CyberArk Endpoint Privilege Manager Reviews

We use CyberArk Endpoint Privilege Manager for verifying that users have the right access and privileges that are necessary and expected. For ransomware and malware mitigations, application control, they are whitelisting the IPs or the APIs for securing our endpoint management, since we are using the hybrid environment.

CyberArk Endpoint Privilege Manager provides comprehensive security features, including password management, DNS scanning, lifecycle management, and session recording. This enables any organization to benefit from a robust security posture because it has all the features required for any organization.

What is most appreciated about CyberArk Endpoint Privilege Manager is that users can easily navigate all admin rights with this control. CyberArk Endpoint Privilege Manager has the capability to manage or limit administrative privileges in a very easy way. 

It enhances security against ransomware, while providing seamless integration and scalability across all applications and solutions in our hybrid cloud environment. 

The interface for CyberArk Endpoint Privilege Manager is quite acceptable. The UI is simple and easy to navigate across all modules available in the product.

CyberArk Endpoint Privilege Manager's deployment is quite complex. 

Additionally, it is quite expensive.

We have used CyberArk Endpoint Privilege Manager for three years.

CyberArk Endpoint Privilege Manager is stable. All CyberArk products are used by large enterprises. It is a mature product.

CyberArk Endpoint Privilege Manager is scalable because it is deploying and running from hybrid or private or public clouds.

For the initial setup, we contacted them frequently, but after one or two years, the contact is minimal. Their customer support is very good and professional, warranting a rating of nine out of ten.

Positive

The initial setup and configurations are quite challenging. The organization team member should have prior experience with deployments and configurations.

The initial setup took around three to four weeks after assessing all requirements, feasibility analysis, and research from our end. We had to identify team members who are experts in deploying such solutions.

CyberArk Endpoint Privilege Manager does not require any maintenance on our end as CyberArk is taking care of all maintenance and operations. It is a managed service running directly from the cloud.

We required three to four people for the deployment of CyberArk Endpoint Privilege Manager. Three people worked full time and one person supervised their activities, totaling four people.

We saw the benefits of CyberArk Endpoint Privilege Manager after one year, and for the next two years, we received a good return on investment for this solution.

CyberArk Endpoint Privilege Manager is quite expensive because it is one of the comprehensive and great solutions by CyberArk. For mid and large enterprises, it should be a good option because it is a very comprehensive solution, so they need to justify the cost.

I have used other solutions from CyberArk. We have evaluated other solutions offering similar features. BeyondTrust provides EPM-kind of services, and Microsoft Entra ID has been used as CyberArk identity as well as for CyberArk Endpoint Privilege Manager.

I would rate CyberArk Endpoint Privilege Manager a nine out of ten because it solves our purpose.

We primarily use the solution on our endpoints. 

We are using pretty much everything there. Basically, what we are trying to do, is when the end user connects to machines, the actual Window servers, Linux servers, et cetera, everything is run through CyberArk. We haven't got into the Application Identity Management part yet, using CyberArk APIs. 

That said, we are using CyberArk whenever somebody wants to access a remote server or any server, for that matter. Our infrastructure is basically set up so that access is given through CyberArk.

The solution is good for controlling access. 

I have always found that CyberArk is a very tight, foolproof product compared to most other products available.

It is quite stable. 

CyberArk is a pretty heavy solution. There are a lot of moving components and a lot of things involved. The architecture itself is pretty heavy. When you look at products like BeyondTrust, it's not as heavy as CyberArk. That's the only thing. 

The setup can be somewhat complex. 

Most of it runs on Windows servers. Maintenance of those Windows servers and all that stuff is what is a little bit challenging.

Technical support could be better.

I've been working with the solution for about five or six years already with CyberArk. 

I have implemented CyberArk for quite a few UK clients before. I've been in London and I've worked with some customers there. 

I've been part of the Identity Access Management domain for almost 12 years already and Privilege Access Management for maybe four or five years.

The solution is stable and reliable. I'd rate the stability at a nine out of ten. There are no bugs or glitches, and it doesn't crash or freeze. 

That said, it depends on the architecture. We have high availability and we have a disaster recovery site. We have a pretty big implementation of CyberArk here. It's foolproof in that way. It's designed to be as stable as possible.

While my understanding is there are opportunities for scaling, I've never really attempted to scale anything. 

We have 5,000 to 10,000 users using the solution at this time. 

We do get a lot of support from them. We have taken professional services also in my previous engagement, where we had to deploy specific complex solutions. Technical support is always available, and they are helpful. 

That said, not everyone has the same level of expertise. There are people who are very knowledgeable and there are people who are not as good as well.

