CyberArk PAS Benefits

CoreAnalee82
Core Analyst/ Server Admin at a comms service provider with 1,001-5,000 employees
It has given us a common environment where all of our critical infrastructure credentials can be stored. From the pure usability and administrative perspective, I can't imagine doing what we do without it. And we're a fairly small business. We don't have 10,000 servers or 5,000 systems to manage. Still, the smaller the business, the smaller the company, the smaller the number of support people you have. So we still end up with a lot of people having to do a lot of work. I would say the security, having all the credentials in one place, having a two-factor login to the system available to us, which we use, and then that administrative aspect of it, being able to lighten our administrative load, so once we hand over certain things to CyberArk, that administrative work is done by CyberArk and not by us anymore. It enables us to get a lot more done with a smaller crew. The first thing that pops into my head is, when you're dealing with some old-school people who have been around our business for many, many decades, who are accustomed to writing down passwords on pieces of paper on their desk, getting those people off of the desktop and into an encrypted environment, that alone, is an enormous improvement. We literally had people, just a few years ago, who would have pieces of paper written with everything - address, username, password - sitting in plain sight on their desktop that the janitor at night could come in and see laying on their desk. Just within the last few years, I've even seen higher-level people who have the little sticky note out on their desktops, on top of their screen, with credentials. It's all electronic but, still, you get to their desktop or you look over their shoulder and you see everything. Going from that to having an encrypted environment, that alone was a huge improvement. Working with a lot of people who have been around the business for a long time, who have more of an old-school mentality, getting those credentials moved into a more secure environment and getting them rotated automatically, that's a huge improvement by itself. View full review »
Securitye790
Security Architect at a healthcare company with 10,001+ employees
Right out of the gate, three years ago, we secured all of our Windows Servers and all of our local administrator accounts. We followed that with all of their root accounts for our Unix servers. We were able to greatly increase our posture with local accounts. Then, we went through domain admins and reduced the landscape and password age of those accounts. We have demoted a lot of domain admins and taken a lot of that away from people, giving it a shared account structure. This has worked well for us to be able to protect our most sensitive assets. We call them crown jewels. It has been important to be able to do that, and CyberArk has allowed us to do that, which has been great. We have tightly integrated CyberArk into a lot of our different processes. Our security organization is massive. We have a lot of different teams and different things moving. Not only have we integrated this into our identity access management team, so onboarding and offboarding, but we also have integrated it in our threat management side where they do security configuration reviews before we have applications go live. We require these accounts that operate those particular solutions to be vaulted immediately. We have implemented them into a lot of our policies, standards, and processes. It has helped us with our adoption with other teams, and it has also helped us to integrate it at the ground level. View full review »
Informatf452
Information security engineer/ business owner
It increases the security posture across the entire enterprise because it's not only helping to secure those infrastructure accounts but it's also helping to secure our user accounts as well. It requires a lot more auditing and monitoring and checks. So if you don't have the right approvals, you can't get the credentials you need to do what you need to do. So if you don't have authorization, of course you can't get them anyway. In total, it's making the environment more secure. The security posture is a lot better. View full review »
Find out what your peers are saying about CyberArk, BeyondTrust, Broadcom and others in Privileged Access Management. Updated: March 2020.
407,096 professionals have used our research since 2012.
