CyberArk under Palo Alto Networks: same vaults, new decisions.
We upgrade PAM Self-Hosted and move vaults to CyberArk's SaaS. We also onboard the accounts nobody has touched in years. Palo Alto Networks has closed the deal, so part of the job now is telling you what really changed.
Palo Alto Networks (acquisition closed 11 Feb 2026)
Platform brand
Idira, launched 13 May 2026
Self-hosted release
PAM Self-Hosted v15, Standard-Term Support (Dec 2025)
Deployment
PAM Self-Hosted or Privilege Cloud (SaaS)
release watch
Palo Alto Networks completes CyberArk acquisition11 Feb 2026
Idira platform launched13 May 2026
connects with
in short·15-second read
Cohash upgrades and runs CyberArk privileged access.
That covers PAM Self-Hosted upgrades to v15 and migration to Privilege Cloud, plus account onboarding, CPM plugins and PSM connectors. Since 11 February 2026, when Palo Alto Networks completed the acquisition, the platform has been marketed as Idira, and we plan around it. We put AI agents under privilege controls with no standing access.
you probably need this if
PAM Self-Hosted is still on v13 or v14, and nobody has tested the DR vault since the last upgrade.
A discovery scan found thousands of service and local admin accounts, and they're still sitting outside the vault.
Admins pull passwords from PVWA and paste them into RDP, skipping PSM altogether.
15 Dec 2025PAM Self-Hosted v15 Standard-Term Support release. It adds Vault Remote Manager, OAuth2 for REST APIs and bulk CPM actions in the Modern UI. Source is secondary and reproduces CyberArk's notice. source ↗
11 Feb 2026Palo Alto Networks completes CyberArk acquisition CyberArk identity security stays available as a standalone platform while integration with Palo Alto Networks proceeds. source ↗
13 May 2026Idira platform launched Built on CyberArk, this is the identity security platform Palo Alto Networks positions as the upgrade path for CyberArk customers. source ↗
today · Oct 22, 2026
the story · cyberark estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your CyberArk estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · cyberark estate3 open
openPAM Self-Hosted is still on v13 or v14, and nobody has tested the DR vault since the last upgrade.
recurringA discovery scan found thousands of service and local admin accounts, and they're still sitting outside the vault.
blockedAdmins pull passwords from PVWA and paste them into RDP, skipping PSM altogether.
exposure
PAM Self-Hosted upgradesMigration to Privilege CloudAccount onboardingSession managementApplication secretsAI agents and machine identities
startrehearsehandover
Health check
Upgrade or migration plan
Rehearsal or pilot
Onboarding waves
Handover
we are here
ready to hand over
Someone has actually failed over to the DR vault.
The service accounts that were too risky to touch before are now rotated by CPM.
Component-order upgrade plan to v15, with DR vault failover test results
Safe and platform inventory with custom CPM plugins and PSM connectors flagged
chapter 01 · where it hurts
Why teams reach out
PAM Self-Hosted is still on v13 or v14, and nobody has tested the DR vault since the last upgrade.
A discovery scan found thousands of service and local admin accounts, and they're still sitting outside the vault.
Admins pull passwords from PVWA and paste them into RDP, skipping PSM altogether.
chapter 02 · what we change
How we solve it
PAM Self-Hosted upgrades
Migration to Privilege Cloud
Account onboarding
Session management
Application secrets
AI agents and machine identities
chapter 03 · how it runs
Our approach
Health check
Upgrade or migration plan
Rehearsal or pilot
Onboarding waves
Handover
chapter 04 · where you end up
What changes
Someone has actually failed over to the DR vault.
The service accounts that were too risky to touch before are now rotated by CPM.
Component-order upgrade plan to v15, with DR vault failover test results
Safe and platform inventory with custom CPM plugins and PSM connectors flagged
what we do
Our CyberArk work
6 kinds of CyberArk work, each run by engineers who have done it on live tenants.
Vault, PVWA, CPM and PSM upgraded in the supported order, with the DR vault and backups tested before and after.
An inventory of safes, platforms, custom plugins and connection components, a decision on what moves as-is, and a phased cut-over that keeps rotation running.
Local admin, service and domain accounts discovered and onboarded into safes, with platforms and rotation policies that won't break dependent services.
