CyberArk Review: Privilege Cloud Costs, Fit and Fine Print

Short answer: CyberArk Privilege Cloud, the SaaS PAM product Palo Alto Networks now sells under the Idira brand, fits large and regulated organizations that need vaulting, rotation and session recording with a published 99.95% SLA. It does not fit small teams: the only public list price is $44,712 a year for 25 users, there is no free trial, and rollouts usually involve paid services.

This CyberArk review is based on vendor pages, public marketplace listings, a third-party spend benchmark and security reporting opened September 22, 2026, plus CyberArk's own product documentation (connector requirements, regional availability, authentication and API pages) opened September 28, 2026. The finding most buyers will not see elsewhere is in the pricing section: the AWS Marketplace listing works out to roughly $1,788 per user per year before discounts.

CyberArk Privilege Cloud at a glance

Who CyberArk is for

CyberArk Privilege Cloud fits a 5,000-person bank or insurer with hundreds of Windows, Linux and database admin accounts, an audit team asking for session recordings, and a security group that can own a PAM program full time. A 99.95% SaaS SLA and 24/7 support with a stated 1-hour response (a UK reseller's G-Cloud listing) match what that buyer's risk committee will ask for.

It also fits an AWS-heavy enterprise that wants to buy PAM through AWS Marketplace and count the spend against existing AWS commitments. The listing supports private offers for custom terms.

A third fit is an organization already standardizing on Palo Alto Networks. Palo Alto Networks describes Idira as covering human, machine and AI agent identities, with over 300 integrations (Idira page). Buyers consolidating vendors may value one contract relationship, though cross-product features are described as coming later rather than shipping now.

Who should not buy CyberArk

Small IT teams that want to see a price before a sales call should look elsewhere. Palo Alto Networks does not publish a CyberArk price list, and the only public list price is $44,712 a year for 25 users, which is more than many small teams spend on their whole identity stack.

Teams without budget for implementation help should also be cautious. Vendr reports that professional services commonly add 20 to 40% of first-year licensing on CyberArk deals.

Developer-led teams whose main need is just-in-time SSH, Kubernetes and database access, rather than a credential vault, can start with access platforms that publish their terms: Teleport Community Edition is free for companies with fewer than 100 employees and under $10 million in annual revenue (Teleport feature matrix). Options to compare are on the privileged access management hub.

Features that matter

The sections below follow this site's weighted criteria for privileged access management, in weight order, for the criteria public sources describe; security assurance, deployment and pricing are covered further down. Capability detail below combines the AWS Marketplace listing, Palo Alto Networks' Idira page, and CyberArk's own product documentation, opened directly this run with a desktop browser User-Agent after the September 22 pass could not reach it.

Vaulting, rotation and session management

CyberArk Privilege Cloud is the SaaS version of CyberArk's privileged access manager. Its AWS Marketplace listing names credential management, session isolation and monitoring, session recording, and detection of anomalous privileged activity. Which of these the "Standard Privilege Cloud user" tier includes is not stated.

Just-in-time access and zero standing privilege

The same AWS Marketplace listing names "Just-in-Time access provisioning with Zero Standing Privileges workflows." At the May 2026 Idira launch, Palo Alto Networks positioned the platform around a zero-standing-privilege model managed from a central control plane, with controls for AI agents (SDxCentral). These are launch claims; independent evaluation of the AI agent controls was not found.

Endpoint privilege management

Palo Alto Networks lists Endpoint Privilege Manager as a separate human-identity product under Idira, next to Privileged Access Management and Identity Governance (Idira page). Confirm whether your CyberArk quote includes it.

Machine identities and secrets

Idira groups Secrets Management and Unified Secrets Governance under machine identities (Idira page). The self-hosted secrets product, Secrets Manager Self-Hosted, was formerly called Conjur Enterprise (SecurityWeek).

Remote and third-party access

The AWS Marketplace listing says CyberArk PAM covers "internal IT admins & 3rd party vendors" and offers vendor access without deploying VPNs, agents or dedicated laptops. How vendor access is licensed is not published.

Integrations

Palo Alto Networks cites over 300 out-of-the-box integrations and over 200 alliance partners (Idira page). The page does not list which directories, SIEMs or ITSM tools are included.

Day-to-day admin and scale

Running CyberArk Privilege Cloud is a program, not a side task. Vendr's data shows contracts ranging up to $275,406 a year and lists training, administration and module expansion as ongoing costs to budget (Vendr).

The SaaS service runs on AWS across three availability zones (G-Cloud listing), and CyberArk's own documentation lists 13 supported AWS regions for the tenant itself: Virginia, Montreal, Sao Paulo, Frankfurt, London, Milan, UAE, Tel Aviv, Singapore, Sydney, Jakarta, Tokyo and Mumbai (CyberArk docs: Privilege Cloud regional availability, accessed September 28, 2026).

The on-premises connector needs its own sizing. CyberArk's hardware tables scale by workload: a PSM (session) connector handling 1-10 concurrent RDP/SSH sessions needs an 8-core server with 8GB RAM, scaling to 32 cores and 32GB RAM at 51-100 concurrent sessions (100 concurrent sessions is the documented per-connector maximum). A CPM (password rotation) connector needs a quad-core server with 8GB RAM for fewer than 1,000 managed passwords, scaling to four 8-core processors and 64GB RAM above 100,000 managed passwords. The connector runs on Windows Server 2016, 2019, 2022 or 2025, and can be hosted on AWS, Azure or Google Cloud VMs as well as on-prem hardware (CyberArk docs: Connector network and machine requirements, accessed September 28, 2026). Ask which scale tier your admin count and password count map to during the POC.

