CyberArk Secure Cloud Access

CyberArk Secure Cloud Access  is used primarily for secure administrator access to cloud consoles like the AWS  console, Azure  portal, and GCP  console without sharing permanent credentials. It allows for better passwords and passwordless access, temporary admin privileges, and full audit tracking. Just-in-Time privileged access is utilized when a cloud engineer needs temporary production access for maintenance or troubleshooting; access is granted for only an approved duration, which is automatically revoked once the work is done. Additionally, it manages DevOps and Kubernetes  access, provides third-party vendor access, and facilitates multi-cloud access governance for AWS , Azure , and GCP . It also caters to emergency situations such as break-glass access during critical production outages and assists in compliance and audit management, such as for SOC audits, while implementing Zero Trust security principles.

The best features of CyberArk Secure Cloud Access  include Zero Standing Privileges, which eliminates the need for permanent admin access by providing users with temporary access only when required, ensuring it automatically expires after task completion. This significantly reduces insider threats and credential misuse. In scenarios such as patch deployment in Azure, CyberArk grants admin access for just two hours after approval, which is revoked automatically once the activity is completed. Furthermore, it supports passwordless access, multi-cloud environments, and includes session monitoring that records privileged sessions to assist during audits and investigations, providing better compliance visibility. Agentless browser access is another significant feature, as it eliminates the need for VPN dependency, making operations easier for DevOps and cloud teams.

Role-based access control (RBAC) improves cloud security by providing access based on job roles and responsibilities, which helps reduce unauthorized access. For example, I provide full infrastructure management rights to cloud admins while offering limited access based on role specifications for DevOps engineers and read-only access for auditors. RBAC includes implementing least privileged security, thus preventing accidental changes and limiting the attack surface, ensuring only authorized users can modify sensitive resources. This improves compliance auditing through traceable access control, monitoring, and documentation.

There are several areas where CyberArk Secure Cloud Access could improve, such as the integration with enterprise IT ecosystems, including cloud platforms, SIEM  tools, ITSM  solutions, MFA systems, and DevOps platforms. While it improves operational efficiency and provides seamless user experiences, configuring policies can be complex, requiring skilled engineers. More guided deployment wizards, better automated onboarding templates, improved UI/UX experiences, simplified policy management, and enhanced reporting and troubleshooting would be beneficial.

I have been using CyberArk IdM and CyberArk Secure Cloud Access solutions for the last three years.

I would rate the product stability of CyberArk Secure Cloud Access around 9 to 10, noting its high scalability and reliability, especially in SaaS deployments. Although there can be upgrade complexities, the platform achieves strong uptime and stability amongst enterprise-level security.

Access control has improved by more than 20% with CyberArk Secure Cloud Access. With over 1,100 users utilizing this solution, I have eliminated the need for RDP access, ensuring that users can only access servers with the proper multi-factor authentication and manager approval, achieving complete coverage and reducing the risk of breaches.

I rate the technical support for CyberArk Secure Cloud Access as a 10.

The pricing for CyberArk Secure Cloud Access is quite high, especially the initial implementation cost, as it requires skilled engineers for deployment, configuration, and integration with various tools. The complex licensing structure involving user accounts, modules, features, and deployment types complicates cost estimation, making it seem expensive for smaller companies; however, it offers better value for larger enterprises. Additional service charges for architecture consulting and deployment support increase operational costs significantly.

When comparing CyberArk Secure Cloud Access with other solutions such as BeyondTrust, Delinea, and ManageEngine, I focus on security capabilities, Zero Trust architecture, cloud-native features, integration ecosystem, and deployment complexity. I find that CyberArk ranks high in PAM maturity, particularly with its advanced features such as Zero Standing Privileges and Just-in-Time access that surpass those of competitors. CyberArk also demonstrates exceptional compliance and audit capabilities and excels in multi-cloud support.

I use adaptive risk-based policies in CyberArk Secure Cloud Access, and while configuring these intelligent security policies, which dynamically adjust user access based on real-time risk analysis can be challenging, they significantly improve security. These policies evaluate user identity, device security, login location, time of access, user behavior risk score, and resource sensitivity to determine access permissions. For instance, if a cloud engineer typically logs in from the Hyderabad office during business hours but attempts to log in from an unmanaged device in another location, CyberArk blocks access and requests multi-factor authentication and manager approval before granting limited temporary access.

I assess the effectiveness of real-time monitoring in identifying threats in the environment by considering scenarios where an employee attempts to log in from a new location and needs manager approval. In such cases, multi-factor authentication is required, ensuring a second layer of security. This mechanism significantly reduces both insider and external threats in my usage of CyberArk Secure Cloud Access.

CyberArk Secure Cloud Access requires some maintenance, particularly for role-based access, future upgrades, patch management, and lifecycle management, which may involve minimal downtime. While skilled engineers and vendor support are needed during issues, it is generally designed to reduce operational overhead, benefiting from agentless access and cloud-native architecture, with regular maintenance tasks such as policy management and compliance auditing handled through the backend platform managed by CyberArk. I rate this solution a 9 overall.

I have been dealing with CyberArk Secure Cloud Access  for over three years now, and I have been working with CyberArk for 10 years plus.

I work with their CASB  solution, CyberArk Secure Cloud Access , and I am a certified deployer for CyberArk.

I use adaptive risk-based policies in CyberArk Secure Cloud Access to learn and understand the environment.

The use of dynamic role-based access controls in CyberArk Secure Cloud Access enhances my cloud security by helping not to prolong the access granting process. In other words, just-in-time access is very quick.

