CyberArk Workforce Identity

I'm working with on-premises solutions. Back in the time there were no other options.

I use multi-factor authentication with Idira Identity . I sell it, I deploy it, so it's something that is really important in the strategy of Idira Identity  platform from top to bottom where the MFA part is at the bottom. Every day users should use it every day, and it should be developed in the future.

The password vault, the origin of CyberArk 25 years ago, is still used for some specific use cases. It's still required by privileged access. This is something that customers use, and in my region, I think it's still the most used part of Idira Identity, of CyberArk.

The best features in Idira Identity are the modern PAM.

Idira is a new label for CyberArk under Palo Alto. Palo Alto is making it more of a platform approach rather than some independent parts. They are brought together to form a platform. This is something that I observe; platformization is going on, and I would say that platformization is now the coolest part of this transition.

From my perspective, platformization is an advantage because it's an experience that big customers can take advantage of, or the platformization part because it's easier to manage and easier to deploy because of that. It's an advantage. I wouldn't say it's a disadvantage because some disadvantages are that this process took so long.

The area that is missing much is about the reporting part.

I would rate Idira Identity in general about eight. It has a good set of features compared to other identity security platforms. It's well-composed on different layers but requires platformization to go further to make it easier to use. You can do many things in it, but you need a lot of knowledge about dependencies of many things, so it requires time and big knowledge, and for the customer, it's a tough task now. It was very bad in the past. Now it's going better, and I expect that this platformization transition will help in succeeding more in the future.

I've been involved in this sphere for eight years.

Nowadays it doesn't require much time to deploy.

I am actually the person who participates in deployment.

From my experience, the technical support of Idira or Palo Alto is that the first response usually meets the SLA. However, I would say that on the way, it takes a long time to get to the next level. If it's not something that I need from support, such as changing the configuration in the tenant, for example, that I cannot do manually by myself, I need to ask the tenant for that. This is a rather quick option, but sometimes the log analysis and getting more into details of the case, especially in on-premises, takes longer. I would say my experience is that getting beyond the first answer sometimes is quite time-consuming. It takes a long time to get things done.

I would say maybe seven at this moment for support. I remember that when it was a smaller company, the support was a little bit better. Now it became larger, and there is a transition in the support layers. So now we are in the transition part, so for two years, I observe a little bit of the problem with the support going. It takes a long time, and I see a decreasing level of support. However, it's not hard, so it's still quite good according to other vendors.

The basic installation can take a day.

Nowadays it doesn't require much time to deploy.

I would say that customers choose this product based on their current needs.

Idira Identity definitely still has room for growth, especially the integration with Palo Alto systems, particularly the support system, because Palo Alto has a really big support system. This somehow needs to match it. The new CyberArk technology must somehow fit the Palo Alto support system. I expect that this will align somehow, but I don't know which way it will go.

I rated this product an eight overall.

The main use cases for CyberArk Identity  help us to strengthen security to protect sensitive data centers and systems. We can store sensitive credentials, user credentials, and privileged accounts inside our CyberArk PAM tool. This helps us rotate passwords for privileged account credentials and monitor sessions. It is very useful for audit purposes. If there are any unsuspected activities happening, we can review the log files and identify where issues are occurring. It is very helpful for monitoring and strengthening security levels.

The best features in CyberArk Identity  that I appreciate most are the recent updates that have added features in the cloud privilege environment. In the SAS solutions, they have added connectors. Except for PSM and CPM , they have included SIA, Secure Infrastructure Access, Secure Cloud Access, and Secure Web Sessions. These are additional features I have seen in the recent updates.

For multi-factor authentication, we use CyberArk Identity's multi-factor authentication integrations, LDAP integration and SSO , Azure  SSO , LDAP and SIM. These authentication mechanisms we implement. Mostly, we use LDAP and Azure  SSO.

