CyberArk Endpoint Privilege Manager Reviews

My primary use case for CyberArk Endpoint Privilege Manager is malware prevention. The solution enables malware detonation, which helps you solve ransomware problems. For example, suppose an unknown application comes into your environment, and you have installed a CyberArk Endpoint Privilege Manager agent. In that case, the solution will filter the unknown traffic from an unknown publisher and stop it from infiltrating. The solution dashboard also lets you know that specific software is suspicious. Still, it depends on the category, but malware prevention is one use case of CyberArk Endpoint Privilege Manager.

Classifying a trusted or whitelisted application is also a use case of the solution.

Another use case of CyberArk Endpoint Privilege Manager is stopping credential theft. For example, you have credential stores all around, whether you know it or not. You have credential stores in web browsers like Chrome and Microsoft Edge. The solution protects you against an attacker that has already gained access to your environment, an internal person that leverages your system and wants to go to your web browser, or probably there's a browser path attack where the person has access to your browser. He can check your credential store, but if CyberArk Endpoint Privilege Manager is in place, that situation will be prevented.

Just-In-Time Access is another use case of the solution. For example, there's no administrator privilege on the system, but let's say a database administrator or application administrator wants to use the credential. You can provide that person with Just-In-Time Access so he can use the credential for thirty minutes, then that credential expires once the time is up.

CyberArk Endpoint Privilege Manager also separates the privileges. For example, a team of application managers receives access to specific software that the network team can't access.

CyberArk Endpoint Privilege Manager is very easy to manage, which I like.

I also found credential detection the most valuable feature of the solution. For example, if I put a credential on my desktop and name the file administrator credential, and a person has access to my system and clicks the file under the history section of the system to steal the credential, CyberArk Endpoint Privilege Manager will flag that activity.

The solution also has a dashboard where you can see which software is suspicious, which I find valuable.

Other valuable features of CyberArk Endpoint Privilege Manager include application whitelisting and Just-In-Time Access.

CyberArk Endpoint Privilege Manager is a perfect solution, but CyberArk Endpoint Privilege Manager for Linux has many issues. One issue I observed while using it is that it needs to synchronize from an agent to a cloud because the agent does not update configurations or settings from the cloud. When I change some settings on the cloud, the changes don't synchronize into the system, and the policies won't come back unless I reinstall all the services. This is an area for improvement in CyberArk Endpoint Privilege Manager.

Another area for improvement in CyberArk Endpoint Privilege Manager, specifically for Windows, is that there's no way for you to check credential theft from a text file, such as a notepad file. Suppose I have a text file that contains passwords, for instance. In that case, I'm doing an application configuration that needs a password. CyberArk Endpoint Privilege Manager won't be able to help you locate that file, which means there's still an opportunity for an attacker to look into that text file and steal the passwords.

You can leverage the CyberArk Application Access Manager with CyberArk Endpoint Privilege Manager, but that aspect also needs improvement.

An additional feature I want to see in CyberArk Endpoint Privilege Manager is XDR, where you can trace how an attack can happen on an endpoint, how traffic was initiated, or if a person tried to access your computer and whether he was denied or allowed. CyberArk Endpoint Privilege Manager should be able to track such activities. The solution should allow you to see a specific event ID and use it to correlate whatever activity the malicious person was trying to do.

I've been familiar with CyberArk Endpoint Privilege Manager for nearly two years, but I haven't been steadily working on it. For example, I've not worked with the solution for three months, then I'll work on it for two months, then I'll stop working with it again, but I'm very familiar with CyberArk Endpoint Privilege Manager.

I last worked with CyberArk Endpoint Privilege Manager three months ago.

CyberArk Endpoint Privilege Manager is stable, particularly for the Windows version, not the Linux version. The solution is an eight out of ten for me, stability-wise.

I've contacted CyberArk Endpoint Privilege Manager technical support, and I'd rate support as seven out of ten.

Response time is three out of five.

Regarding how knowledgeable the level one support of CyberArk Endpoint Privilege Manager is, it always seems like the support person doesn't know what he's doing. I've already done what he was asking me to do. I'm not a CyberArk Endpoint Privilege Manager novice, so support is frustrating and a waste of time. Though the issue will be resolved eventually, CyberArk Endpoint Privilege Manager has already wasted my time, and that's uncool.