Neutral

I've worked in BeyondTrust, also. They have Asian-based solutions, and it's not as heavy as CyberArk.

Since I have been working with CyberArk for some time, I feel a little bit more comfortable with CyberArk. BeyondTrust is also not that bad. However, they did not have all the capabilities that CyberArk was offering at that time. That said, this was maybe four or five years ago. I haven't explored anything after that. I'm sure a lot of things have changed.

There used to be IBM Privilege Identity Manager as well, but it's not there anymore. 

Saviynt has its own solution as well.

Basically, there are multiple solutions there, however, CyberArk was definitely been our choice for Privilege Identity Manager.

Every product has its own way of working. With CyberArk, the only challenge is there are a lot of components. That's the only thing. 

When you have CyberArk architecture and if you have a hybrid environment specifically or you have multiple data centers that you want to use CyberArk in, the thing is there are a lot of components that need to be deployed. They have a lot of architectural components out there.

We do require quite a few people to cover maintenance tasks. 

The solution is expensive. 

I'm an end-user. I have worked for companies that have had partnerships with this solution in the past.

The solution is pretty mature and can accommodate our use cases quite well. 

I'd rate the solution seven out of ten.

I would recommend the solution to others. We have in the past recommended it to our customers as well. 

I use the solution in my company since some users need a certain level of activity in EXE files. The tool is used to block certain issues that we don't want in our environment.

The most valuable feature of the solution stems from its ability to delegate admin access instead of giving complete admin access to a single user. It is possible to elevate the product to a single process.

The product is very flexible. I don't feel any difficulties while using the product. Recently, my company moved to the tool's SaaS model from the on-prem version. With the tool's on-prem version, the database used to have some issues. After moving to the tool's SaaS version, we are not facing any issues. The on-prem version of the tool requires improvement.

The turnaround time of the support team is an area of concern where improvements are required.

I have been using CyberArk Endpoint Privilege Manager for four years. I am a user of the tool.

Stability-wise, I rate the solution a ten out of ten.

Scalability-wise, I rate the solution a ten out of ten.

More than 3,500 to 4,000 people in my company use the product.

I have contacted the technical support for the solution. I rate the technical support a nine out of ten.

Positive

The product's deployment part is very easy because only the agent you need to distribute to either via Intune. With Intune, you need to install the tool via automation.

I feel that the price of the product is nominal. It must be around 10 to 15 USD per installation. I rate the product price an eight to nine out of ten, where one is high price, and ten is low price.

CyberArk integrates with WebLogic. There are no issues with integration wise when it comes to CyberArk Endpoint Privilege Manager.

I rate the overall tool a ten out of ten.

We use the solution to secure direct access to servers. Users could open their browsers and access resources. This applies to different teams, such as DevOps, IT services, and development teams. They can no longer use RDP connections directly to the server for their day-to-day tasks. Instead, they must log in to CyberArk with their account and then use a shared account to access the server. Another advantage is using (Privilege Access Management) PAM accounts, which have high permissions but are limited in their access.

CyberArk's infrastructure is extensive. A cloud version has been introduced, when it was fully on-premises. You had to set up a separate environment for CyberArk, which incurred significant costs for the customer. Additionally, maintaining the infrastructure required dedicated resources, including on-call support outside of regular hours. If infrastructure went down, it left everyone in a difficult situation.

I have been using CyberArk Endpoint Privilege Manager as a consultant for three and a half years.

The product is stable.

I rate the solution’s stability an eight out of ten.

The solution is not easy to scale because it needs a separate team to do the capacity management all the time. We cater the solution to enterprises and small businesses.

I rate the solution’s scalability an eight out of ten.

The initial setup is very difficult, but If you follow the correct sequence, then it's fine. The only complex thing is to build the infrastructure and maintain it.
It depends on the whole component and takes a couple of weeks to deploy.

The solution is very expensive. The licensing costs a lot. There is a separate cost for support.

We opted for BeyondTrust.

Three people are required for the solution’s maintenance.

Overall, I rate the solution a nine out of ten.

What sets CyberArk apart is its continuous innovation, staying ahead of the competition. It not only offers integrated solutions but also expands its capabilities through strategic acquisitions.

In terms of improvement, CyberArk Endpoint Privilege Manager can be better by making its UI more consistent. Right now, there is a mix of a new, user-friendly look and an older interface with some functions. This mix can confuse users and affect how smoothly everything works together. Making the interface more uniform would make things easier and more efficient for everyone.

I have been using CyberArk Endpoint Privilege Manager for almost five years.

I would rate the stability of the solution as a nine out of ten.

