Privileged access (PAM)

Agentless privileged access controlJust-in-time access enforcementZero standing privilege reduction+9

Agentless privileged access for every identity.

Admin By Request

Eliminate local admin rights+11

Admin By Request is a privileged access management vendor focused on removing standing local administrator rights while allowing controlled elevation when needed. Its PAM offering is centered on endpoint privilege elevation, request/approval workflows, session auditing, and policy-based control of elevated activity. The product is best suited for Windows, macOS, and Linux environments where IT teams want to reduce local admin exposure without blocking legitimate software installs or support tasks. It also integrates with ServiceNow for request handling, but its core scope is endpoint PAM rather than vault-centric secrets management.

Akeyless

Secrets Management

7 products

Cloud-Native SaaS platform built to secure and manage every identity through a single pane of glass.

Vaultless secrets management+11

Apono

Identity & Access Management (IAM)

Just-in-time access provisioning+11

Apono is a cloud access management vendor positioned in IAM around just-in-time and least-privilege access for human and non-human identities. Its platform replaces standing privileges with access created at request time, enforced with policy guardrails, and revoked automatically. Apono is best suited for cloud-first teams that need granular control across AWS, Azure, GCP, Kubernetes, databases, and SaaS-connected environments, especially where privileged access and access review must be tightly managed.

ARCON

Discovery and onboarding of privileged accounts+11

11 products

ARCON PAM is an enterprise-class privileged access management solution designed for hybrid, multi-cloud, and distributed datacenter environments. The platform centralizes control of privileged accounts across heterogeneous IT infrastructure through a unified admin console and secure gateway server. ARCON PAM targets IT security, risk, and compliance teams managing complex privilege lifecycles in organizations with DevOps and cloud-native workloads requiring fine-grained access controls and comprehensive audit trails.

Authomize

Access governance policy enforcement+7

7 products

Authomize provides an AI-native Identity Governance and Administration (IGA) platform focused on continuous discovery, mapping, and governance of human and machine identities across cloud and on-premises environments. It delivers real-time visibility into permissions, entitlements, and access risks, automating remediation through policy enforcement and self-service workflows. Best suited for enterprises with complex multi-cloud infrastructures seeking to mitigate identity-based threats without disrupting operations. Authomize positions itself as a modern alternative to legacy IGA, emphasizing agentless integration and ML-driven risk prioritization for mid-to-large organizations.

BeyondTrust

Privileged credential vaulting and rotationPrivileged account discovery and attachment+10

BeyondTrust fights every day to secure identities, intelligently remediate threats, and deliver dynamic access to empower and protect organizations around the world. Our vision is a world where all identities and access are protected from cyber threats.

Britive

CIEM

9 products

Britive provides dynamic Cloud Privileged Access Management (CPAM) and Cloud Infrastructure Entitlement Management (CIEM) with patented just-in-time (JIT) ephemeral access across AWS, multi-cloud, SaaS, hybrid, and on-prem environments. It enforces runtime identity access for human, agentic AI, and machine identities via a unified control plane, minting permissions only at execution and auto-destroying them post-task. Recognized by Gartner as a CIEM leader, Britive offers entitlement governance, anomaly detection, and SCIM-based synchronization with IdPs like Okta and Azure AD. Best for organizations needing granular, zero-standing-privilege controls in dynamic cloud ecosystems.

Dynamic just-in-time cloud accessRuntime privilege enforcement+10

CyberArk (Palo Alto Networks)

Privileged password and key vaulting+10

the next-generation identity security platform that discovers, controls and governs your human and agentic workforce

Delinea (formerly ThycoticCentrify)

Privileged account discovery and governance+10

Delinea, formed in 2021 from the merger of Thycotic and Centrify and backed by TPG Capital, provides privileged access management (PAM) solutions for securing privileged accounts, credentials, and access to servers, applications, databases, and cloud infrastructure. Available as cloud-native or on-premises deployments via a centralized dashboard, it supports hybrid enterprises with products including Secret Server for credential vaulting, Privilege Manager for endpoint controls, and Privileged Behavior Analytics for threat detection. Serves over half of Fortune 100 companies, financial institutions, and critical infrastructure, focusing on password rotation, session monitoring, and just-in-time access.