GerryOwens
Founder at GoTab IT Risk Services
From an industry perspective, you continue to see the headlines in the media about how bad actors have been able to take advantage of weak policies and security controls around access management within companies. In these cases, the focus has been around employees that can access the most sensitive information, or have access to the very controls that operate and protect the firm. Products like CyberArk, that provide controls for privileged access, have helped mitigate the threat of taking over those accounts that have the greatest amount of risk to an organization, particularly for those who are system administrators and have the highest powers in being able to access all levels of the technology infrastructure. When it comes to the product's ability to standardize security and reduce risk across the entire enterprise, standardization is all about simplifying the complexity of IT threats and risks and it's all about the standardization of the controls that you have in place. If you have a product set that enables you to provide security, and it is consistently applied across a specific user base, then you have standardization which drives both enhanced security through the privileged access controls, and efficiency through the standardization of your operating model. Availability is an interesting challenge, but it is part of an IT Risk Strategy. When it comes to Cybersecurity, Privileged Access control is the ability to manage IT risk associated with the most powerful access to your infrastructure services. This IT Risk can manifest itself as compromised information, manipulated data, or disruption of your IT based services. A Privileged Access Security product reduces the threat of stolen credentials and account takeovers of those profiles that would have the power to take down your enterprise. Therefore, it not only reduces the risk to your firm, but also drastically improves availability. View full review »
KunalChandel
Corporate Vice President at a insurance company with 10,001+ employees
An example of one of the ways CyberArk has benefited our company is one of the simplest. And this one is something that a lot of companies struggle with: domain administrators and server administrators. These are among the top accounts that most companies need to protect. As part of our deployment, we decided to go with these first when we deployed PSM. What we found out was that there's always that friction with operational teams where they don't want to do this kind of work because it is another thing they have to do. But once the product was deployed and we were able to give them all the tools that they have today, and they did not have to go through attestations and audits anymore and, when team members were coming in and leaving, all they had to do was put in a ServiceNow request to complete all the work, it was just something so different for them that all that friction just went away. It was one of those simplest things, but one of the biggest things that you can do in your company to protect it. I don't know if CyberArk really helps with meeting our availability requirements, but it definitely helps a lot with managing the accounts and managing the credentials. Availability? It helps to an extent. If there is an event of some sort, yes, you can always go back and look at the logs and you can figure out through recordings what happened. But it's more about manageability than availability. In addition, when we started with RPA, there was a requirement that every credential and the bots themselves be protected through the PAM system. From the get-go, we've had CyberArk in the middle. We use standard products for RPA and all credentials are managed through CyberArk. All bots are protected via CyberArk, through PSM, and also through CCP calls. We've got a pretty robust RPA implementation with our PAM platform. Users, bots, the credentials — everything is managed via our PAM solution. From a cost perspective, this was something that was a requirement, so cost was never really an issue here. The solution's ability to secure robots’ privileged access is pretty good. We've been able to secure our bots. In fact, we take care of our bots right from a development environment, using our development instances. So when our developers are building the scripts around those bots, they're already aware of what's going to happen when things finally go into production. Obviously, the level of security doesn't need to be the same, but we do it through the complete lifecycle. View full review »
Rahsaan Knights
Information Security Analyst III at a healthcare company with 10,001+ employees
We are stripping administrative rights, and we have implemented a special ID to help folks that lose administrative rights. Maybe it broke something, so while we design policies and try to get them where they need to be, they will have this ID in the meantime. CyberArk is able to protect both of these things while we move forward in this. The software is insanely robust. You can do whatever you want. If you want to put your own logo on the pop-up, then you can do it. You want to change the color to pink, yellow or brown, then you can do it. You can do whatever you want with this thing. This leads to people getting lost on what they want to do, but for those who have a great plan with a clear, concise idea of where their organization is going and what they want to accomplish, it is there to help you. Where a lot of people might struggle is with the actual environment, and where to begin. The software builds on top of that. You have to have a solid foundation. You will learn that as you work through the product, but you will also see how great and powerful the product is. With computer security, administrative rights is probably the number one thing that comes to mind. This is a software that will allow people to still use their Google Chrome, Adobe, and Facebook. They can do what they need to do, but it still keeps them protected. That is what is so great about the product, we can sell it to people as, "We are not trying to stop you. We want to enable you, but we want to be safe too. It's there to do that." View full review »
DavidPoints
Associate Director of IAM at INTL FCStone Inc.