Admin tip: Palo Alto Networks introduced the Idira brand for CyberArk products in May 2026 (SDxCentral), and its Idira page says existing customers keep the same platform with a new logo and design. Expect product names, portals and documentation paths to shift, and bookmark the current doc URLs your team uses.

The fine print

Licensing tiers and feature gates: A "Standard Privilege Cloud" user tier appears on AWS Marketplace; the full tier list and what each includes is not published.

SSO/SCIM plan requirements: CyberArk's own documentation covers SAML single sign-on and SCIM user/group provisioning as configurable capabilities of Privilege Cloud, each with its own setup guide; neither page states a separate paid tier or add-on requirement (CyberArk docs: Configure authentication methods, CyberArk docs: The Privilege Cloud SCIM solution, accessed September 28, 2026). This is what the documentation states, not a guarantee your specific contract includes it; confirm during the sales process.

Agent or connector footprint: CyberArk Privilege Cloud needs on-premises (or cloud-VM) connector components running Windows Server 2016, 2019, 2022 or 2025. Documented hardware scales from an 8-core, 8GB RAM server for a small PSM session deployment (1-10 concurrent sessions) up to 32 cores and 32GB RAM at 51-100 concurrent sessions, and from a quad-core, 8GB RAM CPM server under 1,000 managed passwords up to four 8-core processors and 64GB RAM above 100,000 managed passwords (CyberArk docs: Connector network and machine requirements, accessed September 28, 2026).

API access by plan: A REST API is documented for account, safe and session management. CyberArk describes queue-time-based throttling rather than a published fixed requests-per-second limit: when the request queue backs up, new API calls are rejected with an HTTP 429 while UI-driven requests keep processing; CyberArk recommends building retry logic for the 429 case (CyberArk docs: Implementing web services, accessed September 28, 2026). No plan-tier gating of API access itself is stated on this page.

Key integrations: 300+ integrations claimed; specific named integrations not listed on the Idira page.

Data residency and hosting regions: CyberArk documents 13 supported AWS regions for Privilege Cloud: us-east-1 (Virginia), ca-central-1 (Montreal), sa-east-1 (Sao Paulo), eu-central-1 (Frankfurt), eu-west-2 (London), eu-south-1 (Milan), me-central-1 (UAE), il-central-1 (Tel Aviv), ap-southeast-1 (Singapore), ap-southeast-2 (Sydney), ap-southeast-3 (Jakarta), ap-northeast-1 (Tokyo) and ap-south-1 (Mumbai) (CyberArk docs: Privilege Cloud regional availability, accessed September 28, 2026). Which region your tenant lands in is a deployment choice to confirm at signup.

Compliance reports: ISO/IEC 27001, SOC 2, CSA STAR Level 1, Cyber Essentials Plus, FIPS 140-2 and Common Criteria, per the UK reseller G-Cloud listing.

MSP multi-tenancy: Not published.

Trial realities: No free trial on the AWS or G-Cloud listings reviewed.

Contract terms: AWS Marketplace lists a 12-month term; Vendr reports multi-year terms typically bring 15 to 30% discounts (Vendr).

Support

CyberArk Privilege Cloud support runs 24 hours a day, 7 days a week, through email, online ticketing and phone, with a stated 1-hour response time and onsite support at extra cost, according to the G-Cloud listing. That listing is published by UK reseller Phoenix Software, so confirm the same terms appear in your own US contract. The AWS Marketplace listing points buyers to the vendor's customer support portal.

Exit and lock-in

At contract end, CyberArk Privilege Cloud tenant data is deleted after a set period, and customers can request data extraction before that happens (G-Cloud listing). The deletion period and the export format are not stated on that listing.

Watch out: request the export format and the deletion window in writing before signing, because migrating vaulted credentials, rotation policies and session recordings to another PAM tool is the expensive part of leaving.

CyberArk pricing

Pricing note: figures below are from public listings checked September 22, 2026. Palo Alto Networks does not publish a CyberArk price list.

Seat math for 10, 50 and 250 users can only be estimated: AWS lists a single 25-user bundle, so any figure for other team sizes assumes the bundle stacks linearly, which CyberArk does not state, and larger deals go through private offers. Vendr also reports buyers often land 20 to 35% below initial quotes, and that self-hosted deployments carry annual maintenance of 17 to 22% of license cost (Vendr).

Security and reliability record

Uptime: a 99.95% availability commitment, excluding scheduled maintenance, is stated on the G-Cloud listing. A historical uptime figure was not found.

CyberArk vs the alternatives

Criteria-level comparisons will be linked from the privileged access management hub as they are published.

Bottom line

Shortlist CyberArk Privilege Cloud if you run a large, regulated environment, need a contractual 99.95% SLA and can staff a PAM program. CyberArk publishes connector sizing by scale (see "Day-to-day admin and scale"), but get the export format and deletion window in writing during the POC, since those are not public. If you have fewer than about 25 privileged users or no services budget, start with lighter options instead. Build your comparison with the software shortlist builder, and see how CyberArk is scored in our research methodology.