Safeguard for Privileged Passwords

My main use case for One Identity Safeguard  is to specifically secure, control, and monitor the privileged accounts across our critical systems. We use this to secure password vaulting for privileged and service accounts, control the privileged access to servers, databases, and network devices, session monitoring and recording for audits and compliance purposes, and meet compliance requirements. We often use it to reduce the risk of potential misuse while maintaining visibility and governance over the privileged access.

We use One Identity Safeguard  to manage the privileged access to our production Linux and Windows servers. All admin credentials are stored in Safeguard's password vault and users authenticate through Safeguard instead of knowing their actual passwords. When an admin needs access, they request the privileged access through Safeguard, and then Safeguard grants them time-bounded access, with the session proxied and recorded for auditing. Once the session ends, the password is automatically rotated.

One Identity Safeguard has impacted our organization in a positive way. Since implementing One Identity Safeguard, we have seen several noticeable improvements across security, compliance, and operations.

It has reduced the security risks, as privileged credentials are no longer shared or exposed with others, and automated password rotation has significantly lowered the risk of credential misuse. It also improves visibility and accountability. Session recordings and detailed audit logs make it easy to trace who accessed what, when, and why. This has been especially valuable during our audits and investigations. The operational efficiency of automating password management and access workflow has reduced the manual efforts for the IT and security teams.

We have noticed positive metrics after using Safeguard. The automated password rotation replaced our manual password changes for admins and service accounts, saving us three to four hours per day. We no longer need to save this time manually, resulting in a significant amount of time saved for system and security teams and eliminating the coordination emails and spreadsheets. It provides faster onboarding and offboarding for admins. Once roles and policies were defined, granting or revoking privileged access became a policy change rather than multiple manual updates across systems. It has also reduced the audit preparation efforts. Session recordings, access logs, and reports are readily available. Audit evidence that previously took days to compile can now be generated in hours or minutes.

We use One Identity Safeguard as a central control point for all our privileged access, which helps standardize the access policies across teams and platforms. We also use it for the approval workflows, which are enforced for high-risk systems and add an extra security layer for production access.

I have been using it for one and a half years. The best feature I appreciate is the session proxying and recording. It provides transparent session access for admins without exposing the real passwords. Another valuable feature is automated password rotation, which changes the credentials automatically after each use or on a schedule. It reduces the risk of leakage and reuse of passwords. Additionally, the approval workflow and the access request feature add governance with multi-level approvals for sensitive systems. These are the features that I appreciate the most.

When we started using the session proxying and recording features, overall, it was a manageable and fairly smooth process for us. However, like most security platform deployments, it had a few learning curves. Session proxying and recording worked with our major systems including Windows, Linux, and network devices with minimal configuration.

Some devices and services required slight changes to firewall rules and configuration to ensure the proxy could connect cleanly. Additionally, our admins needed orientation so they understood they were joining a recorded session, particularly for remote or support use. We spent considerable time adjusting the session filtering, retention settings, and naming conventions so recordings were useful and not overwhelming. These are some areas where we encountered challenges.

The user interface and navigation can be improved. Some workflows, particularly the reporting, session review, and policy configuration could be more intuitive. New users often need time to get comfortable with where things are located.

The initial setup can also be better. Deploying One Identity Safeguard in large or hybrid environments can require careful planning and tuning, so more guided setup or templates would speed up the onboarding.

In very high-volume environments, session indexing and retrieval can sometimes feel slow, particularly when searching historical recordings.

I have been using One Identity Safeguard for one and a half years.

One Identity Safeguard is quite stable. We have seen minimum downtime since deployment, and routine maintenance has been straightforward. The session proxying, password vaulting, and automated workflow run consistently even under high load. Applying the updates has been predictable with no major disruption in ongoing operations. The integration stability, connections to Active Directory, cloud targets, and DevOps pipelines have remained solid and dependable.

One Identity Safeguard is quite scalable and stable in performance. Safeguard handles a growing number of users, systems, and sessions without significant degradation in performance. The virtual appliance and on-demand cloud version allow the environment to expand easily as infrastructure grows. Access policies, approvals, workflows, and session recording rules can be extended to additional systems and users without major configurations. It works well across hybrid and multi-cloud environments, making it suitable for organizations with geographically distributed infrastructure.