Integrating with existing IT ecosystems like AWS  or Azure  IAM  or Azure AD  helps streamline my administrative and compliance efforts when that is set up correctly.

I have been both a customer and reseller of CyberArk.

In CyberArk Secure Cloud Access, I find the central point where it is easy to access and easy to configure most valuable.

I assess the effectiveness of real-time monitoring in identifying potential threats as very important nowadays, noting the use of algorithms and large language models.

Comprehensive audit trails in CyberArk Secure Cloud Access have provided valuable insights, especially with suspected misuse of credentials.

When someone obtained a vendor's details and attempted to access them, with monitoring enabled, it was easy to see from which area it came from and then confirm with the user whether they were trying to access it or had forgotten something at that point in time.

In my perspective, I do not see much that could still be improved about CyberArk Secure Cloud Access. Depending on what is used to do the integration, looking at the requester's posture could be beneficial.

In the future for CyberArk Secure Cloud Access, I would like to see tokenization improved, where every connection gets a new token. Not in the sense of a connection token but more a certificate that encrypts the data and gets deleted.

I have been using CyberArk Secure Cloud Access for over three years now, and I have been using CyberArk for 10 years plus.

I rate the technical support as very good, so I give it a nine because I know a lot of the technicians.

I am not really working with Trellix that much anymore. It is more something like CrowdStrike.

I have not had experience with Falcon LogScale  by CrowdStrike yet.

When it comes to implementation, I usually refer to the physical implementation or the preparation to implementation.

Overall, I usually say it takes about three months at least for both preparation, implementation, and configuration because this helps to plan and understand the client's environment so that you do not forget something and also do not break connections or anything when you do the implementation.

In South Africa, everything is expensive, so there is always going to be environments where this is seen as a luxury product instead of an enabler.

I rate CyberArk Secure Cloud Access as also a nine, but I would like to see what happens with the Palo Alto acquisition.

I would generally recommend CyberArk Secure Cloud Access to others, but there are other good options, depending on what the client is looking for.

For companies in South Africa, I would not recommend CyberArk Secure Cloud Access for medium to small companies, but it also depends on what their security appetite is.

My overall rating for this review is nine.

My usual use cases for CyberArk Secure Cloud Access  involve primarily working on PAM, which is Privileged Access Management , and this generally helps us with admin and high-level account accessibility. We also use credential vaulting alongside its JIT, which is temporary access, and this has proven quite helpful for our needs.

The features of CyberArk Secure Cloud Access  that I find most valuable are the monitoring, recording, and auditing capabilities.

I find them valuable because both products are quite interchangeable, and the main feature we love is the temporary access. Secondly, it does not require sharing a password, which is really helpful. Additionally, PAM is the core strength of this product, and it provides a dashboard for continuous threat detection, which is quite helpful for taking action against threats.

The value of the insights provided by audit trails is significant for me since it allows checking user logins and accessibility, helping identify potential threats and block or restrict access from high-risk zones. It effectively tracks user login attempts, access requests, approvals, and policy changes, which are crucial for implementing recent policies.

CyberArk Secure Cloud Access provides a solid foundation overall, but the UI/UX might be challenging for less tech-savvy individuals. Something user-friendly that improves the interface and the initial setup process would enhance the experience. The technical documentation requires a high level of understanding about how CyberArk works, and this could be improved.

I have been working with CyberArk Secure Cloud Access for almost three to three and a half years.

I find CyberArk Secure Cloud Access quite stable. However, updates are not very frequent at times, yet it still performs well. The stability from a security perspective is quite good.

The scalability of CyberArk Secure Cloud Access is commendable, as most enterprises use it. From a scalability standpoint, I would rate it an eight out of ten.

I have communicated with the technical support of CyberArk Secure Cloud Access a couple of times.

My experience with CyberArk's technical support has been quite good. They are helpful and provide enterprise-level support with knowledgeable engineers and ample documentation, especially during setup and critical issue handling. Turnaround times may vary depending on the type of support.

I think adaptive risk-based policies are essential because when using any healthcare-related tool, the HIPAA-related compliance or SOC compliance will be completely different from the fintech platform. They definitely differ country-wise or region-wise, and whenever we use them for LATAM or the JPAC region, policy changes are necessary. There are three levels of risk that we configure: low risk for normal access, medium risk where we provide MFA, and high risk where we block that particular system or restrict the accessibility. This is how CyberArk works.

The effectiveness of real-time monitoring in identifying potential threats for my customers is really high because real-time threat detection is a helpful feature. It enables me to analytically check high-risk zones or systems and identify potential threats based on configured access, IP addresses, or analytical reports.

The use of dynamic role-based access controls enhances cloud security for my customers because dynamic roles are essential in current cybersecurity features. They assist in assigning roles dynamically based on user roles or groups configured for them, thus offering just-in-time privilege elevation that works directly with identity providers.

Integrating with existing IT ecosystems helps my customers streamline administrative and compliance efforts by configuring it with Microsoft Azure  Directory and providing SSO  for any external integrations. Azure  offers the highest level of security from Microsoft, and the integration areas include similar functionalities such as MFA, which significantly aid in connecting to VMs or managing cloud workloads.

The pricing of CyberArk Secure Cloud Access is relatively reasonable. It is not as expensive as other cybersecurity software, but it is also not cheap. For enterprises, paying a little more is acceptable, especially considering that one data leak can lead to significant financial problems, making the transparent and flexible pricing worthwhile. I would rate this product an overall eight out of ten.