CyberArk IGA

My main use case for Idira IGA is related to CyberArk at Truist Bank, where I owned the end-to-end delivery of a CyberArk Application Access Manager implementation. I specifically managed the scope and sequencing, Splunk integration, and shared accounts and service accounts remediation, as well as disaster recovery testing. My CyberArk experience is primarily at the program delivery and integration level.

Idira IGA has positively impacted my organization in terms of security posture, compliance and audit impact, and operational impact. For the security posture impact, before the CyberArk implementation, privileged access at Truist was a huge risk, with service accounts using hardcoded credentials in configuration files. After implementation, those accounts retrieve credentials dynamically from Idira IGA vault at runtime.

Regarding compliance and audit impact, the program had a direct SOX audit requirement. A good percentage of privileged accounts were onboarded into CyberArk within a specific timeframe to meet the bank's compliance application. For operational impact, I had over 500 shared accounts and service accounts retired and replaced with individual CyberArk manager accounts. This change alone brought significant operational consequences, such as accountability improvements and enhanced stability, given our pre-onboarding validation process.

In summary, the CyberArk implementation at Truist eliminated static credential exposure across over 200 plus enterprise applications, and my team and I brought over 500 privileged accounts under active vault management.

While discussing the best features Idira IGA offers, I mentioned the challenges, including application owner pushback on the onboarding timeline, particularly for their production systems. Furthermore, the shared account or service account remediation was particularly complex because we often did not have complete visibility into which systems depended on a given shared account. For features, I appreciate the end-to-end ownership, not just a piece. Most people who touch a CyberArk program own slices of it, but I owned the end-to-end implementation. The features of zero service disruption across 500 plus environments are among the strongest, along with proactive risk identification, compliance outcomes under a hard audit deadline, and creative dependency mapping using Splunk. Additionally, the disaster recovery validation that tested the failure scenario is crucial.

I took over a million-dollar CyberArk program from scope definition to a clean audit close, remediating over 500 accounts across legacy banking applications and catching a critical credential rotation risk before it reached production, delivering real-time privileged access visibility to the SOC environment with almost zero service disruption and zero audit findings.

Idira IGA could improve in the way access is provisioned for different users. My perspective on this improvement comes from the program delivery and implementation side. The application onboarding complexity needs to be simpler. Idira IGA could improve by providing a lighter-weight integration option that does not require application code changes. Additionally, while automatic credential rotation is one of Idira IGA's most prominent security features, it can be dangerous for large enterprises if not done properly. A rotation event that was carried out in the test environment caused an application to lose its database connection because it cached the old credential instead of calling Idira IGA dynamically. Therefore, Idira IGA could improve by incorporating an automated application impact assessment into the onboarding workflow.

Visibility into account sprawl before onboarding could also enhance usability, as the strongest problems for shared accounts or service account remediation were our lack of visibility into which systems depended on a given shared account. Idira IGA itself does not discover that dependency map, managing only the accounts it is programmed to report. Additionally, the native reporting in Idira IGA is functional but not executive-ready.

I have used Idira IGA since 2025, and it has been about two years.

An example of how I used Idira IGA was when I implemented it in the form of CyberArk with privileged access management, or PAM.

I mentioned the SOX compliance at the bank as the primary regulatory driver behind the CyberArk program. The SOX Act requires financial institutions to maintain strict control over access to financial systems, knowing who has access, what they did, and whether the access is properly managed and audited. The ISO/IEC 27001 compliance requires organizations to implement and maintain an information security management system with documented controls across access management, logging, monitoring, and incident response. Several of these controls were mapped directly to what the CyberArk program delivered.

I would rate Idira IGA a six out of ten overall. I chose this rating because of the areas where I see improvements could be made. My observations about operational friction points and the challenges slowing down adoption during implementation have led to this rating.

Regarding Idira IGA's AI capabilities, I believe there could be improvements in prioritizing features that reduce implementation friction and increase adoption.

The AI-driven anomaly detection and improvements represent a long-term opportunity for Idira IGA. This is where the platform needs to head to stay ahead of the threat landscape. Simpler legacy application onboarding, smarter rotation readiness checks, and native dependency discovery will make a significant difference for organizations.

