JOB J4 · PRIVILEGED ACCESS
Privileged access tools: just-in-time access, vaults and secrets in an IAM stack
Short answer
Two vendors document this job in our sources: Apono and CyberArk (Idira, Palo Alto Networks). Seven more cover part of it. Our sources on privileged access are thinner than on the other jobs, so treat this page as a starting list and check each vendor's own pages before you shortlist.
What does this job include?
- An inventory of privileged accounts: admin, service and emergency accounts.
- Just-in-time grants that give admin access for a task and then remove it, instead of standing access.
- Vaulting and rotating credentials so people and scripts do not hold long-lived passwords.
- Secrets management for machines, pipelines and cloud workloads.
- Least privilege: only the access a task needs.
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
Who documents this job?
Just-in-time access for humans, machines and AI agents with automatic revocation and zero standing privilege; requests through Slack, CLI or Apono Assist; dynamic roles in AWS, Azure, GCP, Kubernetes and databases; Agent Privilege Guard with intent-based access control; audit logs and AI session summaries; 85+ integrations.
Source: Apono homepage · Read 11 Oct 2026
No pricing page on its own site (/pricing redirects to the home page). AWS Marketplace, 1-month contract: $4,900.00 per month commit for 100 users, plus $49.00 per month for each extra user.
Secrets Manager as SaaS or self-hosted, Conjur open source, and Secrets Hub for AWS Secrets Manager and Azure Key Vault; CyberArk says it can centrally rotate and manage credentials. Palo Alto Networks' Idira release names Traditional PAM, Modern PAM (with zero standing privilege and just-in-time access), Workforce Access, and Machine and AI Identity Security licence lines for existing CyberArk SaaS customers.
Source: CyberArk Secrets Management · Read 29 Sep 2026 · Source: Palo Alto Networks press release: Idira introduced · Read 11 Oct 2026
No prices stated in the Idira release or in our other sources.
Who covers part of it?
Privileged Access Management is listed on the pricing page and sold through sales, not as a line item in the plan table; feature detail is not in our sources.
Source: JumpCloud pricing · Read 27 Sep 2026
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Privileged Identity Management (PIM) needs Microsoft Entra ID Governance or Entra ID P2 licences, per Microsoft's licensing page; feature detail is not in our sources.
Source: Microsoft Learn: Entra ID Governance licensing fundamentals · Read 11 Oct 2026
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Privileged Access is listed in the Essentials suite on the pricing page; feature detail is not in our sources.
Source: Okta pricing · Read 27 Sep 2026
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Brings discovered applications under PAM control and reports privileged accounts it finds to Idira Privilege Cloud's Discovered Accounts queue, without sending credentials; it is not a credential vault.
Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Ping announced Privileged Access for Desktop Agents on 27 May 2026, with availability that may vary by product, region or deployment model.
Source: Ping Identity press release, 27 May 2026 · Read 27 Sep 2026
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.
Privileged access appears in the Saviynt Identity Platform product list, and its 2022 release notes say its cloud PAM auto-discovers Windows service accounts and Azure privileged accounts.
Source: Saviynt homepage · Read 27 Sep 2026 · Source: Saviynt blog: 2022 release wrap-up · Read 11 Oct 2026
Not published.
Non-human identity protection for AD and cloud service accounts: a behavioral baseline per account and virtual fences. Its Enterprise package adds Privileged Access Security with just-in-time access.
Source: Silverfort: non-human identity security · Read 29 Sep 2026 · Source: Silverfort pricing · Read 11 Oct 2026
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.
How do all 16 vendors read for this job?
| Vendor | J4Privileged access |
|---|---|
| Apono | Documented |
| C1 (formerly ConductorOne) | Not in our sources |
| CyberArk (Idira, Palo Alto Networks) | Documented |
| Google Cloud Identity | Not in our sources |
| JumpCloud | Partial |
| Lumos | Not in our sources |
| Microsoft Entra | Partial |
| Okta | Partial |
| Orchid Security | Partial |
| Ping Identity | Partial |
| Push Security | Not in our sources |
| SailPoint | Not in our sources |
| Saviynt | Partial |
| Semperis | Not in our sources |
| Silverfort | Partial |
| Veza | Not in our sources |
Standing access or just-in-time?
Standing access means an admin holds rights all the time, used or not. Just-in-time access grants the right when a task starts and removes it after. Apono describes just-in-time access to cloud resources. NIST defines least privilege as allowing only the access users need for their tasks; just-in-time is one way to apply it to admin rights.
Source: Apono homepage · Read 27 Sep 2026 · Source: NIST glossary: least privilege · Read 27 Sep 2026
Where do machine identities fit?
Service accounts, API keys and tokens are privileged too, and often outlive the people who created them. The OWASP Non-Human Identities Top 10 lists improper offboarding (NHI1), secret leakage (NHI2), overprivileged non-human identities (NHI5) and long-lived secrets (NHI7) among its risks. CyberArk describes rotating and managing these credentials; Silverfort describes baselines and virtual fences for service accounts; SailPoint completed its acquisition of Entro Security, which secures non-human identities, secrets and tokens, on 29 June 2026.
Source: OWASP Non-Human Identities Top 10 · Read 29 Sep 2026 · Source: CyberArk Secrets Management · Read 29 Sep 2026 · Source: Silverfort: non-human identity security · Read 29 Sep 2026 · Source: SailPoint press release: Entro Security acquisition closed · Read 27 Sep 2026
What is missing from our sources?
We read CyberArk's secrets management page, Palo Alto Networks' Idira launch release and Apono's home page, not full privileged access management product pages. Microsoft documents that Privileged Identity Management needs Entra ID P2 or ID Governance licences, but its feature detail is not in our sources. Okta's Essentials suite lists Privileged Access, Silverfort's Enterprise package adds Privileged Access Security with just-in-time access, and Ping announced Privileged Access for Desktop Agents in May 2026.
Source: CyberArk Secrets Management · Read 29 Sep 2026 · Source: Palo Alto Networks press release: Idira introduced · Read 11 Oct 2026 · Source: Apono homepage · Read 11 Oct 2026 · Source: Microsoft Learn: Entra ID Governance licensing fundamentals · Read 11 Oct 2026 · Source: Okta pricing · Read 27 Sep 2026 · Source: Silverfort pricing · Read 11 Oct 2026 · Source: Ping Identity press release, 27 May 2026 · Read 27 Sep 2026
Frequently asked questions
Does Okta include privileged access?
Okta's pricing page lists Privileged Access in the Essentials suite at $17 per user per month, billed annually. The feature detail is not in our sources, so it shows as Partial.
What is just-in-time access?
Access that is granted when a task needs it and removed when the task ends, so nobody holds admin rights they are not using. It is the model Apono describes for cloud resources.
Why do so few vendors show as documented?
Because our sources for this job are limited. A missing vendor or a Partial status here means we did not read a page that describes the feature, not that the product lacks it.
Read next