If you are weighing these two, most of what you will read about them is written by one of them. Both are answering the question they would like you to ask.
We deploy privileged access management. Applied IAM is a CyberArk partner, and our engineers hold the delivery certifications — CDE-PAM, CDE-EPM, Guardian, Sentry, Defender — not the sales ones. We are not a Delinea partner. Read this knowing where we sit, and knowing we have no reason to talk you out of a platform that is working.
The short version: both are serious enterprise PAM platforms. CyberArk, now part of Palo Alto Networks under the Idira name, goes deeper at the top end of complexity. Delinea is usually faster to stand up and lighter to run. Which one fits depends far more on your estate and your team than on either feature list.
What each one actually is
CyberArk / Idira is the long-standing market leader in PAM. Palo Alto Networks closed its roughly $25 billion acquisition of CyberArk in February 2026, and in May 2026 folded the portfolio into the Idira brand. The core components did not change: the Vault, CPM, PVWA, PSM and PSMP are the same components your team already knows. You can run it self-hosted or as Privilege Cloud (SaaS), with Endpoint Privilege Manager for endpoints and Conjur for secrets. We covered the rebrand in more depth in CyberArk Competitors.
Delinea was formed in 2021 from the merger of Thycotic and Centrify. Secret Server is the vault, Privilege Manager covers endpoints, and Server PAM (the old Centrify side) handles Unix and Linux elevation. It has grown by acquisition: Authomize and Fastpath in 2024, and StrongDM, completed in March 2026, which brings just-in-time, proxy-based infrastructure access into the Delinea Platform.
Both were named Leaders in Gartner's 2025 Magic Quadrant for Privileged Access Management, alongside BeyondTrust (Gartner, 13 Oct 2025). On paper that is a tie. In delivery it is not, because they are built for different shapes of organisation.
What changes once you deploy them
The biggest difference is not a feature. It is how much infrastructure and expertise each one asks of you in the first six months.
CyberArk is component-heavy by design. A self-hosted deployment means a hardened Vault server, plus separate CPM, PVWA and PSM servers, plus high availability and disaster recovery for each. Privilege Cloud removes the Vault from your estate, but you still run connectors and PSM on your side. That design is a strength: the Vault is isolated and built to survive a compromised network. It is also why a CyberArk project needs certified engineers and a phased plan. We wrote about phasing it by risk in rolling out CyberArk across a distributed workforce.
Delinea is lighter to stand up. Secret Server Cloud and the Delinea Platform need fewer servers on your side, and the admin console is easier for a generalist to learn. Delinea's own Peer Insights quotes lean heavily on ease of use, which matches what we hear in evaluations. The trade-off shows up later, in very large or very bespoke estates.
Where deployments actually stall is the same on both. Onboarding stops at the first hundred accounts. Rotation gets switched off for the few accounts that broke something once. Sessions are recorded but nobody reviews them. A lighter platform gets you to that point faster. It does not get you past it.
Where CyberArk genuinely differs
Depth at the top end. Mainframe, OT, network devices, legacy applications with hard-coded credentials, thousands of service accounts with dependencies. In large regulated estates, CyberArk has more road behind it and more documented answers to the strange problem you are about to hit.
Session isolation and forensics. PSM brokers the session so the admin never sees the password, and the recording is built for an auditor or an incident responder to replay. For banks, insurers and anyone with heavy audit evidence requirements, this is often the deciding feature.
Endpoint privilege. Endpoint Privilege Manager is mature for removing local admin rights at scale. It takes tuning, but it is well proven.
The Idira direction. Under Palo Alto Networks, the roadmap is extending toward machine identities, AI agents and zero standing privileges. Existing customers keep their deployment and gain access to newer modules, with pricing depending on current licensing. Ask your account team directly.
The talent pool. In our experience, CyberArk has the deepest pool of engineers with production experience in PAM. That matters for the operate phase.
Where Delinea genuinely differs
Time to value. Delinea is generally quicker to stand up and easier for a small team to operate. That is why it wins more often in the mid-market than in large regulated estates.
Unix and Linux elevation. The Centrify heritage still shows. Delinea calls out Unix/Linux privilege elevation as a strength, and for Linux-heavy estates it is worth testing side by side.
Infrastructure and developer access. With StrongDM inside the platform, Delinea now covers just-in-time, proxy-based access to databases, Kubernetes and cloud hosts — the access engineers actually use. Before the deal, customers often ran the two side by side for different audiences (Dark Reading, March 2026).
The caution. Three acquisitions in roughly two years means integration work is still under way. Ask which capabilities are native to the Delinea Platform today and which are still separate products with a shared logo.