We're a small IT shop of a few hundred people and the company has only a couple of thousand employees. We had some SharePoint workflows that people had used to get access via submitting a ticket. We had updated those processes by using some DevOps, some JAMS jobs that run in Azure, and they were breaking frequently. We have gotten people to understand now that they can just go to CyberArk. They don't have to submit a ticket, they don't have to go through a workflow, they don't have to put in the right server name or wait for an approval. It's just there. People were really like that. The solution standardizes security and reduces risk-access across the company. It's what the solution does. It's just a requirement. Standardizing access is taking away the "onesie-twosies." With the DNA scan, you're running a full report of everything on all your servers that you're targeting, or all the servers period, and finding those onesie-twosies accounts and getting rid of them. Standardizing and making local accounts on the servers, accounts that have least privilege and that don't have access to anything else, and giving people only that access when they log onto a box; that's pretty cool standardization. In terms of being able to have a quick win using the solution, we were given a ridiculous deadline to meet an external customer requirement to have privileged access management in place within a couple of months. That was to include signing the purchase order, getting it installed, and having it up day one to take in what we thought were 17 servers. Actually, we found out it was 53 and, two weeks after we had it running, we found out there were upwards of 60 to 70 servers. Getting all those servers in, the accounts in place, by the deadline — even just installing it — was all an immediate win. People said it couldn't be done. View full review »
SeniorSeca1c
Senior server administrator at a financial services firm with 1,001-5,000 employees
Because we now have the ability to grant access to management utilities like DNS Manager, Sequel Studio, and MMC, in a secure fashion, without system admins being required to continually reenter various passwords that are stored who knows where, it has really made the system admin's job much easier. It has made the PSM's job much easier. It has made the auditor's job and the security team's job and the access manager's job significantly easier, because we're able to move much more quickly toward a role-based access management system, and that is really streamlining the whole onboarding/offboarding management process. CyberArk is the key technology around which we have built our security management solution. We chose it four years ago to assist with password management, and it has grown to where it is managing the entire security posture of the company at this point. View full review »
Sack Pephirom
Senior Security Engineer at a financial services firm with 1,001-5,000 employees
It allows me to create my custom CPMs more easily and quickly without having to code everything. It helps me build a lot of these codes, so it makes it easier for me to create custom CPMs and PSMs. It allows us to be able to manage a third-party which is not natively supported by CyberArk. If there are certain legacy applications which are so old that CyberArk does not support them out-of-the-box, it allows me to be able to create custom connections and be able to manage those accounts. View full review »
ITSecuri6676
IT Security Analyst at a mining and metals company with 10,001+ employees
Having the keys securely locked helps drive policy. We can say what policy is, then we can point to the solution which provides it. Having that availability is strong in a large enterprise, especially in a global enterprise where there is a lot of different cultures and people do not want to hand off their privilege, rights, or workflows. Having that all set up and making it easier for them takes a lot of the stress off of our job. We are implementing PSM right now. It is providing a secured workflow substitute where people would go in and check out their passwords. They want to use it instead of having passwords, similar to Guard Check. You go in because you need a key. You get the key, and you are accountable for that key while you have it. You open the door, do your work, close it, and return the key. People get that analogy, and it is awesome. We are in the basics, like Windows, Unix, and databases. We do plan on getting everything eventually managed. It is just a lot of customization and time to get it fully matured. View full review »
CyberA26c
CyberArk Consultant at a hospitality company with 10,001+ employees
It helps us in identifying and detecting the major threats and vulnerabilities and to make sure those vulnerabilities are addressed before something bad happens. It is more of a preemptive solution, to take care of our weaknesses and overcome them. We have been continuously monitoring, reporting, and observing where we were a few years ago, or a few months ago, and where we are now. There is continuous improvement in our security posture and that is where the satisfaction is. The solution is really doing what it is supposed to be doing, helping us to improve our security. View full review »
Sumit-Srivastava
Associate Vice President & Head of Apps Support at a tech services company with 10,001+ employees
There are two main ways CyberArk Privileged Access Manager Server Control has been helpful to us. * Any administrator using his own or her own ID and password to connect to the server or the domain that has been removed and the credentials for accessing the domain or the servers has been locked down into the password wallet, the access to it is controlled now through that group. Now we know who has access and what kind of access. Also, we control access through tickets. Unless there is an approved ticket, an administrator cannot just log onto a server and make changes. In this way, we are ensuring that an attack cannot just steal somebody's ADID and get into the server and create problems. * Through the application and team managers, we have removed the hardcoded user ID and password in our applications. Those are now in a password vault that is not known to anyone. The vault knows and changes the password, then connects the applications to the database. View full review »
Je’rid Mccormick
Associate Engineer I at COUNTRY Financial
The benefits are the way it allows us to secure accounts, but also be agile with providing privileged usage to our users. It is performing quite well, because it allows us to basically do what the user wants us to do, but in a secure manner. So, everyone is happy. Most of all, we don't have any breaches. It enables us to secure accounts and make sure they are compliant. Then, when the accounts are not compliant, it gives us the data so we can reach out to account owners, and say, "Your accounts aren't within our ESP policy. We need you to become compliant." This allows us to not only secure them, but keep track of what accounts are moving out of that secure boundary. View full review »
