License & Deployment Mix: 24 tools – 10 OSS, 7 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

Overview

Privileged Access Management (PAM) is a security discipline that controls, monitors, and audits access to critical systems using elevated (privileged) credentials. Privileged accounts – root, domain admin, service accounts, database administrators, cloud IAM roles – have unrestricted access to infrastructure and data. A compromised privileged account is the fastest path to a full breach.

PAM systems address this risk by:

• Vaulting privileged credentials – storing root passwords, SSH keys, API tokens, and service account credentials in an encrypted vault; users never see or copy the actual password
• Brokering sessions – connecting users to target systems through a proxy that injects credentials without exposing them; the user accesses the system without knowing the password
• Recording sessions – capturing full video or keystroke logs of privileged sessions for forensic review and compliance evidence
• Enforcing least privilege – granting elevated access only when needed, only for the duration needed, and only to the specific systems required
• Rotating credentials – automatically changing passwords and keys after each use or on a schedule, eliminating persistent standing access
• Providing audit trails – logging every privileged access request, approval, session, and credential checkout for compliance and incident investigation

PAM is distinct from general password management (which stores human-facing credentials) and from secrets management (which handles application-to- application credentials). PAM focuses specifically on how humans use privileged credentials to access critical infrastructure.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

Overview Comparison

Credential Management

Best credential management: CyberArk, BeyondTrust, Delinea (full vaulting, discovery, rotation, checkout, break-glass)

Certificate-based (no vault): Teleport, Smallstep – eliminate credential sprawl through short-lived certificates

Composable vaulting: Boundary + OpenBAO provides credential injection without a dedicated PAM vault

Session Management

Best session management: CyberArk, BeyondTrust, One Identity, Wallix (full recording, live monitoring, command filtering, OCR search)

Best OSS session recording: Teleport (SSH, K8s, DB, web recording with real-time view), Guacamole (video + keystroke with admin shadowing)

Access Control

Best JIT + approval: CyberArk, BeyondTrust, Delinea, Teleport Enterprise (full approval chains with ticketing integration)

Best OSS JIT: Teleport (access requests with Slack/PagerDuty/Jira integration)

Audit & Compliance

SSO / Identity

OIDC is the preferred SSO protocol; the notes below assume Authentik as the external identity provider.

* = requires extension, plugin, or specific configuration

Best SSO support: Teleport (OIDC, SAML, SCIM), CyberArk (OIDC, SAML, SCIM), BeyondTrust (OIDC, SAML, SCIM), StrongDM (OIDC, SAML, SCIM)

No SSO: Sshuttle, OpenPAM, LAPS, Bastillion, KeyBox (LDAP only), PrivacyIDEA (LDAP/RADIUS only)

Monitoring Integration

The columns below assume a monitoring stack of Telegraf + InfluxDB + Grafana + AlertManager, with Fluent Bit + OpenSearch for log aggregation.

Best monitoring integration: Teleport (native Prometheus metrics + structured JSON logs), Boundary (Prometheus + JSON event log), Keycloak (Micrometer metrics + structured logs)

Deployment & Scale

Tools

24 tools.

Apache Guacamole

Apache Guacamole is a clientless remote desktop gateway that provides browser-based access to remote desktops and servers via RDP, VNC, SSH, Telnet, and Kubernetes exec protocols.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: SAML

Website · Source

Arcon PAM

ARCON is an Indian privileged access management vendor providing a comprehensive PAM platform with credential vaulting, session management, privileged threat analytics, and endpoint privilege management.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Bastillion

Bastillion is a web-based SSH console and key management tool that provides centralized access to Linux/Unix servers through a browser interface.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

BeyondTrust

BeyondTrust provides a comprehensive privileged access management suite that includes Password Safe (credential vaulting and rotation), Privilege Management for Windows/Mac/Unix (endpoint privilege management), and Privileged Remote Access…

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Boundary

Boundary by HashiCorp is an identity-aware proxy that provides secure access to hosts, services, and databases without exposing network credentials or requiring direct network connectivity.