Neutral

CyberArk Endpoint Privilege Manager is the best solution. However, One Identity Safeguard is trying as a solution, and it has special features which make it almost equal to CyberArk Endpoint Privilege Manager. Still, CyberArk Endpoint Privilege Manager is the best.

CyberArk has been in the market for a long time and keeps improving. CyberArk Endpoint Privilege Manager has a hundred percent effectiveness against ransomware, which you can't get anywhere. The CyberArk team researched and knows the angle, the flaws, and the central point of attack. An attacker usually infiltrates or compromises your system by elevating the credentials or permissions and then leveraging that elevation to compromise the system. CyberArk Endpoint Privilege Manager removes User Access Control on the endpoint, so it takes away the attacker's means to elevate permissions, so CyberArk Endpoint Privilege Manager is simply the best.

Setting up CyberArk Endpoint Privilege Manager was pretty straightforward.

CyberArk Endpoint Privilege Manager has a very high price, so it's a one out of ten for me in terms of pricing.

I've used CyberArk Privileged Access Manager and One Identity Safeguard. I also have experience with CyberArk Endpoint Privilege Manager, One Identity Safeguard for Privileged Passwords, and One Identity Safeguard for Privileged Sessions.

CyberArk Endpoint Privilege Manager is cloud-based, but its agent is on-premises. The on-premise version is no longer supported, but it will still be supported if you're an old customer with an on-premise version. However, by 2024, CyberArk will no longer support the on-premises version of CyberArk Endpoint Privilege Manager.

Right now, there's no CyberArk Endpoint Privilege Manager within my company. I created quotes for customers to try the solution, but it's expensive. I just gathered my colleagues to simulate my use cases, and that's it.

What I'd tell others about CyberArk Endpoint Privilege Manager is that if you have the budget, you definitely should get it. The solution is excellent, and it's as if you're insured because CyberArk Endpoint Privilege Manager provides security. This is the advice I'd give anyone trying to implement CyberArk Endpoint Privilege Manager.

I'm rating the solution as seven out of ten because there's room for improvement in the Linux version, and the pricing needs to be more flexible.

My company is a CyberArk partner.

Inside we have a lot of applications, including three or four critical applications. With this application, remote users cannot run another application if you do not grant access to these applications. For example, if you want users to use Word or PowerPoint, you can allow usage of those and block usage of other things. If you want to run one application and you need to get permission, you send a ticket to ask for authorization to use it. That way, the company can control the access of every user.

I like that we have the power to blacklist, whitelist, and greylist applications.

It is really easy to deploy.

The solution is mostly stable. 

Users can scale the solution. 

We'd like the solution to work with AIX operating systems and custom distributions like Linux. 

We would prefer increased stability.

It is hard to deal with technical support if you are not certified. 

I've been using the solution for one year.

More or less, the solution is stable. About three weeks ago, we witnessed latency with the solution. It could be a bit more stable. 

If you want to deploy some agents, you can buy more licenses for the solution. It's a service only. You can add another agent. With ease and scale as you like.

We have about 100 users on the product right now.  

At this time, we will not increase usage. 

If you do not have certification, you cannot send a ticket. This makes dealing with technical support difficult. 

I did not previously use a different solution. 

You can implement this product on-premise. With the next-generation versions, you can just download an agent and deploy it on your machines. It really is easy to deploy.

We have three people on staff that are capable of managing the solution as needed. 

We had a consultant assist us with the implementation process. 

We have seen an ROI of around $10,000 so far.

We pay about $17 per user.

I'm not aware of any other similar solutions and did not evaluate any others. 

This is a SaaS solution. 

If you don't have a solution that you can deploy a massive agent to, it isn't easy to implement individually. 

I'd rate the solution nine out of ten.

CyberArk Endpoint Privilege Manager can be deployed across all platforms, such as AWS, GCP, and Ali Baba. 

The solution is used for management, multi-site failover, satellite vaulting, distributed architecture, custom CPM, PSM deployment, custom CCP, and CCP deployment.