MasterSo7490
Master software engineer at a financial services firm with 10,001+ employees
The benefit is knowing where your accesses are, who has access to what. Additionally, obviously, it provides improved security around having your credentials locked down and rotated regularly. View full review »
Identity1647
Identity and Access Management Engineer at a energy/utilities company with 10,001+ employees
We have a lot of privileged accounts with a lot of administrators. The only way to have a good handle on the inventory of accounts, and have some type of controls around who has access to the accounts, is to have a tool like CyberArk. The key aspects of privileged access management are being able rotate passwords, make sure someone is accountable, and tie it back to a user (when the system is being used). This helps our security posture. We also look at other privileged accounts, which are used by overlooked applications, and this provides a benefit to the company. View full review »
Director051a
Director Information Security at a insurance company with 501-1,000 employees
* It has helped from an auditing perspective identify who has access to privileged accounts. * We are able to now track who is accessing systems. * It provides an accountability to the individuals who are using it, knowing that it is audited and tracked. It has become one of the primary components that we have. We also utilize PTA, and we are now integrating that into our risk management program so we can identify the uses of the vault which are outside of the norm, e.g., people accessing after hours. It has reduced the amount of time that we are looking through logs and audit logs. View full review »
BridgitAmstrup
Cyber Security Manager at a hospitality company with 201-500 employees
We have been able to really transform how all of our sysadmins manage all our infrastructure. Before, it was like the Wild West. Everybody was way over privileged and had access to everything all the time. Now, we finally have everybody into least privileged and auditing through PSM, which has been fantastic. We also have implemented dual control and just-in-time. So, it's moved the ability to manage a lot of our privileged users to where we need them to be. CyberArk has been easy for us to implement and the adoption has been good. We've been able to standardize a bunch of things. We've been able to standardize relatively easily with the use of the platforms and managing the policies. View full review »
Eli Galindo
Data Security Analyst II at a financial services firm with 5,001-10,000 employees
The product is for hardening access and making the organization more secure, therefore reducing chances of a breach. That is the most beneficial to any company, avoiding any type of data loss which will reflect negatively on your company. Once that happens, you are frowned upon, and nobody wants that. It plays a huge role in enhancing our organization's privileged access and security hygiene. We are using it for most of our open systems, like Windows and Unix. Our plan is to integrate it with our entire internal network. View full review »
Principad996
Principal entity management engineer at a retailer with 10,001+ employees
One way it has improved the organization is we now have restricted access for all users to go through CyberArk. It has also enforced firewall restrictions across other places so they don't go through other means, they go through CyberArk. That brings in compliance and their account is now two-factored, so that is more compliant with PCI regulations. The way it manages privileged accounts and managed access to privileged systems such that, right now, we are recording every session through PSM and people are more aware that the session is recorded, and they're more careful with what they do. View full review »
Rodney Dapilmoto
Systems Admin Analyst 3 at CPS Energy
By using this product, it has placed a new culture in my company by making employees more aware of IT compliance and cyber security. It has also placed us in a position to meet NERC CIP v6 requirements. View full review »
Technica06b9
Technical consultant at a healthcare company with 1,001-5,000 employees
Previously, we didn't have any password rotation policy for application IDs. Once we implemented CyberArk, we created a policy. It's good to rotate the passwords every two weeks. That is the biggest value for us. It gives us one place to store the keys to the kingdom, so if there is any breach we know where it is and what to do. View full review »
Song Ye
Senior System Engineer at a transportation company with 10,001+ employees
CyberArk has allowed us to get the credentials and passwords out of hard-coded property files. This is why we went with AIM in the beginning. Then, on the EBB user side, we were able to secure all the server root passwords and admin for Windows. This was a big win for us. It helps us with our SOX's controls and meeting new client directives. View full review »
ITSecurif9a7
IT Security at a manufacturing company with 10,001+ employees
It gives us the capability to rotate passwords. That is the biggest thing. We do not want them being stagnant so every service account that we have needs to be rotated at least once a year. View full review »
Stephen Brittain
Security Analyst at a insurance company with 1,001-5,000 employees
We are utilizing CyberArk to secure application credentials and endpoints using AIM. We have a big project this year to try to secure a lot of application accounts using AIM. It is helping to centralize control over credentials. It gets a lot of privileged accounts off endpoints and rotates them, so they are not out in the open. View full review »
ITSecuri170b
IT Security Specialist I at a healthcare company with 1,001-5,000 employees
It has removed the local admin rights. It is safe and improving well. Also, everyone doesn't have passwords to certain applications because of PAS, which is managing the passwords world-wide. So, it is more secure. Our overall security posture is pretty good, but there is always more to improve upon. View full review »
Maarten22
User at Liberty Global
