BeyondTrust deployments that rotate credentials without breaking things.
We implement and upgrade BeyondTrust Password Safe, Privileged Remote Access and Endpoint Privilege Management. Upgrades get planned before support ends, and Password Safe 24.3.x drops out at the end of December 2026.
Cohash implements and upgrades BeyondTrust privileged access products, including Password Safe, Privileged Remote Access, Endpoint Privilege Management and the Pathfinder platform.
We onboard accounts, tune rotation, set up vendor access and remove local admin rights. With Password Safe 24.3.x support ending in December 2026, we plan upgrades to 26.x now, and we track BeyondTrust's AI Agent Security module, in private beta since mid-2026.
you probably need this if
Password Safe is on 24.x and the December 2026 end of support is already on the risk register.
Vendors come in over VPN on a shared account, and afterwards nobody can play back what they did.
Local admin rights came back after the last removal attempt flooded the helpdesk.
terms on this pageService accountdefinitionA non-human account that software signs in with. Shared ones tend to pick up years of extra permissions.explained in a field note →
30 Jun 2026AI Agent Security for Pathfinder (private beta) Endpoint controls for agents such as Claude Code, Microsoft Copilot, Cursor and OpenAI Codex. Sold first as an add-on to Endpoint Privilege Management. source ↗
Sep 2026BeyondInsight and Password Safe 26.3 Latest listed release. 26.2 shipped in July 2026 and 26.1 in April 2026. source ↗
today · Oct 22, 2026
Dec 2026aheadPassword Safe 24.3.x end of support Support ends on the last day of December 2026. Password Safe 24.2.x already went out of support in September 2026. source ↗
the story · beyondtrust estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your BeyondTrust estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · beyondtrust estate3 open
openPassword Safe is on 24.x and the December 2026 end of support is already on the risk register.
recurringVendors come in over VPN on a shared account, and afterwards nobody can play back what they did.
blockedLocal admin rights came back after the last removal attempt flooded the helpdesk.
Production is on a supported 26.x release with the integrations tested.
Nobody on a standard account has local admin now, and elevation goes by written rules.
Upgrade runbook from 24.x to 26.x with timed rehearsal results
Service account dependency map, showing the services, tasks and app pools that use each…
chapter 01 · where it hurts
Why teams reach out
Password Safe is on 24.x and the December 2026 end of support is already on the risk register.
Vendors come in over VPN on a shared account, and afterwards nobody can play back what they did.
Local admin rights came back after the last removal attempt flooded the helpdesk.
chapter 02 · what we change
How we solve it
Password Safe implementation and upgrades
Privileged Remote Access
Endpoint Privilege Management
Service account discovery and rotation
AI agents on endpoints
Health checks
chapter 03 · how it runs
Our approach
Health check
Upgrade plan
Service account mapping
Vendor access through PRA
EPM rollout and handover
chapter 04 · where you end up
What changes
Production is on a supported 26.x release with the integrations tested.
Nobody on a standard account has local admin now, and elevation goes by written rules.
Upgrade runbook from 24.x to 26.x with timed rehearsal results
Service account dependency map, showing the services, tasks and app pools that use each account
what we do
Our BeyondTrust work
6 kinds of BeyondTrust work, each run by engineers who have done it on live tenants.
Managed systems, accounts and rotation policies configured, with upgrades from 24.x and 25.x to current releases rehearsed before the production window.
Vendor and admin access through jump points, with credentials injected from Password Safe so nobody sees the password.
Local admin rights removed from workstations, with application control policies built from what people actually run.
Service accounts mapped to the services and scheduled tasks that use them before rotation is switched on.
A review of the coding agents and assistants running on your endpoints, and a pilot plan for BeyondTrust's AI Agent Security module where it fits.
A review of rotation failures, session policies and stale accounts, with a ranked list of fixes.
capability 01 / 06in production
Password Safe implementation and upgrades
Managed systems, accounts and rotation policies configured, with upgrades from 24.x and 25.x to current releases rehearsed before the production window.
We pieced these together from BeyondTrust situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Password Safe 24.3 with a December deadline and no test instance
composite · not a client story
Beforethe situation
Password Safe runs 24.3.x with about 6,000 managed accounts on a single production appliance. There is no test instance, two integrations call the API from old scripts, and support ends on the last day of December 2026.
What we dothe work
We build a test instance from a recent backup, upgrade it to 26.3 and time each step. The API scripts run against it and get fixed where they fail. Then the production window is booked with a rollback point and a post-upgrade checklist for rotation and sessions.
Afterwhere you end up
Production is on a supported 26.x release with the integrations tested. Next time, the team starts from a rehearsed runbook and not from nothing.
case file 02
Local admin removal that failed once and was never tried again
composite · not a client story
Beforethe situation
The last attempt to strip local admin rights from 8,000 Windows laptops swamped the helpdesk within a week and got rolled back. Since then, developers have started running coding agents like Claude Code and Cursor with admin rights.
What we dothe work
Endpoint Privilege Management runs in audit mode only for a few weeks. We write the elevation rules from what people actually ran, then roll out department by department, starting with the one that has the fewest elevated apps. Developer machines get an AI Agent Security pilot next to the EPM policies.
