet names the core components: the Digital Vault (with disaster recovery and cluster options), the Password Vault Web Access (PVWA) portal, the Central Policy Manager (CPM) that rotates credentials, and the Privileged Session Manager (PSM), including PSM for SSH servers.
It is sold self-hosted (Idira PAM Self-Hosted) or as SaaS (Idira PAM SaaS, still called Privilege Cloud on the Idira Marketplace). The SaaS course covers connector servers, session recordings and auditing of session commands, privileged access workflows and a Secure Infrastructure Access (SIA) module. Palo Alto Networks bought CyberArk in a deal completed on 11 February 2026 and in May 2026 launched Idira, which adds Zero Standing Privilege and just-in-time enforcement. Which database engines and database clients PSM and SIA support could not be confirmed on an official page that loaded, so check that with Palo Alto Networks.
Key features
- Central, encrypted vault for privileged credentials, with automatic rotation by the Central Policy Manager
- Credential injection at login so users never see the password
- Privileged Session Manager to isolate, monitor and record sessions, including PSM for SSH servers
- Session recordings, auditing of session commands and activity reports
- Privileged access workflows, plus Secure Infrastructure Access in the SaaS edition
- Self-hosted or SaaS delivery, with Palo Alto Networks resources on moving from self-hosted to SaaS
- Idira platform additions: Zero Standing Privilege and just-in-time enforcement
Integrations and ecosystem
Pros and cons
Pros
- Mature credential vaulting, rotation and session recording for administrators
- Users connect through brokered sessions without seeing passwords
- Choice of self-hosted or SaaS delivery
- Zero Standing Privilege included at no extra cost for Modern PAM SaaS customers under the Idira terms
Cons
- Branding and documentation are moving from CyberArk to Palo Alto Networks Idira, and docs.cyberark.com was offline when checked
- Database engine and client support could not be confirmed from loadable official pages
- No public pricing; some new capabilities need added licences
- A large platform that needs dedicated administration
Pricing
No prices are published on the Palo Alto Networks Idira pages or in the launch press release; pricing is by quote. The Idira launch release (12 May 2026) sets out upgrade terms for existing CyberArk SaaS customers: Traditional PAM (IT Standard) customers get discovery and user experience improvements, with Zero Standing Privilege (ZSP) and agentic and machine identity protections needing additional licences; Modern PAM (IT Enterprise and Dev) customers get discovery, ZSP and user experience improvements at no additional cost, with agentic and machine identity security optional.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Regulated enterprises that must vault, rotate and record privileged access across a large server and infrastructure estate, including DBA accounts once database support is confirmed for their engines.
Typical use cases
- Vault and rotate the built-in administrator accounts of production servers and databases
- Broker and record administrator sessions so auditors can review what was done
- Replace standing administrator rights with just-in-time, zero standing privilege access
- Give third-party support staff recorded access without sharing passwords
Who should look elsewhere
- Smaller engineering teams that want a lighter access proxy for databases and Kubernetes: see StrongDM.
- Application-to-database credentials issued by API: see HashiCorp Vault.
Verdict
CyberArk Privileged Access Manager is a deep PAM platform for vaulting, rotating and recording privileged access. The Palo Alto Networks acquisition and the Idira rebrand mean names, documentation and packaging are changing in 2026, and the database-specific documentation was not reachable when we checked, so get current product, database support and licence terms in writing.
Frequently asked questions
Who owns CyberArk now?
Palo Alto Networks. It completed the acquisition on 11 February 2026 and on 12 May 2026 launched Idira, its identity security platform, with upgrade terms for CyberArk SaaS customers. The cyberark.com Privileged Access Manager page now redirects to the Idira PAM page on paloaltonetworks.com.
Does CyberArk PAM support database sessions?
CyberArk has long documented PSM connection components for database clients, but the documentation site (docs.cyberark.com) returned 404 for every page we tried on 7 November 2026 and no other official page that loaded listed the supported clients or engines. Ask Palo Alto Networks for the current list for your version.
Is it available as SaaS?
Yes. Palo Alto Networks trains customers on Idira PAM SaaS (the Idira Marketplace still calls it Privilege Cloud) and Idira PAM Self-Hosted, and publishes resources on moving from self-hosted to SaaS.
How much does it cost?
Palo Alto Networks does not publish prices; contact sales for a quote. Under the Idira launch terms, Zero Standing Privilege is included for Modern PAM (IT Enterprise and Dev) SaaS customers and needs added licences for Traditional PAM (IT Standard) customers.
Sources
- Idira privileged access management (Palo Alto Networks)
- Palo Alto Networks completes acquisition of CyberArk (11 February 2026)
- Palo Alto Networks introduces Idira (12 May 2026)
- Idira Marketplace
- Palo Alto Networks Education: Idira PAM Self-Hosted Install and Configure (datasheet)
- Palo Alto Networks Education: Idira PAM SaaS Set Up and Manage (datasheet)
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.