Formal

Credential vaulting for privileged accountsAutomated password rotation after use+4

Formal is a modern identity and access proxy that governs interactions between users, AI agents, and sensitive infrastructure like databases, Kubernetes, and SSH. It functions as a just-in-time access layer that provides visibility and control over data access without the friction of legacy PAM vaults. The platform is designed for the modern cloud stack, enabling visibility into 'who accessed what' down to the query or command level.

Foxpass

Restrict access to privileged accountsMonitor privileged account activity+7

Foxpass Cloud RADIUS and Cloud PKI make it simple to protect your Wi-Fi and VPN connections with identity- and certificate-based authentication. No hardware. No local servers.

HashiCorp Vault

Encryption & Key Management

Lifecycle management for cryptographic keys+10

HashiCorp Vault is a secrets and cryptographic key management system used to store, distribute, rotate, and control access to encryption keys, certificates, tokens, and other sensitive material. In the Encryption & Key Management scope, Vault’s key management secrets engine centralizes lifecycle control while still interfacing with external KMS providers, and its encryption-as-a-service functions let applications encrypt data without exposing keys. It is typically chosen by teams operating mixed cloud and on-prem environments that need policy-controlled key handling, auditability, and integration with existing identity systems. Enterprise features are available through Vault Enterprise and HCP Vault Dedicated.

Heimdall Data

Control database access with role-based permissionsEnforce multi-factor authentication for access requests

We're redefining database access from the ground up

Heimdal PAM

Just-in-time privileged access+11

Heimdal PAM is a privileged access management solution designed for mid-market to enterprise organizations seeking simplified admin rights governance without traditional PAM complexity. The platform enforces least-privilege access through three core modules: Privileged Account and Session Management (PASM), Privilege Elevation and Delegation Management (PEDM), and Application Control. Heimdal differentiates through automatic user rights de-escalation upon threat detection, integrated with their Next-Gen Antivirus engine, and just-in-time privilege provisioning that eliminates standing admin credentials.

Hitachi ID Bravura Privilege

Secure elevated privilege access+9

Hitachi ID Bravura Privilege is an enterprise-grade PAM solution that automates password randomization across over a million accounts daily, supports geo-redundant credential vaulting, and enables frictionless, time-limited access for thousands of users, applications, and systems. It integrates agentlessly with clients, servers, hypervisors, databases, and cloud/on-premise applications. Part of the Bravura Security Fabric IAM platform, it combines PAM with identity governance for unified policy enforcement, access certifications, and compliance reporting. Best suited for large enterprises managing hybrid infrastructures with high-volume privileged access needs.

ManageEngine PAM360

Centralized privileged access governanceEncrypted privileged credential vault+10

3 products

ManageEngine PAM360 is a unified Privileged Access Management platform that centralizes governance of privileged credentials, sessions, and accounts across IT infrastructure for humans and non-human entities. It stores credentials in an encrypted vault with automated rotation, enforces Just-In-Time elevation, and provides session recording with command filtering. Trusted by over 5000 organizations and government agencies, it suits enterprises needing comprehensive PAM with endpoint privilege management, behavioral anomaly detection via AI/ML, and role-based access controls. Best for mid-to-large IT teams managing hybrid environments with strict compliance requirements.

N-able Mail Assure

Email Security

9 products

N-able Mail Assure is a cloud-based email security gateway for MSPs and Microsoft 365 environments. In scope for email security, it filters inbound and outbound mail, blocks spam and email-borne threats, supports policy-based controls, and provides quarantine, archiving, and continuity functions through a web console. N-able positions it for service providers and IT teams that need centralized protection for multiple domains and tenants, plus message-level visibility and administrative reporting. Adjacent capabilities include a private portal for handling sensitive messages and Microsoft 365 add-ons, but the core product is email gateway protection.