Afterwhere you end up
Nobody on a standard account has local admin now, and elevation goes by written rules. The agents developers run sit under a policy that someone owns.
approach
How a BeyondTrust engagement runs
We don't start a step until the last one has produced something you can check.
step 01
Health check
We go through BeyondInsight and Password Safe versions, managed systems, rotation failures, session policies and stale accounts, and put the fixes in order.
step 02
Upgrade plan
We plan the route from 24.x or 25.x up to a current 26.x release, check integrations and rehearse the upgrade before the production window.
step 03
Service account mapping
Rotation doesn't get switched on until each service account is mapped to the Windows services, scheduled tasks and app pools using it. Otherwise one of them keeps the old password and breaks.
step 04
Vendor access through PRA
We put a Jumpoint in each network zone and set up vendor accounts with approval and session recording. Credentials are injected from Password Safe.
step 05
EPM rollout and handover
We build Endpoint Privilege Management policies out of observed application use and roll them out one group at a time. Then the runbooks go to your team.
ai on beyondtrust
Where AI fits on BeyondTrust, and where it needs guardrails.
BeyondTrust announced AI Agent Security for Pathfinder in June 2026, and it's in private beta. It controls coding agents on endpoints (Claude Code, Copilot, Cursor and Codex among them) and is sold first as an add-on to Endpoint Privilege Management. BeyondTrust has also shown a preview MCP server for Password Safe. We'd run both as pilots next to your current EPM and Password Safe policy.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
BeyondTrustdoes the work
BeyondTrust has a preview Password Safe MCP server, authenticated with an API client ID and secret. For production we'd have agents call the Password Safe API instead, on a dedicated API registration with source IP limits, credential checkout approval and session logging.
AI Agent Security for Pathfinder (private beta)
It targets agents running on endpoints and is sold as an add-on to Endpoint Privilege Management. We'd pilot it on a developer group already under EPM, with exit criteria agreed before it starts.
Coding agents and local admin rights
Developers often run coding agents with admin rights. We run EPM in audit mode to see which elevations agents actually request, then write elevation rules so agents work without standing admin.
Password Safe preview MCP server
In October 2025 a BeyondTrust employee posted a demo of a preview MCP server that pulls privileged credentials from Password Safe into Claude Desktop. We'd keep it out of production. Any test should use non-production accounts only.
How BeyondTrust controls vendor, admin and endpoint privilege
Vendors and admins get to servers through Privileged Remote Access and a Jumpoint in each network, and Password Safe injects the credentials so nobody sees them. Password Safe also rotates them. Elevation on workstations is handled by Endpoint Privilege Management.
These are working documents, written against your configuration, so your team can run them without us.
runbook01
Upgrade runbook from 24.x to 26.x with timed rehearsal results
yours to keep
document02
Service account dependency map, showing the services, tasks and app pools that use each account
yours to keep
guide03
Rotation policy set per managed system type, with failure alerting
yours to keep
plan04
PRA Jumpoint placement plan and vendor onboarding procedure
yours to keep
plan05
EPM policy set built from audit-mode data, with a rollout wave plan
yours to keep
plan06
Pilot plan and exit criteria for AI Agent Security
yours to keep
talent and delivery · beyondtrust
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
BeyondTrust Password Safe engineer
Privileged Remote Access engineer
Endpoint Privilege Management engineer
BeyondInsight administrator
PAM architect
due diligence · beyondtrust
Questions to ask any partner, including us.
Put these to anyone bidding on your BeyondTrust work. The ones who've done it answer differently from the ones who've read about it.
Q1
How do you find every place a service account's password is used, before rotation is switched on?
Rotation that updates the vault but misses one scheduled task or IIS app pool breaks a service overnight. The dependency map is the real work, and it has to be checked host by host.
Q2
Can you rehearse our move to 26.x on a copy of production before the window?
Jumping from 24.x touches the database, the API and every integration. A timed rehearsal shows how long the window must be and which scripts break.
Q3
How will vendors reach our network through PRA without a VPN account?
With a Jumpoint in each network zone, a vendor can only reach the systems approved for that session. Whether that holds depends on where the Jumpoints sit and how approvals are routed, and that deserves its own design review.
Q4
What audit-mode data will you collect before EPM starts blocking anything?
Elevation rules built from guesses are what flood the helpdesk. A few weeks of real application use per department gives the rule set something to stand on.
Q5
How would you treat AI Agent Security while it's still in private beta?
BeyondTrust launched it as a private beta in mid-2026. A partner should scope it as a pilot with exit criteria, not as a production control your auditors rely on.
01When does our Password Safe version go out of support?
BeyondTrust lists Password Safe 24.2.x as out of support from September 2026 and 24.3.x at December 2026, with support ending on the last day of the month. Check BeyondTrust's support life cycle page for other versions before you set an upgrade date.
02How long does an Endpoint Privilege Management rollout take?
It depends on device count and how many applications need elevation. We start in audit mode to see what people actually run, then move groups to enforcement in stages so the help desk isn't flooded.
03Can BeyondTrust control AI agents?
BeyondTrust announced AI Agent Security for Pathfinder on 30 June 2026. It is in private beta and sold first as an add-on to Endpoint Privilege Management. We'd treat it as a pilot for now and pair it with existing EPM policies.
04Do you also work with CyberArk and Delinea?
Yes. We implement all three, and if you're choosing between them we compare against your systems, hosting rules and team size.
05What drives the cost of a Password Safe project?
Mostly the number and variety of managed systems, how many service accounts have dependencies to map, and how many network zones need Jumpoints. Licensing is priced separately by BeyondTrust. We size the work after a short inventory of systems and accounts.
services
Related services
Projects on BeyondTrust usually end up touching one of these, so they're worth a look.
