IT AI Index
Index › Identity and access › PAM › Enterprise › September 2026 Edition

Privileged access management for enterprise buyers

Asked as “privileged access management platform”, and as “PAM tool”, on behalf of an enterprise B2B company. 38 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
CyberArk
Clear leader
58% of first choices, clear leader.
ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessKeeperPAM27%ContestedStanding →Mid-marketManageEngine PAM36021%ContestedStanding →EnterpriseCyberArk58%Clear leaderThis page

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01CyberArk58%25%53endorsed leader
02Delinea16%12%50accepted challenger
03One Identity Safeguard3%0%11accepted challenger
04KeeperPAM3%33%15criticized challenger
05ManageEngine PAM3603%36%14criticized challenger
Show the three products at 0%, ordered by negative rate
08HashiCorp Vault0%64%11criticized challenger
06BeyondTrust0%17%52accepted challenger
07WALLIX0%9%11accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
ManageEngine PAM360 vs DelineaManageEngine PAM360 vs Securden Unified PAMDelinea vs Securden Unified PAM

One product takes 58% of first choices here, so the chart would put seven markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Three products carry a negative rate above 25% in this category. Jump to the standing

02What they warned about

Eight of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Llama 4 Maverick and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CyberArk
25%
13 of 53 labels negative · 8 of 12 models · 2 hard negative
“Platforms to Avoid for Predictable Costs | **CyberArk** | $1,800–$12,000 per user/year; modular pricing” Kimi K2, budget prompt
BeyondTrust
17%
9 of 52 labels negative · 7 of 12 models · 3 hard negative
“High Caution: Major Vendors with Recent Serious Security Incidents ... BeyondTrust ... December 2024 nation-state breach” Kimi K2, negative prompt
HashiCorp Vault
64%
7 of 11 labels negative · 5 of 12 models · 3 hard negative
“Tools designed for SSH/DevOps secrets (like raw Vault or Teleport) often lack the governance, workflow approval, and audit trail depth” DeepSeek V4 Flash, negative prompt
ManageEngine PAM360
36%
5 of 14 labels negative · 5 of 12 models · 3 hard negative
“frequently cited in reviews for scalability limits in large deployments (e.g., session bottlenecks, high resource usage)” Grok 4.1 Fast, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

64 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 877 links across 202 sites, every framing counted. Ranked by the number of answers carrying the site or page.

startwithidentity.com
35 answers · 61 citations · 11 models
netwrix.com
vendor site · Netwrix29 answers · 32 citations · 10 models
expertinsights.com
vendor site · Expert Insights29 answers · 29 citations · 9 models
gartner.com
21 answers · 27 citations · 9 models
cybervendorguide.com
20 answers · 25 citations · 8 models
heimdalsecurity.com
vendor site · Heimdal Security19 answers · 22 citations · 9 models
delinea.com
vendor site · Delinea18 answers · 38 citations · 7 models
tech-insider.org
17 answers · 17 citations · 7 models
oneidentity.com
vendor site · One Identity15 answers · 19 citations · 8 models
zluri.com
vendor site · Zluri14 answers · 15 citations · 8 models
decryptiondigest.com
13 answers · 24 citations · 6 models
compliancestronghold.com
13 answers · 13 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