Inbound and outbound email securityPattern recognition for phishing and malware+6

Netwrix

Automate joiner mover leaver workflows+11

Netwrix provides a SaaS-based Identity Governance and Administration (IGA) platform, primarily through Netwrix Identity Manager (formerly Usercube), automating identity lifecycle management across hybrid IT environments. It handles provisioning, deprovisioning, access reviews, and policy enforcement for joiner-mover-leaver processes. The solution builds role catalogs mapping technical entitlements to business roles, detects toxic role combinations and Segregation of Duties (SoD) conflicts, and generates compliance reports. Best suited for mid-to-large enterprises needing scalable IGA for Active Directory, Azure AD, and multi-system access governance to enforce least privilege and support audits.

One Identity

Identity lifecycle provisioning and deprovisioning+10

One Identity provides Identity Manager, an enterprise-grade IGA platform unifying governance for users, applications, data, and privileged accounts across on-premises, hybrid, and cloud environments. It excels in automated identity lifecycle management, including provisioning and deprovisioning for SaaS and hybrid apps, with SAP-certified controls for SAP-centric organizations. Key strengths include attestation workflows, self-service access requests via shopping-cart interface, consolidated governance for regular and privileged accounts, and compliance reporting. Best suited for large enterprises needing visibility into access usage, behavior-driven policy insights, and regulatory audit support in complex hybrid IT landscapes.

Osirium PAM

Privileged credential vaulting and rotation+10

Osirium PAM is a Privileged Access Management platform that brokers and audits privileged sessions to servers, network devices, and security infrastructure via a gateway model. It enforces least privilege by separating users from credentials stored in an encrypted vault, with automated rotation and just-in-time access. Supports 150+ target devices, session recording with keylogging and screen capture, real-time shadowing, and privileged behavior analytics. Integrates with ServiceNow, SAML2 SSO, and multi-Active Directory. Best for organizations managing third-party access and heterogeneous IT environments requiring compliance with ISO27001 and Cyber Essentials.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Portnox CLEAR

Network Access Control (NAC)

5 products

Portnox CLEAR is a cloud-native NAC-as-a-Service platform that provides continuous risk monitoring and access control for endpoints across wired, wireless, VPN, and virtual networks. It discovers devices, authenticates via cloud RADIUS and Active Directory integration, enforces role- and risk-based policies, and automates quarantine of non-compliant devices using AgentP for enrolled endpoints. Vendor-agnostic with zero on-premises footprint, it supports managed, BYOD, IoT/OT devices in distributed environments. Best for mid-sized enterprises (500-10,000 employees) needing SASE-aligned NAC without hardware maintenance.

Cloud-native network access control+11

Remediant

Discover unmanaged privileged accounts+6

Remediant, acquired by Netwrix in 2022, provides SecureONE (now Netwrix Privilege Secure for Discovery), an agentless, vaultless Privileged Access Management (PAM) solution enforcing zero standing privileges. It discovers and removes always-on administrative access across servers and endpoints, delivering just-in-time privileged access via multifactor authentication. Targeted at small to midsize enterprises seeking lower-cost alternatives to CyberArk, it prevents lateral movement, offers real-time monitoring of standing privileges, and provides contextual insights for incident response. Pricing is approximately $22-25 per device.

SafePaaS

Policy-based access governance+9

The governance control fabric that shields identity, transactions, data and applications across the enterprise.

Sandfly Security

Endpoint Detection & Response (EDR)

6 products

Sandfly creates a dedicated and reliable Linux security solution that works across all systems without endpoint agents or drama. Our company focuses on Linux security that is high performance, high stability, high compatibility, and low risk.

Agentless Linux endpoint detection+11

Saviynt

Automated identity lifecycle management+11

7 products

Saviynt is on a mission to safeguard enterprises through intelligent, cloud-first identity governance & access management solutions.