PSM and PSM for SSH configured for RDP, SSH and web applications, with connection components for the tools your admins use.
Credentials moved out of scripts and config files into CyberArk, using the integration that fits each workload.
Agents discovered and given owners, with access limited to what a task needs for as long as it runs, and their actions audited.
capability 01 / 06in production
PAM Self-Hosted upgrades
Vault, PVWA, CPM and PSM upgraded in the supported order, with the DR vault and backups tested before and after.
An inventory of safes, platforms, custom plugins and connection components, a decision on what moves as-is, and a phased cut-over that keeps rotation running.
Local admin, service and domain accounts discovered and onboarded into safes, with platforms and rotation policies that won't break dependent services.
We pieced these together from CyberArk situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
v13, a DR vault nobody has failed over, and a renewal due next year
composite · not a client story
Beforethe situation
PAM Self-Hosted is on v13, and the DR vault last failed over before the previous upgrade. Renewal is due next year, and leadership wants to know whether to upgrade in place, move to Privilege Cloud or wait to see what Idira means for them.
What we dothe work
First comes a DR failover test, along with a health check of Vault, PVWA, CPM and PSM. We cost both paths against your custom plugins and connection components. If you pick v15, we rehearse the upgrade in a test environment. If you pick Privilege Cloud, we plan a pilot set of safes.
Afterwhere you end up
Someone has actually failed over to the DR vault. Leadership gets two priced options, self-hosted v15 or Privilege Cloud, and goes into the renewal knowing what the custom plugins will cost to carry.
case file 02
14,000 discovered accounts and 900 in safes
composite · not a client story
Beforethe situation
Discovery found about 14,000 local admin, domain and service accounts. Only 900 sit in safes, mostly domain admins, because the last attempt to rotate a service account took down a batch job.
What we dothe work
We group accounts by platform and risk, and map each service account to the Windows services, scheduled tasks and app pools it runs. Onboarding goes in waves. Local admin accounts with no dependencies go first, then service accounts, with their usages set up in CPM.
Afterwhere you end up
The service accounts that were too risky to touch before are now rotated by CPM. When a rotation fails, the PAM team hears about it, not the application owner. Later waves run from the first wave's runbook.
We don't start a step until the last one has produced something you can check.
step 01
Health check
We check Vault, PVWA, CPM and PSM versions and look at safe design and platform settings. Then we go through rotation failures and DR replication and decide what to fix first.
step 02
Upgrade or migration plan
For self-hosted, the supported component order to v15 with backups and DR checked. For Privilege Cloud, an inventory of safes, platforms, CPM plugins and PSM connection components.
step 03
Rehearsal or pilot
Upgrades run in a test environment first. For Privilege Cloud, a pilot set of safes moves first and we confirm CPM rotation and PSM sessions still work.
step 04
Onboarding waves
Accounts come on in waves, one platform at a time, and we map dependencies before each wave so rotation doesn't break a service or scheduled task.
step 05
Handover
We write the runbooks for the admins who'll actually use them. They cover vault operations, CPM troubleshooting and PSM connection component changes.
ai on cyberark
Where AI fits on CyberArk, and where it needs guardrails.
CyberArk is part of Palo Alto Networks now, sold on the Idira platform. Its agent offering is an MCP Server for Secure Cloud Access, which gives developers and AI assistants just-in-time cloud access without standing privileges. PAM Self-Hosted v15 adds OAuth2 for REST APIs. Treat agents the way you treat admins. Each one needs an owner, and its access should be short-lived, with sessions audited.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
CyberArkdoes the work
There's an MCP Server for Secure Cloud Access from CyberArk on AWS Marketplace. For everything else, have agents call the PAM REST APIs through an OAuth2 client that's limited to specific safes, with short-lived credentials and session recording. A human approves privileged writes.
MCP Server for Secure Cloud Access
The container is on AWS Marketplace, free for Secure Cloud Access customers, and built for assistants like Amazon Q Developer or Claude for Desktop. SCA policies come first for us. Agents then get time-bound cloud roles, and every grant lands in the log.
