What is our primary use case?
We are one of the biggest security implementation and solution partners in Uganda. We work with multiple vendors, including Splunk, Fortinet, Check Point, Palo Alto, ARCON, Rapid Server, and Tenable. These are all our vendor partners. We work with different solutions for different kinds of customers and requirements. One of the PAM, privileged access management and identity management solutions our customers have been using was CyberArk, which they were not very happy with. We moved them over to solutions like Thycotic or ARCON. That is what we are working on. These are public sector customers, government customers, they are not private customers.
It is always on-prem, it cannot be hybrid. These guys will come and do an implementation on a server, which they put in the data center, then they map all the user credentials with it.
What is most valuable?
I am not a product guy, I'm the business guy for them, so I won't be able to give the specifics on the technical aspects. I can say that the customers are happy with ARCON ARSIM. They've been using it for the last six months and they've been happy with it.
What needs improvement?
As for what can be improved, definitely pricing. Customers look for pricing and ARCON is a little more expensive than Thycotic. So the pricing model could be improved. Our customer went with ARCON because being a government public sector entity, they could only go with an on-premises implementation which Thycotic does not offer.
It's still under evaluation and testing. These are big entities, the user base will be huge. So they have taken 50 user workable licenses and they're working on it for a while.
I don't think I have any other challenges or requests with ARCON, it satisfies what was required for mapping and reporting. I would say the dashboard visibility could be better. Thycotic's dashboard is very good.
For how long have I used the solution?
We've been interacting with ARCON for more than a year.
What do I think about the stability of the solution?
We have also never had any issues with stability.
What do I think about the scalability of the solution?
We have never had any issues with scalability.
How are customer service and technical support?
The support for ARCON ARSIM is very good.
How was the initial setup?
In terms of the initial setup, I can't say it was very straightforward nor very difficult; it was okay. Any implementation that we do, especially in security, is never going to be easy. This one is not tough, it was easy in the sense that we didn't have any difficulty implementing it - either at the POC stage or user stage. But it is not something that anybody off the desk can just start implementing. You need to understand how to do it and it's pretty complex unless you’re a security expert, which we are. Unless you know how to install the product and you've been trained on it, it is not easy for just anyone to do. So we had the ARCON team do a remote implementation for it with our engineer on the field.
What's my experience with pricing, setup cost, and licensing?
Thycotic is cheaper then ARCON and CyberArk is more or less similar in its pricing.
Which other solutions did I evaluate?
The customer wanted to have a comparison between CyberArk, Thycotic, and ARCON. They wanted to understand whether Thycotic could work for them or not and we wanted to partner with them if it met certain customer requirements. The customer had to decide for their project in the next financial year, starting sometime in August, September, whether to go with Thycotic or ARCON. They were using CyberArk but they were not very happy with it. So they looked at Thycotic and ARCON. They checked out Thycotic because they were looking at its cloud-based pricing and it was cheaper than ARCON. That is one of the reasons why they looked at Thycotic, as well as the other features it has. But being a government entity, they cannot go for a cloud-based architecture. They need to have an on-prem implementation.
In Africa, migration to the cloud for services has not taken off. Because of the statutory requirements and concerns, they have not authorized anybody to use cloud services for any security applications, except for standard services like mail and messaging, which is on the cloud. Nothing else is allowed. Every other service is on-premises implementation. That is where the challenges are.
What other advice do I have?
I would definitely advise anyone to look at it, it is a good product. Quite stable and scalable. It has its own strengths compared to other solutions and it does its job well. Thycotic has other strengths for other kinds of requirements. For the requirements that we looked into, ARCON met the customer's needs.
On a scale of 1 to 10, I'd rate ARCON ARSIM an eight. As a product, its technicality is good. There's nothing more that we could recommend. I'm just saying if you look at the complexity of implementation, it's not that it is hard, but unless you know how you cannot implement it properly. There is the issue of the graphics. The GUI interface display and reports that it generates could both be a little more user-friendly.
Which deployment model are you using for this solution?