Our third-party teams are able to connect to the end-points in a secure and isolated manner without needing to know any end-point credentials. Besides this, end-points themselves are back in control when the passwords are managed by the CPM. View full review »
Dan Hines
Senior Technologist at a retailer with 1,001-5,000 employees
We are maintaining compliance in PCI, SOX and HIPPA, which is a big thing. Auditors really like it, and it has made us stay compliant. There is at least one place to go to for getting privileged accounts. Now, users have to go through the portal or go through CyberArk front-end, the PVWA, or we could use the OPM or PSMP. It has helped out quite a bit. View full review »
karthikrajaraj
Technical Director at Unique Performance Techsoft Pvt Ltd
* Automatic password management, which will automatically change passwords based on compliance requirements. * DVR like video recording and text-based recording for easier audits. * Easily scan the network for all privilege accounts and has an easier onboarding process. * SSH key management * Command level restriction for all SSH-based devices. * Anomaly detection and prevention for all privilege accounts. * Integration with ticketing tools and SIEM solutions. View full review »
Kevin Elwell
Security Analyst at a retailer with 10,001+ employees
We know when passwords will be expiring so we can force users to change their passwords, as well as requiring specific password requirements for length, complexity, etc. Our security goal would be to keep people from putting the passwords in text files, do online shares, etc. This gives us more granular control. View full review »
SystemsA2327
Systems Admin II at a transportation company with 5,001-10,000 employees
* Lessens the risk with privileged access. * As far as EPM, mitigating the risk of local admins on PCs. View full review »
Ashish Pandey
Technical Manager at a tech services company with 10,001+ employees
It has improved the way our company functions on the basis that they're expanding, and the SDDC management solution and the decision to bring on security licenses under the system umbrella, then has passwords and the system management be a requirement in the coming quarters. We are already doing a small PoC with the relevant themes of the natural habits of the security teams. View full review »
reviewer990873
Information Security Engineer at a international affairs institute with 1,001-5,000 employees
The practice of sharing passwords disappeared completely and the most sensitive application is using the AIM to retrieve database passwords for all its users. We're still struggling with the use of RDP through PSMs. View full review »
HimanshuPandey
Lead Consultant at a tech services company with 10,001+ employees
I have an affinity towards CyberArk. I find that it works out-of-the-box, as a product. View full review »
Jack Gammon
Security Analyst at a financial services firm with 5,001-10,000 employees
If any intruder gets inside, they would not be able to move around nor do lateral movements. It minimize any attack problems within our network. It keeps us from having to fight with passwords or groups which are not getting onboard with the program. View full review »
reviewer990921
IT Support Specialist / Project Lead at a energy/utilities company with 10,001+ employees
Users were removed from local administrators group on all desktop endpoints providing a more secure computing environment, allowing only those programs approved to run securely. View full review »
Je’rid Mccormick
Associate Engineer I at COUNTRY Financial
CyberArk has enabled my organization to monitor and manage privileged accounts in a secure manner while also giving the ability to adhere to password compliance automatically. CyberArk has helped us to remove hard-coded credentials in applications and scripts. View full review »
reviewer990912
Senior Manager - Privileged Access Management at a tech services company with 10,001+ employees
Improved our user access and tracking, thereby safeguarding the organization and its customers. Being a user makes us a better reseller. View full review »
reviewer991878
Senior IT Security Engineer at a insurance company with 5,001-10,000 employees
Accounts are managed, passwords change frequently, and we have better audit logs! When something happens, there is a better chance you can determine the who/what/where/when/why of the situation. View full review »
José Luis Llorente Rey
Senior Specialist Identity System Support at Roche
With CyberArk, we can meet our compliance requirements reducing security risks without introducing additional operational complexity. This is very valuable for our company because we have regular audits where we have to provide evidence about the use of our privileged accounts (password use, password rotation, etc.) In addition, we have several third parties that need access to our infrastructure. CyberArk PAS helps us to provide this access in a quick and secure way. View full review »
reviewer988578
Snr Technical Consultant at a tech services company with 10,001+ employees
The audit capabilities include video so that not only keystrokes but also mouse clicks are captured. This provides safety and reassurance for anyone working in our infrastructure. View full review »
reviewer1052523
User with 10,001+ employees
We have different teams that hire out consultants from various vendors. For those consultants, there was a challenge in providing access to our critical infrastructure. CyberArk PAS provides isolated and recorded sessions for third-party/outsourced admin access. View full review »
identity989526
Identity and Access Management Analyst at a financial services firm with 1,001-5,000 employees
It's been a big win for us as we're now able to start managing service accounts with AIM. This is a big win, especially with our web hosting team. View full review »
reviewer990891
Information Technology Specialist (Contract role) at a tech services company with 10,001+ employees
The auditing and recording functionality along with stringent password-change policies and one-time password use has made compliance with customer requirements a much clearer and easily managed process. View full review »
reviewer990891
Information Technology Specialist (Contract role) at a tech services company with 10,001+ employees
A higher level of password rotation and usage auditing. View full review »
Find out what your peers are saying about CyberArk, BeyondTrust, Broadcom and others in Privileged Access Management. Updated: March 2020.
407,096 professionals have used our research since 2012.