Sectona

Identity & Access Management (IAM)

Privileged account and credential protection+10

Sectona provides a modern infrastructure access layer for the new-age workforce to build, confidently access, and operate faster, more secure technology environments. As a leader in Privileged Access Management (PAM), Sectona helps mitigate the risk of privileged account abuse. Its integrated platform simplifies password and privilege management, enables just-in-time access, and enhances endpoint and remote security.

Securden Unified PAM

Centralized privileged account vaultingJust-in-time privileged access+10

5 products

We stand for simplicity and affordability in cybersecurity

Segura

Identity & Access Management (IAM)

9 products

Segura is a leader in Privileged Access Management (PAM), delivering security that's fast, simple, and powerful, without the complexity.

Centralized multi-cloud identity provisioning+10

Segura (senhasegura)

Privileged credential discovery+11

Segura is a leader in Privileged Access Management (PAM), delivering security that's fast, simple, and powerful, without the complexity.

Silverfort

Identity Threat Detection & Response (ITDR)

10 products

Silverfort secures every dimension of identity. We break down the silos of identity infrastructure and point solutions to eliminate security gaps and blind spots once and for all. The result? Identity security without limits, that doesn't slow down the business.

Monitor authentication across hybrid environments

Sonrai Security

CIEM

3 products

Sonrai Security provides a CIEM platform that analyzes identities, entitlements, and resource relationships across AWS, Azure, and GCP to identify excessive access and misconfigurations. It uses an identity graph to map effective permissions and toxic permission combinations, enabling cloud security, IAM, and compliance teams to discover privilege risks and enforce least privilege. The Cloud Permissions Firewall automates real-time restriction of unused permissions and dormant identities based on actual usage. Extended with CWPP via Sonrai Dig, it links workload vulnerabilities to identity paths for prioritized remediation, distinguishing it from visibility-only CIEM tools.

Identity graph maps effective permissions+9

Tailscale

Zero Trust / SASE / SSE

3 products

We're returning to the original vision of the Internet. We want to help everyone create their own secure networks built around people and their connections.

Uses WireGuard-based encrypted tunnels to establish peer-to-peer connections between endpoints, reducing reliance on traditional VPN concentrators for private network access.

Twingate

Zero Trust / SASE / SSE

Zero Trust access to protected resources+11

Twingate provides Zero Trust Network Access (ZTNA) using software-defined perimeters to hide resources from public and private networks, enabling direct encrypted tunnels between authenticated users and resources. It acts as a cloud-native control layer for Zero Trust orchestration, integrating with identity providers, MDM, and EDR tools. Positioned as a lightweight SASE alternative to VPNs, it supports phased deployments without infrastructure changes. Best for organizations seeking rapid ZTNA adoption for remote access to critical resources while maintaining existing networks.

Venice Security

Discover every identity and entitlement+9

Venice Security provides a just-in-time (JIT) access platform designed to eliminate permanent standing privileges across hybrid environments. Its Valkyrie platform utilizes live, adaptive policies to grant temporary access to both human and non-human identities (NHI) without the need for agents or infrastructure disruption. It serves as a modern replacement for legacy static vaulting and manual ticketing workflows by automating the lifecycle of ephemeral credentials.

WALLIX Bastion

Centralized privileged access controlPrivileged session management+8

WALLIX provides cybersecurity solutions for simple, secure and trusted access, to protect digital and industrial environments.

Xage Security

OT & ICS Security

Layered multi-factor authenticationSingle sign-on federation+9

Xage Security is a zero-trust access vendor whose IAM offering centers on identity-based access for mixed IT, OT, and edge environments. In the IAM scope, it provides multi-factor authentication, federation, single sign-on, and policy-based access orchestration across multiple identity providers and local directories. Xage is best suited for industrial, critical infrastructure, and distributed enterprise buyers that need access control across legacy systems, remote sites, and intermittently connected environments. The company also sells adjacent zero-trust and privileged access capabilities, but its IAM value is rooted in layered identity enforcement.

Xton Access Manager (XAM)