The most valuable features of CyberArk Endpoint Privilege Manager are password management, session management, onboarding rules, platform customization, and safety management.

CyberArk Endpoint Privilege Manager was presently revised, which included a new interface, rebranding, improve documentation, and an excellent user panel that supports multiple integrations.

The price of the solution should improve.

I have been using CyberArk Endpoint Privilege Manager for approximately three years.

The stability of CyberArk Endpoint Privilege Manager is excellent. It has an uptime of 99.99 percent.

My clients have scaled CyberArk Endpoint Privilege Manager. They have a distributed architecture and satellite vaulting, which allows scalability to be flexible.

I rate the scalability of CyberArk Endpoint Privilege Manager five out of five.

We have approximately 30 people using the solution.

The support from CyberArk Endpoint Privilege Manager is excellent. We have good support in our SLAs, it is for five days.

I work with the competitor of CyberArk Endpoint Privilege Manager, Beyond Trust. If I was to change something it wouldn't be CyberArk Endpoint Privilege Manager, it would just be Beyond Trust. There's a reason why there are features in CyberArk Endpoint Privilege Manager, it works in CyberArk Endpoint Privilege Manager. The same goes with Beyond Trust, there are features that only work in Beyond Trust and wouldn't work in CyberArk Endpoint Privilege Manager. For example, the introduction of smart rules, wouldn't make sense because CyberArk Endpoint Privilege Manager,  doesn't work with smart rules.

I rate the initial setup of CyberArk Endpoint Privilege Manager as straightforward. However, I use the solution every day. The process of implementation took approximately one day.

The implementation strategy was reviewing architecture, deploying architecture, installing components, deploying components, configuring components, onboarding accounts, managing accounts, configuring platforms, managing platforms, configuring safes, and onboarding safes. 

We had a company-wide deployment of this solution.

We did the implementation of the solution in-house, but the SaaS-based part of the solution is done by the vendor. We had approximately five people who did the implementation.

The price of CyberArk Endpoint Privilege Manager is expensive. The solution is priced based on the number of accounts onboarded and the number of concurrent sessions. Everyone else is included in the price, such as support.

I rate the price of CyberArk Endpoint Privilege Manager a one out of five.

I rate CyberArk Endpoint Privilege Manager an eight out of ten.

We use the solution for cyber security to block unwanted things and ensure endpoint security. We also use the solution to collect user analytics.

Based on a customer's requirements, the solution allows me to give access and privileges to each user individually. CyberArk also allows granular blocking permissions.

CyberArk has better features than other vendors' products, such as a password vault.

CyberArk has some performance issues. For example, servers could not handle the solution when we first took CyberArk Endpoint Privilege Manager.

But to solve the problem, I first examine why the services take so much time to install. After that, I look at where we start the services. After that, if we need any patches there, I'll contact CyberArk.

It would be good if, based on an analysis of the user behavior from the logs we collect, we can see if a user has been accessing some other things. We need better reporting tools for those use cases.

I have worked with this solution for three years.

CyberArk's technical support is great. They immediately give support to everybody.

Positive

I've used Arcon User Behavior Analytics. And with endpoint security, we have used ManageEngine Endpoint Security. CyberArk's advantage over its competitors is its granular access. You can give specific access.

However, we work with all the solutions and provide one or the other based on what the customer requires. We will make a POC accordingly.

The solution's implementation process is a bit complex compared to other products. But every product has some challenges based on the customer's environment. However, we don't face any challenges because we understand the customer's environment and assess the scope of work.

As for difficulties we face while deploying CyberArk PAM, sometimes the agent won't install on the client's server. But if I report that to CyberArk, they give the required patches, and the solution works fine.

The time we take to deploy CyberArk PAM is based on the number of endpoints. If we have about 200 users, it takes two or three weeks to deploy.

We usually need two or three people to deploy the solution. One will be L2, and the other will be L1.

The solution's pricing is reasonable compared to other vendors' products.

I rate CyberArk Endpoint Privilege Manager an eight out of ten.

Because we are dealing with personal health information, we have had to setup up a security broker for admin access in and out of the accounts.

They wanted to have a break-glass solution in case there was a problem with the multi-factor authentication or any other issues.