Idira IGA is deployed in the cloud across the two organizations I have experience with.

Improvements needed for Idira IGA that I have not mentioned yet include alignment with banking regulations and compliance as well as enhancements according to the national NIST framework.

At Truist Bank, it took us about six months to deploy our previous IGA solution, primarily because we had to conduct compliance checks with various teams. Deploying CyberArk Modern IGA took three months. Compared to past solutions, the CyberArk deployment was pretty fast due to strong support from account managers and the many out-of-the-box configurations CyberArk offered.

My team spends less time on access reviews and evidence collection compared to before, taking about two to three hours of work with two technical people, depending on the subject matter experts available. Automation has made access reviews faster and more accurate.

My advice for others looking into using Idira IGA would be to prioritize improvements that reduce implementation friction and increase adoption. The gap between what CyberArk can do and what an organization achieves is not due to platform capability, but rather the difficulty of achieving effective implementation. Simpler legacy application onboarding, smarter rotation readiness checks, and native dependency discovery will differentiate organizations that achieve full privileged access coverage from those that stall at 60 percent and stop. My insights come from leading delivery and identifying operational friction points rather than from a product engineering perspective.

Idira IGA is a very good solution for privileged access management and stands out against the rest. I hope it continues to improve. My overall rating for this review is six out of ten.

In our day-to-day activities, we use Idira IGA for storing passwords, rotating passwords, and securing connections.

We support users and onboard user accounts, elevated accounts, privileged accounts, and all accounts on Idira IGA. On a daily basis, we rotate them according to company policies.

Apart from password rotations, we store passwords on the web application. According to user requirements, we provide access to users and approvers. Once a user requests a password, the manager must approve it. Then, the user can access the password. We have implemented policies according to Idira IGA policies.

The best feature is the secure logins and secure connections. Whenever a user needs to connect to the target machine, they must log in to the web application. From the web application, the user can connect to the target machine with the help of the PSM component. This is a very valuable feature in Idira IGA.

Not only my team, but the entire organization stores recordings with the help of this PSM. Whenever a user wants to connect to the target machine, they must log in to Idira IGA, which is CyberArk. Later, from the web application, the user can connect to the target machine. This allows for secure connection instead of a user directly connecting through RDP.

Apart from this, whenever a user tries to access the target machine and does something wrong, the manager can monitor what the user is doing and has permissions to stop the session whenever needed. Idira IGA has many features in the PSM component.

In my organization, with the help of Idira IGA, we secure our passwords and rotate passwords. This is very helpful for our organization to maintain secure growth.

Currently, they are improving significantly, and whenever vulnerabilities arrive, they notify customers. Whenever they upgrade versions, they notify customers. This is very good. Whenever we contact customer support, they provide prompt responses. Everything is good on their end.

I have been working in my current field for around ten years, and I have been working in my current organization for three years.

Whenever we contact customer support, they provide prompt responses. Everything is good on their end.

On a daily basis, we rotate passwords automatically. Whenever the user retrieves the password, after settings such as twelve hours or eight hours, the password expires. This means that the user cannot use the same password again. This is very secure. The organization, as I work in the banking sector, finds this very helpful for us and our clients to maintain all applications securely.

I would suggest to them that whenever an issue occurs, with the help of logs, we need to go to Idira IGA community portal and validate that.

Idira IGA serves as a unified platform combining IAM, PAM, IGA, and machine identity security within HP. One example of how I use Idira IGA in my day-to-day work is through the PAM capability, where we utilize something called digital workforce within HP. These are Bot IDs used for automations. Whenever we request any new automation to be created, we request a Bot ID with the IGA team within HP, and then it gets onboarded to the PAM solution for automatic credential rotation management on the platform.

Other use cases for Idira IGA include management of specific types of accounts, such as supplemental accounts and service accounts. We also use IGA for onboarding users into many other applications within our organization and providing user access, attaching the roles and permissions necessary. Using this platform, we are able to drive our SOX activities, including segregation of duties and other SOX controls which can occur on any application. Those activities are tracked and maintained on this platform.