The customer support is very good. Whenever we encountered any problem or issue, they are ready to help us.

Before using Safeguard, we evaluated accounts from CyberArk and Thycotic Secret Server , as well as a previous PAM solution. We switched because of the complexity and usability of those solutions. The previous solution required significant manual efforts to manage the privileged credentials and lacked intuitive session monitoring. There were limited integrations and it did not easily integrate with our cloud environment, DevOps pipelines, or RPA  workflows, which was increasingly important for our operations. That is why we chose One Identity Safeguard.

One Identity Safeguard is a mature, reliable, and secure PAM solution that has significantly improved our privileged access management, compliance, and operational efficiency. While there is a learning curve for admins and users, continuous improvement in usability, reporting, and integration would make it even stronger. As it stands, it provides excellent security, visibility, and peace of mind.

We have seen return on investment after using Safeguard. We have saved approximately seven hours per week by automating the password rotation and access approvals, which has freed the IT security teams to focus on higher-value tasks. It has also reduced the manual efforts. Preparing audit evidence now takes only hours instead of days, reducing both internal labor cost and external audit time.

One Identity Safeguard is positioned as an enterprise-grade solution, so the license is not the cheapest in the market, but it reflects the value and security capabilities provided. Initial deployment costs were moderate, mostly tied to planning, virtual appliance resources, and some consulting support for policy configuration. There were no hidden costs beyond the standard licensing and support.

We evaluated CyberArk and Thycotic Secret Server  before selecting One Identity Safeguard.

My team and I have been using Safeguard for a considerable time, and the positive feedback I received from them is that they appreciated the automated access workflow. The session proxying and recording gives them the confidence that actions are secure while still letting them work efficiently. Admins appreciate the centralized password vault because it removes the hassle of remembering or sharing passwords.

One Identity Safeguard is a robust, enterprise-grade PAM solution with excellent security and governance capability. The reason it deserves a rating of eight out of ten is because of its robust features and capabilities. However, it does not receive a higher rating due to user interface complexity, reporting limitations, setup and scaling efforts, and integration could be deeper.

I would strongly recommend One Identity Safeguard for enterprises managing privileged access. If an organization needs strong control over admin accounts, session monitoring, and compliance, Safeguard is a robust choice. For deployment and onboarding, the solution is reliable and feature-enriched, so organizations need to take time to plan the initial setup, policy configuration, and user onboarding to get the most out of it. Organizations can expect a learning curve as admins and users may need training to adapt to approval workflows, session recording, and just-in-time access.

I provide One Identity Safeguard a rating of eight out of ten.

My main use case for One Identity Safeguard  is using only one module for privileged session, which we use for admins and contractors.

A quick specific example of how my team uses One Identity Safeguard  day-to-day is that we use only the second part for our contractors, not for admins in our company, but for companies that help us perform admin work and support our system.

The best features One Identity Safeguard offers include video recordings to help us control our support risks.

Accessing and reviewing those recordings when needed is easy, and there are no problems with recording or reviewing.

One Identity Safeguard has positively impacted my organization by helping us manage risk. We have this product as Balabit, which is a good product that is very light and helps us check or assist with our needs.

One Identity Safeguard could be improved with a password manager and an identity manager as one big access management system.

I believe improvements could be made around integrating with other tools.

I have been using One Identity Safeguard for eight years.

I rated One Identity Safeguard nine out of 10 because the stability and control could be better, as there are some problems with stability and errors when we use it.

As my organization grows or my needs increase, it is easy to add more users or expand the use of One Identity Safeguard, and that experience has been good.

I would rate the customer support for One Identity Safeguard as eight on a scale of one to ten.

I did not previously use a different solution before One Identity Safeguard.

The deployment of One Identity Safeguard solution took one or two days.

The deployment affected my privileged users in a way that was pretty smooth.

Before choosing One Identity Safeguard, I evaluated other options based on simplicity, price, and functionality.

Feedback from users regarding One Identity Safeguard's usability and functionality is that it is a good product and very simple to use.

My advice for others looking into using One Identity Safeguard is that it is a great solution for simple tasks, with a good price and good functionality.

My company does not have a business relationship with One Identity Safeguard vendor other than being a customer.