We chose to use CyberArk for their failover abilities. If the Multi-factor authentication fails then you can still log in and it has a second factor that authenticates.  

It gives them the break glass option that they needed.

The most valuable feature is that it does lifecycle management and that it will change to whatever the end target is. For example, you can go into Azure AD, a backup directory, or a set of Google cloud platforms.

It will do lifecycle management on the keys. It makes it so that you won't have to ever have a standard key. 

It's generating dynamically keys and you can enforce policy easier.

As you start adjusting your key lengths and everything further, you can adjust them all in a single day.

It's an old product and has many areas that can be improved.

They are having to purchase Centrify to get a Linux client session that is authenticated against Active Directory. 

If you wanted to log in and use your ID credentials into Linux boxes, the solution that worked was not CyberArk, it was Centrify. They had to purchase two different products to do the same thing.

The interface is not great, but good.

In the next release, I would like to see a Linux Client added.

I have been using CyberArk Endpoint Privilege Manager, since the early 2000s.

We are using the latest version.

It's a stable solution.

CyberArk Endpoint Privilege Management is scalable.

We have 1200 users in our organization.

Technical support is fine, they are better than what they used to be.

The initial setup is complex because you are dealing with federated credentials across multiple authentication protocols.

We did not use a vendor or reseller. I am there as a consultant.

I think that it was in the range of $200,000  that had to get approved. That may have been for the whole three to five years for the project length.

I basically am trying to drive their digital transformation and do the overall build a mass data network for their data strategy. Building out different APIs and different things. 

Building out a blockchain security framework to allow HIPAA compliance where you can go in at the portability of their data to pull in and out without creating an issue with the payers.

I would recommend this solution depending on what the business needs are. I'm a big proponent for keeping things simple and trying to avoid unneeded complexity.

The company demanded certain things and only wanted to do it one way, and the way they wanted to do is what we got stuck with.

The API mobilities are there, they exist and they are okay, but as a framework and in total is worrisome because it's not a stateless application.

It doesn't appear to be moving forward. It's still a type of software-oriented architecture instead of moving to microservices, where it could be stateless. If it were stateless, and it failed during a password change, you would see it as a failure and go back to the original password.

I think that they have a lot of work to do to get there.

I would rate this solution an eight out of ten.

The solution reduces the stress of managing privileged accounts that log into servers and network devices. We're also looking to onboard service accounts, and the solution takes care of the rotation while meeting the password policy and auditing and recording user sessions. The solution manages privilege sessions. The solution is also part of a zero-trust architecture where we see what admin users do on the servers.

The password rotation and the session recording are the most valuable features. Likewise, password management for service accounts is a very nice feature.

One area that has room for improvement is in managing the credentials for network devices. The solution works fine for servers running Windows 10, but it's not very functional or smooth in operation for servers running Linux and Unix operating systems. There could also be some improvement in integrating with a number of solutions. Though CyberArk keeps developing, improving, or increasing its integrations with other solutions, it could do better.

I would also like the initial setup to be easier because we have to engage the services of a partner when setting up the solution. Moreover, the documentation for setup is restricted to partners only. You can get training on the administration of the solution, but the setup and getting some support documents are reserved for partners only. If there were a better way to get this information out there or to make it more accessible, that would reduce the complexity of setting up the solution.

We've worked with this solution for three years.

I rate the solution's stability an eight out of ten.

The solution is highly valuable, but it depends on the license. To scale the architecture, you can just increase your resources. I rate the solution's scalability an eight out of ten. I have about 50 users for this solution, using it 24/7.

CyberArk's technical support can be very prompt, and I am satisfied with their services.

Positive

I rate the initial setup a five out of ten. The solution was not so easy to set up. It has several components with communication between them and server hardening, so the setup is not exactly easy. But there is straightforward documentation, so we can work with that. However, that is reserved for partners.

All conditions being equal, it takes three weeks to deploy the solution. But it took longer for us because there were some constraints within the environment, so it took three weeks to one month.

When deploying the solution, we had to evaluate our environment, get all our privileged accounts, and decide on the architecture we wanted to go with. Since we deployed the solution on-premises, we had to provision servers for different components of the solution before installing each component on the servers and then installing the vault.