License: LicenseRef-BSL-1.1 (source-available) · Kind: web · Deploy: native, k8s · SSO: none

Website

Boundary Enterprise

Boundary Enterprise extends the open-source Boundary Community Edition (see boundary.md for core architecture) with enterprise features including HCP Boundary (HashiCorp Cloud Platform managed service), multi-hop workers, managed worker gro…

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

CyberArk

CyberArk is the market leader in privileged access management, providing a comprehensive platform for credential vaulting, session management, threat analytics, and endpoint privilege management.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Delinea

Delinea (formerly the merger of Thycotic and Centrify) provides a privileged access management platform centered around Secret Server (credential vaulting), Privilege Manager (endpoint privilege management), and Server Suite (AD bridging an…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Devolutions Server

Devolutions Server (DVLS) is a self-hosted credential vault and privileged access management solution designed for SMBs and IT teams.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

JumpServer

JumpServer is an open-source bastion host and privileged access management platform that provides centralized access control, session recording, command auditing, and multi-protocol gateway capabilities.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Keeper PAM

Keeper PAM is an extension of the Keeper password management platform that adds privileged access management capabilities including session recording, credential rotation, secrets management, and remote browser isolation.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Keycloak

Keycloak is an open-source identity and access management (IAM) solution that provides SSO, identity brokering, user federation, and fine- grained authorization services.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, k8s · SSO: none

Website · Source

ManageEngine PAM360

ManageEngine PAM360 is an integrated privileged access management solution from Zoho Corporation that combines password vaulting, SSH key management, SSL/TLS certificate lifecycle management, and privileged session management in a single pr…

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

One Identity Safeguard

One Identity Safeguard (by Quest Software) is an enterprise PAM solution delivered as a hardened appliance with integrated credential vaulting, session management, and privileged analytics.

License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none

Website

OpenBAO

OpenBAO is a community-driven fork of HashiCorp Vault, created after Vault’s license change to BSL-1.1. OpenBAO provides secrets management, encryption as a service, and identity-based access under the permissive MPL-2.0 license.

License: MPL-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

PrivacyIDEA

PrivacyIDEA is a multi-factor authentication (MFA) server that manages hardware and software tokens, provides a RADIUS server for network equipment authentication, and integrates with PAM modules for Linux host authentication.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: SAML

Website · Source

Saviynt

Saviynt is a cloud-native identity governance and administration (IGA) platform that includes Cloud PAM (CPAM) capabilities.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Smallstep

Smallstep provides an open-source certificate authority (step-ca) and CLI tools (step) for automated certificate management, including SSH certificates, X.509 TLS certificates, and ACME- based automation.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Sshwifty

Sshwifty is a lightweight, open-source web-based SSH and Telnet client that runs in the browser, providing terminal access without local client software; it has no credential vault or session recording.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

StrongDM

StrongDM is a cloud-native infrastructure access platform that provides proxy-based access to databases, servers, Kubernetes clusters, and cloud environments.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Teleport

Teleport is an identity-aware access proxy that provides secure access to SSH servers, Kubernetes clusters, databases, web applications, and Windows desktops through a unified gateway.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, k8s · SSO: none

Website · Source

Teleport Enterprise

Teleport Enterprise extends the open-source Teleport Community Edition with enterprise PAM features including hardware security module (HSM) backed certificate authorities, FedRAMP authorization, advanced RBAC with access request workflows,…

License: Proprietary (proprietary) · Kind: web · Deploy: native, k8s · SSO: none

Website

TRASA

TRASA (Transparent Remote Access Security Architecture) was an open-source zero-trust remote access platform developed by Seknox that provided two-factor authentication enforcement, session recording, access policies, and a browser-based ac…

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

WALLIX Bastion

WALLIX Bastion is a European PAM solution providing session management, password vaulting, and privilege elevation and delegation management (PEDM).

License: Proprietary (proprietary) · Kind: web · Deploy: native, appliance · SSO: none

Website