expertinsights.com/identity-and-access-management/the-top-privileged-access…
27 answers · 9 models
startwithidentity.com/rankings/best-pam-for-enterprises
27 answers · 9 models
netwrix.com/en/resources/blog/pam-solutions
26 answers · 10 models
cybervendorguide.com/guides/privileged-access-management
18 answers · 8 models
heimdalsecurity.com/blog/privileged-access-management-pam-software-solutions
18 answers · 9 models
tech-insider.org/cyberark-vs-beyondtrust-vs-delinea-pam-2026
17 answers · 7 models
gartner.com/reviews/market/privileged-access-management
16 answers · 8 models
startwithidentity.com/rankings/best-pam-tools
16 answers · 8 models
oneidentity.com/learn/top-5-privileged-access-management-tools-in-2025.aspx
14 answers · 8 models
compliancestronghold.com/best-pam-solution
13 answers · 8 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best privileged access management platform for an enterprise B2B company?”Paraphrase“Which PAM tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade privileged access management platforms and how do they differ?”Budget-constrained“What is the best privileged access management platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a privileged access management platform. What should we look at?”Negative“Which privileged access management platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceCyberArkChanged
Three alternativesBeyondTrust, Delinea, One Identity Safeguard
CyberArk
Four alternativesBeyondTrust, Delinea, Netwrix Privilege Secure, One Identity Safeguard
Delinea, Securden Unified PAM
One alternativeStrongDM
against: CyberArkno first choicenothing named
GPT-5.4 miniCyberArk
Two alternativesBeyondTrust, Delinea
CyberArkHeld
Three alternativesBeyondTrust, Delinea, Microsoft Entra Privileged Identity Management
CyberArk
Two alternativesBeyondTrust, Delinea
against: Microsoft Entra Privileged Identity ManagementDelineaagainst: BeyondTrustno first choicenothing named
Gemini 3.5 FlashIdira
Four alternativesBeyondTrust, Delinea, KeeperPAM, Saviynt
CyberArkChanged
Three alternativesBeyondTrust, Delinea, KeeperPAM
Idira
Four alternativesBeyondTrust, Delinea, KeeperPAM, Saviynt
ManageEngine PAM360
Two alternativesDevolutions Server, JumpServer
against: CyberArk, KeeperPAMno first choice
Four alternativesBeyondTrust, Delinea, StrongDM, Teleport
against: CyberArk Privileged Access Manageragainst: CyberArk, Delinea, Devolutions, Doppler, HashiCorp Vault, Infisical, KeeperPAM, ManageEngine PAM360, Securden Unified PAM, Symantec Privileged Access Manager
Perplexity SonarCyberArk
Four alternativesBeyondTrust, Delinea, One Identity Safeguard, WALLIX
CyberArkHeld
Three alternativesBeyondTrust, JumpCloud, Saviynt
CyberArk
Seven alternativesBeyondTrust, Delinea, ManageEngine PAM360, Microsoft Entra Privileged Identity Management, One Identity Safeguard, Saviynt, WALLIX
Securden Unified PAM
One alternativeJumpServer
against: CyberArkno first choiceagainst: ARCON PAM, Admin By Request, Devolutions, HashiCorp Vault, Heimdal, KeeperPAM, ManageEngine PAM360, Microsoft Entra Privileged Identity Management, Okta Privileged Access, Ping Identity, Securden Unified PAM, Teleport, ThreatLocker, WALLIX
Grok 4.1 FastCyberArk
Two alternativesBeyondTrust, Delinea
CyberArkHeld
Two alternativesBeyondTrust, Delinea
CyberArk Privileged Access Manager
Three alternativesBeyondTrust, Delinea, One Identity Safeguard
Delinea
Two alternativesManageEngine PAM360, StrongDM
against: BeyondTrust, CyberArkCyberArk
Three alternativesBeyondTrust, Delinea, HashiCorp Vault
against: ARCON PAM, HashiCorp Vault, Hitachi ID Systems, ManageEngine PAM360, Netwrix, Okta Privileged Access, One Identity, Symantec Privileged Access Manager
Mistral SmallCyberArk
Two alternativesBeyondTrust, Delinea
CyberArkHeldCyberArk
Four alternativesBeyondTrust, Delinea, One Identity Safeguard, WALLIX
CyberArkagainst: BeyondTrust, Delineano first choiceagainst: ARCON PAM, CyberArk Privileged Access Manager, Delinea Secret Server, Symantec Privileged Access Manager
DeepSeek V4 FlashCyberArk
Two alternativesBeyondTrust, Delinea
against: KeeperPAMCyberArkHeld
Two alternativesBeyondTrust, Delinea
CyberArk
Three alternativesBeyondTrust, Delinea, One Identity Safeguard
against: HashiCorp Vault, SaviyntDelinea
One alternativeKeeperPAM
against: CyberArk, ManageEngine PAM360, Teleportno first choiceagainst: BeyondTrust, CyberArk, Delinea, HashiCorp Vault, Hitachi ID Systems, ManageEngine PAM360 / Password Manager Pro, OpenBastion, Teleport
Llama 4 Maverickno first choiceCyberArkChangedCyberArk
Four alternativesBeyondTrust, Delinea, One Identity Safeguard, WALLIX
CyberArk Privileged Access Manager
Two alternativesManageEngine PAM360, Safeguard
CyberArk Privileged Access Manager
Three alternativesBeyondTrust, Delinea, Teleport
nothing named
Qwen 3.7 FlashCyberArk
Three alternativesBeyondTrust, HashiCorp Vault, Microsoft Entra ID
CyberArkHeld
Two alternativesDelinea, Microsoft Entra Privileged Identity Management
CyberArk
Five alternativesBeyondTrust, Delinea, Microsoft, One Identity, WALLIX
KeeperPAM
Two alternativesDelinea, StrongDM
against: CyberArkDashlane Thycotic
Two alternativesBeyondTrust, Microsoft Entra PIM / Cloud App Security
against: CyberArkagainst: BeyondTrust, CyberArk, Delinea, ManageEngine PAM360, Microsoft Entra Privileged Identity Management
Kimi K2CyberArk
Two alternativesBeyondTrust, Delinea
CyberArkHeld
One alternativeBeyondTrust
against: DelineaCyberArk
Four alternativesBeyondTrust, Delinea, HashiCorp Vault, StrongDM
Delinea
Two alternativesManageEngine PAM360, StrongDM
against: BeyondTrust, CyberArk, HashiCorp Vaultno first choiceagainst: BeyondTrust, CyberArk, Delinea, HashiCorp Vault
GLM 4.7 FlashXCyberArk, One Identity Safeguard
Two alternativesBeyondTrust, Delinea
CyberArk Privileged Access ManagerChanged
Two alternativesBeyondTrust, Delinea
CyberArk