Just-in-time access, also called ephemeral access, is especially beneficial, particularly with SIA and SCA  features. The recent updates from CyberArk Identity have been impressive. If a requester needs access to a platform, such as Windows, Linux, or any database, the request goes to the approval level for a particular time period. The approver can approve the request within that set time frame, granting just-in-time access to the end user.

Session monitoring is beneficial as it detects if the user is trying to log in and records all activities stored in the vault. It gives us more insights into what activities are happening inside. If there are any breaches or issues arise, I can go back to the log report and check all those activities that are captured, where it failed exactly, and what the issue was. From there, I can find and fix it.

On the identity product side, it is awesome. However, they can improve in the documentation parts. For example, if there is a migration process, I can see the maximum customers are moving from self-hosted to on-premises or from on-premises to the cloud. It would be helpful if they released a generalized document for processes such as migration. A clear overview document would assist us in understanding more about the tool, configurations, and automations to enhance our security.

Regarding the initial setup of CyberArk Identity, I faced some challenges. At some points, I could not find proper documentation for deploying, enhancing, or integrating with other components. I could not find the proper documentation in the community portal.

I have been working with the identity product using CyberArk PAM tool for more than two years.

When it comes to performance and stability, I find it very reliable.

CyberArk Identity is highly scalable as there are many things to learn. There is no limitation. When delving deep into the concepts, there is a lot to address and learn, especially when facing real-time scenarios. It may seem simple at first glance but once you get into the depth of the concepts, you realize how much there is to learn and there are no limitations in that regard.

My experience with technical support has been very good. When I reached out to them, I received prompt responses and support, which I would rate as very good.

I faced some challenges during the initial setup of CyberArk Identity. At some points, I could not find proper documentation for deploying, enhancing, or integrating with other components. I could not find the proper documentation in the community portal.

If I can share advice or recommendations for other companies considering CyberArk Identity, I would highlight the most powerful features in CyberArk PAM such as password rotation, session recordings, and just-in-time access as the best aspects of this product. On a scale of one to ten, I would rate this solution an eight.

The solution is mostly used for financial services.

The solution covers all key pillars of Identity security and governance. It reduces IT team workload by managing employee transitions, allocating rights, implementing least privilege, and ensuring people have only the necessary access rights. The role-based access and secure resource access principles are automated within organizations, especially when integrated with HR systems, enabling quick resource provisioning and decommissioning.

Once the solution is deployed, the customer can immediately see benefits. Typically, the first phase involves securing high-risk areas. Once the protection for privileged access identities is in place, the customer can then focus on securing the rest of the workforce, as well as protecting sensitive communications between machines, endpoints, and workstations. The time to realize value from this solution is quite short because it is a comprehensive solution. As soon as it is implemented, it fundamentally changes how users access systems, providing immediate security benefits. In summary, the value becomes apparent right away.

CyberArk Identity  offers Single Sign-On , Adaptive MFA, Web Password Manager, and Secure Web Sessions for recording sessions from web applications. It also provides federated services, Directory Service integration with popular IDPs, and management of joiners, leavers, and movers in an organization.

They have been working to improve areas such as Identity Governance  and Assurance (IGA ), but integration with new acquisitions into a single stack could be enhanced. While CyberArk Identity  is a leader in Identity Security, the integration of multiple components could be improved.

I would suggest focusing on the integration of the multiple components. Currently, we have a unified platform, but with the recent acquisitions, I would like to see more seamless integration of those new entities. Additionally, I’m curious to see how the recent acquisition by Palo Alto will play out. I am interested in understanding how both companies can benefit from each other moving forward.

Additional improvements could include more out-of-the-box plugins for key systems. Though they are the largest privileged access company with numerous integrations, coverage could be expanded for certain database clients and other systems.

I have been using CyberArk Identity for a year and a half.

Their support is very good, with a huge community. I would rate it as a nine out of ten.

The subscription licensing model, which provides identity features within the privileged access license, is quite affordable for most customers. The full stack available through one subscription license works particularly for customers in Africa, where the acquiring rate remains healthy.

I would rate CyberArk Identity an eight out of ten.