Teams reconsider CyberArk, now sold as Idira by Palo Alto Networks, for three reasons: the route to a price runs through a demo, the product has grown from a vault into an identity platform, and the owner is now a large security company. The alternatives range from free endpoint tools to EU-based vendors and engineer-focused access gateways.
Short answer: Looking for a replacement for Idira PAM (formerly CyberArk)? Admin By Request, WALLIX and Devolutions PAM come first in our privileged access management software ranking. Where a category has smaller vendors worth recommending, they occupy the first three places and the big brands come below them. Start with Admin By Request if the pain is local admin rights on laptops and you want to start free. Below are 11 alternatives, each taken from the Best Privileged Access Management Software in 2026 ranking, with its main difference from Idira PAM (formerly CyberArk).
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
Built for: Large enterprises already on CyberArk or Palo Alto Networks platforms
Not for: Small teams needing a quick, priced, self-service start
01
Why buyers look past Idira PAM (formerly CyberArk)
01
A price only after a conversation
The CyberArk address now opens the Idira platform page from Palo Alto Networks, and the PAM page we read offers a demo request and a contact form. No list price, plan name or free tier appears on either page. A team that wants to compare three vendors on cost has to start three sales conversations first.
02
The product has become a platform
Idira presents PAM together with machine and agentic identity security, identity governance and threat detection, in what it calls one control plane. The PAM page lists zero standing privileges, infrastructure access, endpoint security, session intelligence and vaulting as separate topics. A company that needs a vault and session recording will be reading a good deal of scope it did not ask for.
03
New owner, same roadmap to be confirmed
The CyberArk homepage tells existing customers they can continue to use the platform as before and will notice a new logo and name. That reassurance covers today. Buyers who chose CyberArk as an independent specialist now deal with a unit of Palo Alto Networks, and some prefer to see how packaging develops before renewing.
you want a like-for-like vault replacement and are content to buy it by module
#11
03
What each one does differently
1
Admin By Request
Denmark · Published
Admin By Request comes from Denmark and removes standing local admin rights on Windows, macOS and Linux through approval and time-limited elevation. Its Free plan carries every feature for 25 seats with no term limit, so a small estate can test the whole product. The plan table lists no vault for server credentials, so it answers the endpoint half of the question only.
Switch from Idira PAM (formerly CyberArk) if the pain is local admin rights on laptops and you want to start free.
WALLIX started in Paris in 2003 and has traded on Euronext since 2015. It records sessions, vaults and rotates credentials without agents, and extends to operational technology such as plant and factory networks. A full month of trial is offered, but the site shows no price list, so the quote has to be scoped against separate capabilities like elevation and remote access.
Switch from Idira PAM (formerly CyberArk) if a French vendor with agentless sessions and OT coverage matters to your audit.
Devolutions, founded in Québec, sells PAM as the top rung of a published per-user ladder, listed at 650 USD per user per year. It adds checkout with approval, rotation and just-in-time elevation to Remote Desktop Manager, run on its own server or in Devolutions Cloud. Every privileged user counts towards the bill, and the client comes with it.
Switch from Idira PAM (formerly CyberArk) if you want a number on a page before talking to sales and your admins already use remote-connection tools.
Heimdal Security A/S, based in Copenhagen and owned by Marlin Equity Partners since 2020, treats privilege as an endpoint matter: elevation, session management and application control. It says deployment takes hours because no vault servers are needed. An estimate tool gives a range per endpoint and server, with final prices set by sales inside a wider security platform.
Switch from Idira PAM (formerly CyberArk) if you want endpoint-first privilege control rolled out in hours, not a vault project.
Securden is a Delaware company selling a password vault, privileged sessions, endpoint privilege and vendor access as editions chosen through a quote form. Deployment is on-premises or SaaS, with a 30-day trial that needs no credit card and a 30-day refund policy. Each product added to the basket changes the quote, so list the parts first.
Switch from Idira PAM (formerly CyberArk) if you want to trial the vault yourself for 30 days and keep the choice of on-premises or SaaS.
JumpServer ships a GPL-3.0 gateway you install and run yourself. Its Community Edition is free up to 5,000 assets and includes session recording, command filtering and LDAP or AD sign-in. Rotation, just-in-time approval, multi-tenancy and single sign-on sit in the Enterprise Edition. Support runs through GitHub and a forum, and the commercial arm is registered in Hong Kong.
Switch from Idira PAM (formerly CyberArk) if your team can operate its own gateway and wants auditable source code.
ManageEngine PAM360, a Zoho Corp. division, publishes a table by number of administrators and keys, in subscription and perpetual form, with no cap on users or resources. A Free Edition covers one administrator and ten resources, and a trial runs 30 days. The cloud option is marked beta on the download form, so on-premises is the safer reading.
Switch from Idira PAM (formerly CyberArk) if you need published prices by administrator and a perpetual-licence option.
Teleport, from Gravitational Inc. in Oakland, gives engineers short-lived access to servers, Kubernetes, databases and desktops, with recorded sessions and no long-lived keys. Core code sits on GitHub under AGPL-3.0, while Community builds are limited to organisations below 100 employees and 10 million dollars of revenue. Pricing follows active users and protected resources, by quote.