Four alternativesBeyondTrust, Delinea, One Identity Safeguard, WALLIX
Delinea
Three alternativesJumpCloud, KeeperPAM, Okta
against: BeyondTrust, CyberArkno first choiceagainst: BeyondTrust, Delinea Secret Server, Fortra Core Privileged Access Manager, Heimdal Security, KeeperPAM, One Identity SecretServer, Securden Unified PAM
MiniMax M2.5CyberArk
Two alternativesBeyondTrust, Delinea
CyberArkHeld
Two alternativesManageEngine PAM360, Safeguard
CyberArk
Three alternativesBeyondTrust, Delinea, Saviynt
no first choiceno first choicenothing named
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:24no05 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:13yes56 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:22yes1522 s
Direct recommendationPerplexity Sonarsonar2026-09-17 12:57yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:46yes3417 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 13:35yes107 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:02yes1011 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:08yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:12no037 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:59yes1036 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:54yes1641 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:04yes1034 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:54yes99 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:31yes56 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:45yes1124 s
ParaphrasePerplexity Sonarsonar2026-09-17 13:17yes166 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:19yes198 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 14:10yes53 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:50yes814 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:25yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 14:15yes515 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:22yes1029 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:15yes2330 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:12yes517 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:11yes1419 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:53yes68 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:48yes2629 s
ComparativePerplexity Sonarsonar2026-09-17 14:06yes2010 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:43yes2615 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 09:22yes55 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:52yes1629 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:59yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:33yes530 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:44yes934 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:49yes1560 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:56yes2554 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:00yes1714 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:57yes45 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:45yes1636 s
Budget constrainedPerplexity Sonarsonar2026-09-17 09:44yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:26yes4022 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 12:59yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:45yes2628 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:44yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:08yes1079 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:01yes2345 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:00yes2288 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:51yes1891 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:36yes1813 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:53no07 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:57yes1130 s
Scale constrainedPerplexity Sonarsonar2026-09-17 10:18yes2010 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:27yes1613 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:32no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:38yes2925 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:14yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:52no044 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:49yes2453 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:15yes1555 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:27no065 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:27yes169 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:35no06 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:06yes1327 s
Negative framingPerplexity Sonarsonar2026-09-17 12:01yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:54yes2514 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 12:18yes1511 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:32yes3050 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:57yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:22yes2074 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:16yes2952 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:33yes24333 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:09no011 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
ARCON read as ARCON PAM
Broadcom (Symantec PAM) read as Symantec Privileged Access Manager
Keeper Business read as KeeperPAM
Keeper Security read as KeeperPAM
Keeper Security (KeeperPAM) read as KeeperPAM
Keeper Security Enterprise read as KeeperPAM
Securden read as Securden Unified PAM
Unresolved, counted raw
Dashlane Thycotic
ManageEngine PAM360 / Password Manager Pro
Microsoft Defender for Identity + PIM
Microsoft Entra PIM / Cloud App Security
Microsoft Privileged Access Workstation (PAW)
One Identity SecretServer
OpenBastion
SailPoint Privileged Access Management
Discontinued, still offered
No shut-down product was recommended here.

Also in identity and access

The other categories of this function, with the leader in each.
← MFASecrets →