Right now, as an individual, I can't just say I'm getting CyberArk and setting it up myself. I need to get the services of a partner. A lot of the documentation is reserved for partners.

We needed two people to deploy the solution, and we currently just need one admin for maintenance. We would need two for a larger business.

I rate the solution's pricing an eight out of ten since the price can be too high for smaller businesses. There is an annual support license that needs to be purchased additionally.

It's a great solution and is really functional. It's not a solution that covers a lot of needs. It has a niche area, and they do excellently with that. I recommend CyberArk Endpoint Privilege Manager and rate it a nine out of ten.

I'm still trying to maximize and explore the solution's capabilities. It does quite a lot, but I have not been able to utilize the solution that well. It takes time for users to accept changes and get used to the solution.

By securing our endpoints, we are preventing attackers from using the domain accounts we have that are administrative accounts. For example, your credentials are cached when you log into a Windows computer, so attackers look out for those, and if it's an admin account, it will be what they need. Another good thing about this product is that even if you have a local account, you can provision that account so that the password is unique on all computers. So if you have their account credentials on a single computer, it doesn't mean you can use that same account and password to log into another computer or workstation. It also prevents using any accounts to jump from one host to another or move laterally, which is another important one for us.

All of the features are valuable. They control applications for users, like preventing users from elevating applications. You can use it to strip users of their local admin rights and, at the same time, elevate applications for them and give them access to elevated applications. Hence, administrative rights are unavailable for domain accounts which are the juicy ones for attackers because they can use them to move laterally from one host to another. Therefore, attackers can no longer strip a user's near right, but at the same time, they can elevate the user from access to the application and do their jobs without having issues elevating applications.

The solution can be improved by allowing computers or users to be excluded from policies because we currently can't do that. If you roll out an approach, you can target computers and users and can't exclude end users when targeting computers. So, for example, say you want to exclude administrators from a policy it will apply to everybody.

We have been using this solution for approximately one year and are currently using the latest version.

The solution is stable and reliable, depending on the client's use case.

The solution is scalable.

I rate customer service and support seven out of ten.

Neutral

The implementation would be complex for someone who doesn't understand how to implement it overall. Additionally, the use case determines the complexity. I rate the complexity an eight out of ten, with ten being the easiest.

The time involved in deployment depends on the use cases, the size of the organization and the number of workstations and users they have. For smaller organizations, if you have less than a hundred computers, it depends on your use cases. If the use cases are few, they can be deployed in a day or two, and policies can be rolled out to the workstations. On the other hand, organizations could take up to six months or a year to deploy.

I rate the solution seven out of ten. The solution is good but can be improved by allowing computers to be excluded from policies. I advise customers considering this solution to asses their use cases and try to talk to the three leading vendors at Delinea, CyberArk and Beyond Trust and find out if they can meet the requirements of their use cases before deciding.

We primarily use the solution on our endpoints. 

We have found the solution quite impressive.

Performance-wise, it's on par with BeyondTrust.

We like that you can distribute the applications and decide how you want to run those applications based on their criticality. You can distribute them and decide which one needs any extra approval and which can run independently. That division was really, really helpful. It has actually reduced almost 30% of calls to the IT help desk.

It cannot be on-prem. It is only cloud-based. Sometimes, that's a restriction in terms of usage.

I want to have the EPM platform on the same platform as PAM. I'd like not to have two different dashboards or two different consoles to manage the endpoint systems. Having a single platform for PAM and for EPM would actually help a lot.

We've only been testing the solution. We haven't used it for that long. 

The solution is stable. It offers great performance. There are no bugs or glitches and it doesn't crash or freeze. 

EPM is mostly for the endpoint end users. We have more than 500.

We've also used BeyondTrust EPM. They are very similar. 

Anyone who's trying to get the EPM implemented before purchasing the solution should have their internal policy sorted out. Make sure you have the right application groups and user groups defined and the policies for them defined. You cannot acquire the solution, purchase it, and then start building it. You will lose the license period, and sometimes not being ready means the implementation will fail.

I'd rate the solution eight out of ten. It still leverages a lot of group policy manager features of Windows infrastructure, and the group policy manager is a little complicated. It's still a good solution, however.