Switch from Idira PAM (formerly CyberArk) if your privileged users are engineers working in SSH, Kubernetes and databases.
Netwrix Privilege Secure, formerly SBPAM and Remediant, is sold by Netwrix Corporation of Frisco, Texas, which took a majority investment from TA Associates in 2020. Its design goal is zero standing privilege: just-in-time access, monitoring of privileged activity and removal of leftover credentials. Pricing is by request, a trial exists, and the product sits within a large portfolio.
Switch from Idira PAM (formerly CyberArk) if removing standing accounts matters more to you than a classic vault.
KeeperPAM from Keeper Security, Inc. in Chicago grows out of a zero-knowledge password manager. Its gateway needs no firewall ingress changes, and browser sessions cover SSH, RDP, VNC, HTTPS and several databases. Quotes are requested, with volume tiers for non-human identities. A company already running Keeper for passwords has the shortest path to it.
Switch from Idira PAM (formerly CyberArk) if Keeper already holds your staff passwords and you want privileged sessions added to it.
Delinea, San Francisco and formerly Centrify, sells Secret Server for vaulting, rotation and session monitoring, and lists Privilege Manager, Server PAM and remote access as separate products with their own trials. Having completed its StrongDM acquisition, it now owns that infrastructure-access product too. Each module is priced on contact, so several modules mean several quotes.
Switch from Idira PAM (formerly CyberArk) if you want a like-for-like vault replacement and are content to buy it by module.
You need to remove local admin rights from laptops first
Admin By Request: Every feature is free for 25 seats with no term limit, with approval and time-limited elevation on Windows, macOS and Linux.
02
You need a European vendor with agentless sessions and OT
WALLIX: The company began in Paris in 2003, lists on Euronext and offers a full month's trial, though no price list is shown.
03
You want a price you can read before any call
Devolutions PAM: The PAM tier is listed at 650 USD per user per year, on a self-hosted server or Devolutions Cloud.
04
You want to start with one administrator and no budget
ManageEngine PAM360: The Free Edition covers one administrator and ten resources, and paid prices are published by administrators and keys.
05
Your privileged users are engineers in Kubernetes and databases
Teleport: Access is short-lived with recorded sessions; the core is AGPL-3.0 and Community builds stop at 100 employees.
04
When Idira PAM (formerly CyberArk) is still the right choice
CyberArk, under the Idira name, remains the natural choice for a large estate that already runs its vault and wants to extend it. The PAM page covers vaulting and rotation, ephemeral privileges, agentless access to AWS, Azure, Google Cloud and Kubernetes, local admin removal on Windows, macOS and Linux, and isolated, recorded sessions, and the pricing page cites eight Gartner Magic Quadrant leader placements for PAM. If one vendor should cover identity, machine and agentic privilege together, a smaller tool will leave gaps you must fill yourself.
05
What moving off Idira PAM (formerly CyberArk) involves
01
Count privileged accounts and who needs them
Export the list of vaulted accounts, safes and their owners, and mark which ones are used weekly. Dormant accounts are the cheapest to retire and make the quote for the new tool smaller.
02
Plan the credential hand-over before the cut-over
Every password in the vault has to be rotated into the new system or retired, and scripts or applications that fetch secrets from the old one need new calls. Do the rotation in waves, starting with the least critical systems.
03
Keep recordings for as long as audit requires
Session recordings and logs are evidence. Agree with the auditor whether they are exported or kept readable, and for how long, before the old contract ends.
06
Questions about replacing Idira PAM (formerly CyberArk)
6 answers
What is the best alternative to CyberArk?
For people leaving CyberArk, we put Admin By Request first for endpoint privilege and WALLIX first for a European session and vault product. Devolutions, Heimdal and Securden follow, and the larger names Netwrix, Keeper and Delinea come after the independent vendors in the list above.
Is CyberArk still called CyberArk?
The product is now sold as Idira under Palo Alto Networks. The old cyberark.com address still serves the pages, and the homepage says existing customers can continue to use the platform and will see a new logo and name.
Which CyberArk alternative has a free plan?
Admin By Request gives every feature free for 25 seats with no term limit, ManageEngine PAM360 has a Free Edition for one administrator and ten resources, and JumpServer's Community Edition is free up to 5,000 assets if you host it yourself.
Which CyberArk alternatives publish prices?
Devolutions lists 650 USD per user per year for its PAM tier, and ManageEngine publishes a table by administrators and keys in subscription and perpetual form. WALLIX, Securden, Teleport, Netwrix, Keeper and Delinea quote on request.
Which CyberArk alternatives are European?
WALLIX is in Paris, and Admin By Request and Heimdal are in Denmark. Devolutions is Canadian, the rest of the list is American, Indian or Hong Kong based.
Can I try these tools without talking to sales?
Securden offers a 30-day trial without a credit card, WALLIX a month on request, and ManageEngine a 30-day trial. Teleport has a 14-day Enterprise trial, and Admin By Request can be started on its Free plan.
—
Sources
Checked 2 November 2026
CyberArk PAM page (Idira): Idira PAM scope: vaulting, zero standing privileges, cloud and Kubernetes access, endpoint privilege, session recording; demo and contact form.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Author and fact-checker: Sebastiaan Smits. This page was last reviewed on 2 November 2026; our review process is public.