The solution is highly scalable. I would rate the scalability as a nine out of ten.

I would give CyberArk's tech support a nine out of ten. They have made it so only certified experts can raise support tickets, ensuring that the person seeking help knows the product. This often leads to quicker problem-solving. While I haven't needed support much, others say CyberArk is responsive, even handling custom requests overnight in some cases. Overall, their support is solid.

Positive

Setting up CyberArk Endpoint Privilege Manager was challenging for me due to the involvement of multiple components. The process required a good understanding of each component and its configuration. It is not a straightforward setup, and familiarity with the system is crucial to ensure everything is correctly configured. I would rate the easiness of the initial setup as a six out of ten. The deployment of CyberArk Endpoint Privilege Manager takes about a day. It is not as quick as some Linux, which can be up and running in just a couple of hours. CyberArk's deployment is more complex due to the various components that need to be set up and validated to ensure they work together seamlessly. Once the deployment is complete, you can then proceed with tasks like account onboarding.

The investment in CyberArk is worthwhile. It significantly elevates security measures, reducing the vulnerability to breaches.

CyberArk is mostly used by big companies, especially in finance and banking. It is not really for small businesses because the investment is quite large. I have seen cases where substantial discounts were given, but that is usually for big enterprises. CyberArk has extra costs for professional services on top of the standard fee. These services are a bit pricey, and unlike some competitors, CyberArk doesn't focus heavily on them. While helpful, be prepared for an additional expense if you opt for these services. I would give it an eight out of ten in terms of costliness.

Overall, I would rate CyberArk Endpoint Privilege Manager as an eight out of ten.

The solution reduces the stress of managing privileged accounts that log into servers and network devices. We're also looking to onboard service accounts, and the solution takes care of the rotation while meeting the password policy and auditing and recording user sessions. The solution manages privilege sessions. The solution is also part of a zero-trust architecture where we see what admin users do on the servers.

The password rotation and the session recording are the most valuable features. Likewise, password management for service accounts is a very nice feature.

One area that has room for improvement is in managing the credentials for network devices. The solution works fine for servers running Windows 10, but it's not very functional or smooth in operation for servers running Linux and Unix operating systems. There could also be some improvement in integrating with a number of solutions. Though CyberArk keeps developing, improving, or increasing its integrations with other solutions, it could do better.

I would also like the initial setup to be easier because we have to engage the services of a partner when setting up the solution. Moreover, the documentation for setup is restricted to partners only. You can get training on the administration of the solution, but the setup and getting some support documents are reserved for partners only. If there were a better way to get this information out there or to make it more accessible, that would reduce the complexity of setting up the solution.

We've worked with this solution for three years.

I rate the solution's stability an eight out of ten.

The solution is highly valuable, but it depends on the license. To scale the architecture, you can just increase your resources. I rate the solution's scalability an eight out of ten. I have about 50 users for this solution, using it 24/7.

CyberArk's technical support can be very prompt, and I am satisfied with their services.

Positive

I rate the initial setup a five out of ten. The solution was not so easy to set up. It has several components with communication between them and server hardening, so the setup is not exactly easy. But there is straightforward documentation, so we can work with that. However, that is reserved for partners.

All conditions being equal, it takes three weeks to deploy the solution. But it took longer for us because there were some constraints within the environment, so it took three weeks to one month.

When deploying the solution, we had to evaluate our environment, get all our privileged accounts, and decide on the architecture we wanted to go with. Since we deployed the solution on-premises, we had to provision servers for different components of the solution before installing each component on the servers and then installing the vault.

Right now, as an individual, I can't just say I'm getting CyberArk and setting it up myself. I need to get the services of a partner. A lot of the documentation is reserved for partners.

We needed two people to deploy the solution, and we currently just need one admin for maintenance. We would need two for a larger business.

I rate the solution's pricing an eight out of ten since the price can be too high for smaller businesses. There is an annual support license that needs to be purchased additionally.

It's a great solution and is really functional. It's not a solution that covers a lot of needs. It has a niche area, and they do excellently with that. I recommend CyberArk Endpoint Privilege Manager and rate it a nine out of ten.

I'm still trying to maximize and explore the solution's capabilities. It does quite a lot, but I have not been able to utilize the solution that well. It takes time for users to accept changes and get used to the solution.

We use the solution for cyber security to block unwanted things and ensure endpoint security. We also use the solution to collect user analytics.

Based on a customer's requirements, the solution allows me to give access and privileges to each user individually. CyberArk also allows granular blocking permissions.

CyberArk has better features than other vendors' products, such as a password vault.

