What is CyberArk EPM?
CyberArk EPM — Endpoint Privilege Manager — removes standing local-admin rights from laptops and servers and grants elevation only for approved actions. It's the module that closes the gap most PAM programs leave open: users who still run as admin on their own machine. It also blocks and contains ransomware by stopping unapproved executables from running with privilege. We deploy it in audit-first mode so you can see what would break before you enforce anything.
What's the difference between the CyberArk Vault and Privilege Cloud?
Same core capability, different hosting model. The self-hosted Vault (with CPM and PVWA) runs in your own data centre or cloud tenancy and you own the infrastructure. CyberArk Privilege Cloud is the SaaS version — CyberArk runs the vault infrastructure, you consume it as a service, and rollout is faster because there's no hardware to stand up. We deliver both and help you pick based on your compliance, latency, and operational constraints.
What does CyberArk PSM do?
CyberArk PSM — Privileged Session Manager — brokers privileged sessions so admins never hold the actual credential. The connection is proxied, isolated from the endpoint, and fully recorded, which gives you an audit trail and a kill switch for every privileged session. It's also how secure remote and third-party access is done properly, without VPNs and shared passwords.
Is CyberArk Conjur the same as Secrets Manager?
Conjur is the secrets-management engine inside CyberArk's Secrets Manager offering. It takes application, DevOps, and machine-to-machine credentials out of code, config files, and environment variables, and issues them at runtime with rotation and policy. If your developers are hard-coding API keys or storing secrets in a repo, this is the module that fixes it.
Do we need every CyberArk module?
No — and buying all of it at once is how deployments stall. Most environments start with the Vault (or Privilege Cloud) and PSM to get privileged credentials and sessions under control, then add EPM for endpoint least privilege and Conjur for secrets once the foundation is stable. We scope the modules to your actual risk rather than the full price list.
Can you add a CyberArk module to an existing deployment?
Yes — that's a common engagement. If you already run the Vault and want to add PSM, EPM, or Conjur, we assess what's live, confirm the integration points, and roll the new module out in waves without disrupting what's already working.
Who actually delivers the CyberArk modules?
Certified CyberArk delivery engineers, hands-on — not a reseller handing you a license. We've done the Vault installs, PSM hardening, EPM rollouts, and Conjur integrations. If you want the full end-to-end engagement rather than a single module, see our CyberArk implementation and delivery page.