I rated this review nine out of ten.

Our main use case for One Identity Safeguard  is to integrate it to clients that need the SPP functionality, which stands for Safeguard for Privileged Passwords . They do say that we could utilize One Identity Safeguard  to its full extent for now, but we're getting there.

A quick specific example of how we use One Identity Safeguard with a client is that our latest client needed a password vault, so at first, we integrated One Identity Safeguard for Privileged Passwords, and then they asked for a personal vault so they could store their passwords and secrets, much like KeePass, so we integrated One Identity Safeguard Personal Vault as well. Lastly, they figured at some point down the line that they needed SPS as well, but only the primitive version of it, so we just decided to integrate SPS as well and form it into a cluster with SPP, but they don't use any third-party plugins as of now.

The best feature One Identity Safeguard offers is that it is a pretty new, modern tool that makes extensive use of its API. In general, it's easier than other tools to just perform maintenance work or perform work using the API of One Identity Safeguard. Also, the way that the access requests are structured—with entitlements and access request policies—makes it easier to govern data and identities. CyberArk, which is essentially the industry standard right now, is doing a very primitive job of helping the administrator with the task, and One Identity Safeguard is a lot better at this.

These features help my team day-to-day by making onboarding new users easier, and they also make it easier to create existing teams that are complete with their own password management, their own password profiles and rotations, password requirements, and who gets access to what, so it all makes it easier and faster.

One Identity Safeguard has positively impacted my organization by being another tool that we have in our arsenal to be able to get other clients as well, because we also sell One Identity IAM , and we can just bundle One Identity Safeguard with it. It also has a nice feature called remote access, which a lot of people want to use for externals in their organization, coupled with its just-in-time requisition, so it makes selling it much easier because One Identity is a company that's been in the field for ages.

One Identity Safeguard can be improved by fixing the documentation, which is very convoluted as of now, and addressing versioning, as some major bugs and issues are not documented well enough in the documentation, along with some patches and fixes. Custom plugins need to be introduced as soon as possible.

I give it an eight because it's a nice tool and it's a modern tool, but there are still some issues, not necessarily pertaining to the tool itself, but to the whole philosophy of One Identity and how they have structured their workflows and their knowledge base, which essentially has no knowledge base, just like CyberArk. There are some issues that need to be fixed, plus it does not have a custom option, and a lot of clients are using in-house made applications that also need to be onboarded to One Identity Safeguard to be able to launch a browser session to that application, which One Identity Safeguard has not had any capabilities that could assist with that.

I have been using One Identity Safeguard for two and a half years, ever since we pivoted from CyberArk, as we wanted to be more tool-agnostic, and we decided that One Identity Safeguard was our best option because we had a past with One Identity, with us being in an IAM  team.

One Identity Safeguard is stable.

So far, we haven't had any issues with One Identity Safeguard's scalability; it's been fine, but we generally target smaller to mid-sized implementations.

The customer support for One Identity Safeguard is fine for what it is, even though everything needs to be run through them and there are no knowledge bases, so we have to wait for a response from the One Identity Safeguard company, and they also keep a lot of information, requiring us to make a request and then they would need to reply, but it's acceptable overall. It's not the worst I've seen.

I previously used CyberArk before switching to One Identity Safeguard.

The deployment of the solution takes about two to four weeks, give or take, but that's not counting waiting for the client to respond and all that.

About a month of training is required for end-users, and for us, it was four months to understand One Identity Safeguard, but that was because we already had experience in other PAM tools like CyberArk.

We are partners, executive partners, and resellers with this vendor.

My experience with pricing, setup cost, and licensing has been a good experience overall, as the back and forth with One Identity is something that is acceptable; other tools have options to do this automatically, and they have it, but pricing, presales, and sales is acceptable overall.

Before choosing One Identity Safeguard, I evaluated Zero Trust and Delinea, but they were for smaller organizations, so we decided to adopt One Identity Safeguard.

My advice to others looking into using One Identity Safeguard is to get familiar with the concepts of entitlements and access request policies, the keywords One Identity Safeguard uses, and also get familiar with the way that it handles session management and recording because it's a tool that needs a lot of time to get accustomed to. I give One Identity Safeguard an overall rating of eight out of ten.