Idira IGA offers several good features, including integration capabilities that allow it to integrate with many SaaS apps, on-premises apps, and cloud platforms. It also has APIs, which make it useful for integration with different types of downstream and upstream applications. Additionally, it provides a unified identity security platform that functions as a single platform for IGA, PAM, and IAM security, serving as a single control plane for all these platforms and capabilities. It also has native governance for most of these capabilities and inbuilt compliance integrated into the workflows, making it easy for us to meet our regulatory frameworks for SOX.

We rely mostly on the integration features of Idira IGA. For example, PAM is one of the tools we use most from Idira IGA, where we are connecting to privileged accounts and utilizing them for our automations across the organization. This is one of the most heavily used features. We also rely on this platform for our SOX activities to gather all audit-based evidence collections.

My favorite feature is the integration with PAM and the audit governance that it provides, making it truly helpful for us in driving our automations and SOX compliance activities. In terms of agentic capabilities and AI capabilities, it has some, but I believe it could improve in that area. We have not used that feature much, but I believe the combination of integration with agentic capabilities or autonomous agents within the platform could help increase the productivity of the platform.

Governance security on Idira IGA is very tight, providing all necessary requirements to keep data and transactions closely monitored. It has all the logging mechanisms within the platform. In terms of compliance, it aligns with most of the industry standard certifications and can be tightly integrated within our company network for setup. I believe AI readiness is present, with good governance and security measures in place.

Automation has significantly reduced both manual efforts and improved accuracy in our access reviews, which has changed how quickly we complete these processes. For example, we previously onboarded users through a different tool, which took considerable time due to back and forth emails and manual approvals for requests. Now, with this platform, everything is automated, requiring just one form and one approval, making the process much more efficient. What used to take about seven or eight days can now be accomplished within a couple of working days.

Idira IGA platform itself is somewhat complex to understand initially, so the UI and user interface could be simplified. This is one pain point I see. Additionally, an agentic layer could be improved on the platform. Instead of filling many forms to onboard any account or get access permissions, we could use the agent, invoke it, and through conversing naturally with the agent, we could get the access and onboarding completed quickly. This would simplify processes for most of our teams, so these two are the primary improvements I feel should be made.

Support is not an issue; however, performance-wise, the application feels somewhat heavyweight. It could possibly be made lighter by improving the underlying backend technology. Adding an additional agentic layer would also help simplify how we interact with the application.

The AI capabilities of Idira IGA are not extensively used by us, but I believe the accuracy of the responses we have utilized is good. However, regarding agentic actions, I think there is room for improvement overall on the platform.

I have been working in my current field for almost thirteen years.

Idira IGA is quite stable.

Customer support for Idira IGA is good. They are responsive and provide a first response within a few hours, with most issues resolved within a couple of days.

We did not have any centralized IGA solution previously, but we had some tools around PAM such as CyberArk. Idira IGA now serves as a comprehensive solution that suits all of our needs.

I believe it took somewhere around six months to go live with our previous IGA solution. Idira IGA deployment took less than a quarter. Compared to past solutions, our Idira deployment was at least 50 percent faster.

Currently, the return on investment is mostly reflected in time and effort reductions. We have indeed saved some headcounts as part of this deployment, but the metrics primarily highlight time-saving and accuracy improvements.

Pricing-wise, I find Idira IGA very competitive compared to other IGA tools available in the market.

We evaluated options from other vendors, such as BeyondTrust, but Idira IGA suited us better.

I would definitely recommend customers use Idira IGA as a single platform for all governance around PAM, application, and user provisioning. It is definitely recommended for large organization deployments. I provided this review with a rating of nine.

CyberArk IGA Powered by Zilla includes automated access reviews and certification. We automate compliance campaigns, reducing manual effort by 80%. It provides pre-approvals that can eliminate over non-required entitlements, streamlining onboarding. We also use it for role changes and off-boarding for employees and contractors. Additionally, it provides comprehensive integration for more than 200 to 300 applications, allowing us to manage all users and entitlements within the Salesforce and Slack applications, as well as managing non-human identities like bots, service accounts, scripts, and workloads, which helps reduce risks in complex hybrid or multi-cloud environments. It is also used for auto-readiness, creating detailed audit trails for compliance reporting, answering questions such as who has done what process or what particular activities have been done for a particular duration. Overall, CyberArk IGA Powered by Zilla helps us automate user access reviews, provisioning, and de-provisioning for both human and machine identities across hybrid and multi-cloud environments.