OAuth2 for REST APIs in PAM Self-Hosted v15
v15 adds OAuth2 for REST API calls, so we get agent and automation integrations off stored API passwords and onto OAuth2 clients with narrow safe permissions.
Agents under privilege controls
An agent that needs privileged credentials gets an owner, access limited to the task and how long it takes, and audited sessions. We onboard its accounts to safes and rotate credentials through CPM, the same as any other account.
AI help with onboarding and CPM plugins
We let an AI assistant draft account onboarding files and review CPM plugin and PSM connector code. Nothing it touches rolls out until one of our engineers has tested the change on a non-production vault.
How CyberArk's Vault, PVWA, CPM and PSM broker privileged access
Admins sign in to PVWA, which fetches credentials from the Digital Vault and opens isolated, recorded sessions through PSM. CPM rotates and verifies passwords on targets, while applications pull secrets through the Credential Provider instead of hardcoding them.
01 · Admins and workloads
IT adminsbrowser · RDP and SSH clients → PVWA · sign in
SailPointsafe membership requests → Digital Vault · safe membership
Applications and scriptsCredential Provider → Digital Vault · credential retrieval
02 · CyberArk PAM
PVWAweb portal · REST API → Digital Vault · credential request→ PSM · launch session
These are working documents, written against your configuration, so your team can run them without us.
tests01
Component-order upgrade plan to v15, with DR vault failover test results
yours to keep
inventory02
Safe and platform inventory with custom CPM plugins and PSM connectors flagged
yours to keep
plan03
Onboarding wave plan with dependency checks per account type
yours to keep
runbook04
Privilege Cloud migration runbook and pilot sign-off record
yours to keep
runbook05
Runbooks for CPM troubleshooting and PSM connection component changes
yours to keep
talent and delivery · cyberark
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your CyberArk work. The ones who've done it answer differently from the ones who've read about it.
Q1
What will you check in our DR vault before any upgrade work starts?
An upgrade that falls back to a DR vault nobody has tested turns a rollback into an outage. Replication status and a failover test belong at the start of the plan.
Q2
Which of our custom CPM plugins and PSM connectors survive a move to Privilege Cloud?
Customizations decide most of a migration's cost. Each one needs a decision to move it as-is, rebuild it or retire it before anyone quotes a timeline.
Q3
How will you map service account dependencies before CPM starts rotating them?
Onboard a service account without its usages and CPM changes the password while the Windows service keeps the old one. That outage is what stalls most onboarding programs.
Q4
The platform is sold as Idira now. What does that change for us, and what doesn't it change?
Palo Alto Networks has said CyberArk will stay available as a standalone platform. A partner should keep the product facts separate from the marketing, so that renewal and roadmap decisions rest on published notices.
Q5
How long can we stay on v15 under Standard-Term Support?
Standard-Term Support runs for a shorter window than a long-term release. CyberArk's End of Life policy gives the end date, and that's what the upgrade calendar should be built on.
01Does the Palo Alto Networks acquisition change our CyberArk deployment?
Not right away. On 11 February 2026 Palo Alto Networks said CyberArk products stay available as a standalone platform and existing customers would see no disruption. The products are now marketed under Idira. Watch renewal terms and roadmap notices, and keep upgrading on your normal schedule.
02Should we upgrade self-hosted or move to Privilege Cloud?
It depends on hosting rules, on how many custom plugins and connection components you run, and on how much effort vault upkeep takes today. Regulated environments with strict data residency sometimes stay self-hosted. We inventory customizations first, because they decide most of the migration cost.
03What does Standard-Term Support mean for v15?
PAM Self-Hosted v15 is a Standard-Term Support release. You get security updates and critical fixes under CyberArk's End of Life policy, so look up the exact end date there before planning to stay on v15 for long.
04Do you also connect CyberArk to identity governance?
Yes. Hook CyberArk up to SailPoint or Saviynt and safe membership gets requested, approved and certified like any other entitlement. We do that integration.
05How long does a migration to Privilege Cloud take?
It depends on the number of safes and platforms, how many custom CPM plugins and PSM connection components you run, and how many network sites need connectors. A pilot set of safes moves first, then the rest in waves. We give a timeline after the customization inventory, because customizations drive it.
services
Related services
Projects on CyberArk usually end up touching one of these, so they're worth a look.