Side by side
| CyberArk / Idira | Delinea | |
|---|---|---|
| Best fit | Large, regulated, complex estates | Mid-market, small PAM teams |
| Vault | Self-hosted Vault or Privilege Cloud | Secret Server (on-prem or cloud) |
| Session management | PSM, deep isolation and forensics | Built in, strong |
| Endpoint privilege | Endpoint Privilege Manager | Privilege Manager |
| Unix/Linux elevation | Supported | A noted strength |
| Machine secrets | Conjur | Built into the platform |
| Infrastructure JIT access | Via Idira roadmap | StrongDM, acquired March 2026 |
| Deployment effort | High | Moderate |
| Skills needed to run it | Certified specialists | Generalist-friendly |
| Parent | Palo Alto Networks | Independent (TPG-backed) |
The row that decides most evaluations is deployment effort, and it is the one vendors talk about least.
What these actually cost
Neither vendor publishes enterprise pricing, so any number in a blog post is a guess. What is worth knowing is the shape of the cost.
The licence is usually the smaller part. With CyberArk, the bigger line is the infrastructure and the specialist time to deploy and run it. With Delinea, the licence is often a larger share of the total because there is less to build. Either way, the cost people forget is year two, when the implementation partner leaves and someone has to keep onboarding accounts.
Three questions to ask either vendor:
- What exactly is being counted: users, accounts, endpoints or servers?
- What is in the base platform, and what is a separate module?
- What does year two cost, including the people to run it?
If you are thinking of switching
Most people weighing this already run one of the two. Moving in either direction is a two-quarter project for a mid-sized estate. What gets underestimated:
- Re-onboarding every privileged account and rebuilding every rotation rule
- Rebuilding integrations: ticketing, SIEM, MFA, HR feeds
- Running both platforms in parallel, and paying for both
- Losing session history and audit evidence, or paying to migrate it
- Retraining every administrator
Before treating a stalled deployment as a product verdict, check whether it was ever finished. In most stalled environments we open, the vault is healthy and the problem is onboarding, rotation exceptions and unreviewed sessions. A new vendor does not fix any of that. It all follows you.
How to decide
Answer four questions honestly.
How complex is your estate? Mainframe, OT, network devices, heavy legacy and strict session-forensics requirements point to CyberArk. A mostly Windows, Linux and cloud estate does not need that depth.
Who runs it in eighteen months? A team of certified PAM specialists can get full value from CyberArk. One or two generalists will be better served by Delinea.
Is developer and infrastructure access a big part of the problem? If so, Delinea's StrongDM capability is worth a serious look. Test it live, not on slides.
Are you already on one of them? Then the real question is usually the renewal, not the platform. In most estates we open, a third of what is licensed is not switched on. That is often the whole negotiation.
If the answers do not point clearly one way, the difference will be decided by your implementation, not your licence. Put your energy into choosing the delivery partner. If neither fits your size, KeeperPAM and the wider field in CyberArk Competitors are the next places to look.
Frequently asked questions
Is Delinea better than CyberArk?
Neither is better across the board. CyberArk goes deeper in large, complex, regulated estates. Delinea is usually faster to deploy and easier for a small team to run. Both were Leaders in Gartner's 2025 PAM Magic Quadrant.
Is CyberArk now called Idira?
Yes, in effect. Palo Alto Networks completed its CyberArk acquisition in February 2026 and moved the portfolio under the Idira brand in May 2026. The Vault, CPM, PVWA and PSM components are unchanged, and both names are still in use.
Is Delinea the same as Thycotic?
Delinea was formed in 2021 from the merger of Thycotic and Centrify. Thycotic's Secret Server is still Delinea's core vault, and Centrify's technology underpins its Unix and Linux elevation.
Is Delinea cheaper than CyberArk?
Often the total cost is lower, mainly because there is less infrastructure to build and run. Neither publishes enterprise pricing, so compare total cost over three years, including the people to operate it, not just the licence quote.
Can Delinea replace CyberArk?
For many mid-sized organisations, yes. For estates with mainframe, OT or heavy session-forensics requirements, test those use cases first. Plan for a two-quarter migration either way.
What did Delinea's StrongDM acquisition add?
Just-in-time, proxy-based access to infrastructure such as databases, Kubernetes and cloud hosts, for both people and machine identities. The deal closed in March 2026.
What are the best CyberArk alternatives?
Delinea and BeyondTrust are the closest like-for-like options. KeeperPAM suits smaller organisations, and HashiCorp Vault, Teleport and StrongDM cover narrower jobs. Our CyberArk Competitors post compares them all.
Should we switch from CyberArk to Delinea?
Only if the platform is the problem. If the real issue is a stalled rollout or nobody to run it, switching makes it worse for about a year. Fix capacity first, then compare.
Where we come into it
We deploy and run CyberArk as a certified partner, and we work in mixed estates often enough to know where each platform hurts. We are not a licence reseller who disappears after signature. Our engineers stay through day two. If you are earlier than this and still working out the basics, what PAM actually is is the better place to start.
If you are weighing this up, we will spend 30 minutes walking your current setup with a certified engineer and tell you what we see, including if you should keep what you have. You get the findings in writing afterwards.