CyberArk has some performance issues. For example, servers could not handle the solution when we first took CyberArk Endpoint Privilege Manager.

But to solve the problem, I first examine why the services take so much time to install. After that, I look at where we start the services. After that, if we need any patches there, I'll contact CyberArk.

It would be good if, based on an analysis of the user behavior from the logs we collect, we can see if a user has been accessing some other things. We need better reporting tools for those use cases.

I have worked with this solution for three years.

CyberArk's technical support is great. They immediately give support to everybody.

Positive

I've used Arcon User Behavior Analytics. And with endpoint security, we have used ManageEngine Endpoint Security. CyberArk's advantage over its competitors is its granular access. You can give specific access.

However, we work with all the solutions and provide one or the other based on what the customer requires. We will make a POC accordingly.

The solution's implementation process is a bit complex compared to other products. But every product has some challenges based on the customer's environment. However, we don't face any challenges because we understand the customer's environment and assess the scope of work.

As for difficulties we face while deploying CyberArk PAM, sometimes the agent won't install on the client's server. But if I report that to CyberArk, they give the required patches, and the solution works fine.

The time we take to deploy CyberArk PAM is based on the number of endpoints. If we have about 200 users, it takes two or three weeks to deploy.

We usually need two or three people to deploy the solution. One will be L2, and the other will be L1.

The solution's pricing is reasonable compared to other vendors' products.

I rate CyberArk Endpoint Privilege Manager an eight out of ten.

The primary use case for CyberArk Endpoint Privilege Manager (EPM) is to control applications on work sessions, particularly in environments where users are not supposed to have open rights. It can be utilized to remove local admin rights from work sessions and protect the local admin group from unauthorized modifications. By deploying policies on these work sessions, organizations can restrict users' privileges and prevent them from adding users to the local admin group, reducing administrative privilege risks on endpoints.

Furthermore, it enables the deployment of policies that allow users to elevate application permissions without granting additional user rights. These application policies benefit specific applications without affecting users' overall rights. For instance, developers may require elevated permissions for certain software applications without needing broader administrative rights. However, EPM does not directly improve an organization's response to endpoint threats. Instead, it depends on other policies, such as those designed to prevent ransomware attacks. These policies focus on different aspects of endpoint security, while application policies specifically address the elevation of application permissions for user tasks, such as development activities.

CyberArk Endpoint Privilege Manager (EPM) 's most valuable feature is its ability to manage user application privileges and protect against ransomware attacks by controlling access to specific files and applications. Additionally, EPM effectively oversees the local admin group, preventing unauthorized users from adding themselves to it and ensuring tighter security. Moreover, the capability to remove users from the local admin group and rotate passwords for built-in admin groups enhances security measures significantly.

The product's threat protection and defense capabilities need enhancement. While there have been significant improvements in recent months, there's still a need for better identification and handling of real threats versus false alarms. It would be beneficial if the product could accurately detect and respond to genuine threats without generating false positives. This would allow organizations to rely more confidently on the product as a complete tool for application control and endpoint protection.

We have been using CyberArk Endpoint Privilege Manager for four years.

The technical support services are good. Despite occasional delays, the team has consistently provided effective assistance and support.

Positive

The initial setup of CyberArk APM was relatively straightforward, and the platform offers flexibility in deployment methods. Depending on the organization's preference, deployment could be done through various means, including deployment tools or the APM console. The platform provides administrators options for choosing the most suitable approach for their environment, contributing to ease of deployment.

However, there are areas for improvement. One aspect that could be enhanced is moving endpoints between sets within the EPM console. While the capability exists, there can be delays in endpoint movement, which could be addressed to streamline the process and improve efficiency.

Additionally, I recall considering adjustments in the advanced settings of the APM console. Specifically, there's a feature for creating custom advanced settings and targeting specific computers or endpoints. However, it's currently limited to targeting only one computer at a time, which can be cumbersome when dealing with multiple endpoints. The process could be easier.

EPM is not specifically designed for threat protection. While it does a decent job in this area, it generates many false positives. As a result, the primary function of EPM in terms of threat detection is to send events to the security team for further investigation.

As a consultant working with organizations, I've deployed application control features like those offered by CyberArk Endpoint Privilege Manager (EPM) across various environments. Without such controls, organizations would face increased vulnerability to attacks, as granting local admin rights exposes systems to potential security breaches.

I rate it an eight. However, there are areas where improvements could be made. For example, addressing the issue of false positives in events, especially concerning ransomware events, would enhance the platform's usability. Additionally, it requires EPM and PAM solutions to reset passwords for local accounts on workstations. Other products allow this with just the EPM component, whereas CyberArk requires integrating two separate products.