The best feature of CyberArk IGA Powered by Zilla is its rapid integration and deployment. It has a lot of pre-built integrations for SaaS applications as well as cloud-based and on-premise applications, which allows us significantly faster deployment compared to other legacy IGA tools. It also focuses on securing and managing non-human identities, bots, service accounts, and APIs, which often pose high security risks. It is used mostly for robotic automation, connecting applications that lack APIs and enabling automated data collection for governance.

With CyberArk IGA Powered by Zilla, automation impacts our access reviews by allowing us to generate access reviews automatically. It generates entitlement profiles, analyzes access, and suggests approvals or denials based on the service and bot accounts we use. This overall reduces manual effort in access reviews by up to 60%, and it monitors the access reviews for recertification, notifying if a user has not utilized their privileged IDs for an extended period. The AI or automation suggests if this user is no longer using their access, prompting their manager to make a decision whether to approve or deny access.

Previously, we performed manual work repeatedly, creating one-by-one campaigns and triggering them individually. However, with automation, we now employ a group of people for on-demand recertification, and for all privileged IDs, we use time-based recertification that runs every quarter or every 90 days. This significantly reduces our time by about 40 to 60%, and no manual effort is required for these activities.

The UI of CyberArk IGA Powered by Zilla is good, but there is room for improvement in the transition from legacy systems. Organizations with highly customized, long-standing legacy IGA tools may face a steep learning curve and complex data migration when moving to this modern AI-driven or cloud-native solution. Another limitation involves integration gaps. While CyberArk IGA Powered by Zilla boasts extensive pre-built connectors, any application not covered requires manual configuration or the deployment of Zilla Universal Sync, which may increase implementation time and could be less effective for legacy applications. However, it can be quite useful for SaaS-based applications, so improvement in customization or configuration for legacy applications is needed.

There is a considerable dependency on data quality. The effectiveness of AI-driven insights, such as entitlement recommendations for approve, deny, or do nothing actions, is entirely reliant on the quality and accuracy of the data ingested from connected applications. This means data quality should not just depend on application integration but also overall user insights regarding usage, such as login activity or MFA utilization.

I have been using this newly launched solution, CyberArk IGA Powered by Zilla, since the second quarter of last year in my organization.

Regarding stability, I recommend it at nine out of ten.

For scalability, I would also rate it nine out of ten.

I would rate the technical support of CyberArk IGA Powered by Zilla an eight out of ten, considering its time frame and the number of applications it handles.

Implementing CyberArk IGA Powered by Zilla presented challenges as it is a new tool, requiring a steep learning curve initially. However, I found it to be easy to use after I acquired the necessary skills in six months, leading to an overall moderate experience.

In terms of pricing for CyberArk IGA Powered by Zilla, I find it moderate compared to SailPoint, but it is cheaper than Okta Identity Governance.

In terms of maintenance, there is an annual maintenance cost (AMC) package to consider. Daily management of API-related services, customer-related services, and deployment-related services is also necessary, which clients need to purchase.

When comparing CyberArk IGA Powered by Zilla to other solutions such as Okta, it is known for its cloud-first approach and managing modern SaaS applications, while SailPoint is a leader in IGA. Entra ID is a newer competitor in this space. If comparing CyberArk IGA Powered by Zilla primarily with SailPoint IQ, I recommend CyberArk IGA Powered by Zilla if a client wants to rapidly govern SaaS applications, employs a lot of AI for automating access reviews, and prefers a modern low-touch SaaS platform. If a client has a large enterprise with complex legacy applications needing extensive customization and governance, then they should choose SailPoint IQ.

My advice for others looking into CyberArk IGA Powered by Zilla is that if a client has a complex number of legacy applications, they should opt for SailPoint or Okta. However, if they prefer to use AI for automating access reviews or want a low-touch SaaS platform for rapid SaaS adoption, they should go for CyberArk IGA Powered by Zilla. I would rate my overall experience with CyberArk IGA Powered by Zilla a nine out of ten.