CyberArk Conjur vs HashiCorp Vault: which should I choose?

Choose HashiCorp Vault when a platform team owns secrets across multi-cloud and Kubernetes and needs dynamic credentials, PKI and a broad engine catalog. Choose CyberArk Conjur, now sold as Idira Secrets Manager, when you already run CyberArk (Idira) for human privileged access and auditors expect machine secrets under the same governance.

What is CyberArk Conjur called now?

Idira Secrets Manager. Palo Alto Networks completed its CyberArk acquisition on 11 February 2026 and relaunched the portfolio as Idira on 12 May 2026. Conjur Cloud and Conjur Enterprise are now sold as Idira Secrets Manager in SaaS and self-hosted editions, while the open-source core keeps the name Conjur Open Source.

Which is easier to learn, Conjur or HashiCorp Vault?

For most engineers, Vault, because far more tutorials, Terraform providers and community answers exist for it. Conjur's declarative policy files are readable once learned, and PAM teams already on CyberArk will find its governance model familiar. Vault's breadth (26 secrets engines and 21 auth methods documented) is also what makes it harder to operate well.

What is the difference between CyberArk Vault and Conjur?

The CyberArk vault is the core of Privileged Access Manager, storing and rotating credentials for human administrators and privileged accounts. Conjur, now Idira Secrets Manager, serves applications, containers and CI/CD pipelines that need secrets at runtime. They integrate, so one policy program can cover both.

How much do HashiCorp Vault and Conjur cost?

Neither publishes list prices (checked 2026-11-05). Vault Community is free to self-host; HCP Vault Dedicated bills per cluster-hour plus per unique active client per month. Idira Secrets Manager is quote-only via a demo request, usually licensed alongside the wider Idira platform, and Conjur Open Source is free to run.

HashiCorp Vault vs CyberArk Conjur in 2026, Comparison

HashiCorp Vault vs CyberArk Conjur in 2026

CapabilityHashiCorp VaultIdira Secrets Manager (formerly CyberArk Conjur)

Overall

4.4

4.1

Authentication: 4.5; 3.0
SSO & Federation: 3.5; 2.5
Authorization: 4.5; 4.0
Lifecycle & Provisioning: 4.0; 4.0
MFA & Passwordless: 3.0; 2.0
Governance & Audit: 4.0; 4.5
Developer Experience: 3.5; 4.0
Deployment Flexibility: 4.5; 4.0
Pricing Transparency: 2.5; 3.5
Support & Ecosystem: 4.5; 3.5

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

Verdict

HashiCorp Vault vs Idira Secrets Manager (formerly CyberArk Conjur) is decided by who owns the program. If platform engineering owns secrets across multi-cloud and Kubernetes, HashiCorp Vault is the reference choice for dynamic secrets, PKI and breadth. If the PAM team owns it and already runs Idira (formerly CyberArk) for human privileged access, Idira Secrets Manager, the name Conjur has been sold under since May 2026, keeps machine and human secrets under one governance model. Vault scores 4.4 and Idira Secrets Manager 4.1 in our profiles.

Where each wins

Decision factor	HashiCorp Vault	Conjur / Idira Secrets Manager
Dynamic, short-lived credentials	Wins: databases, cloud IAM, PKI	Rotation and expiry by policy
Breadth of engines and auth methods	Wins: 26 engines, 21 auth methods	Narrower, integration-led
Governance with human PAM	Separate program	Wins: integrates with Idira Privileged Access Manager
Community and learning resources	Wins: largest ecosystem	Smaller, vendor-led
Licensing	Source-available (BUSL 1.1)	Open-source core plus commercial editions
Deployment	Self-hosted or HCP Vault Dedicated	SaaS or self-hosted
Published pricing	None	None

Pricing reality (checked 2026-11-05)

Neither vendor prints a price. HashiCorp's pricing page shows tiers for Terraform but routes Vault to sales. The documented HCP Vault Dedicated meter is per cluster-hour plus a monthly charge per unique active client, across Starter, Development, Essentials and Standard editions. HCP Vault Secrets, the lighter SaaS, reached end of life on 1 July 2026, so any quote mentioning it is stale. Vault Community remains free to self-host.

Palo Alto Networks' Secrets Manager page offers a demo request and no prices; expect it to be scoped alongside the broader Idira platform. Conjur Open Source is free (latest release v1.27.0, June 2026). Model the operational cost of self-hosting either with the TCO calculator.

Ownership changes

IBM completed its HashiCorp acquisition on 27 February 2025 for $6.4 billion; the Vault license now names IBM as licensor. CyberArk bought Conjur in 2017, and Palo Alto Networks closed its roughly $25 billion CyberArk deal on 11 February 2026, relaunching the portfolio as Idira on 12 May 2026. Both products now sit inside large platform vendors, so roadmap alignment with IBM or Palo Alto Networks is a fair diligence question.

Deployment and architecture

Vault is a cluster you run (or rent as HCP Vault Dedicated) with pluggable storage, seal and unseal, auth methods and secrets engines. Kubernetes gets three patterns: the Agent Injector, the Vault Secrets Operator and a CSI provider. Six engines and three auth methods, including SAML and SPIFFE, are Enterprise-only.

Idira Secrets Manager runs as SaaS or self-hosted for residency or air-gap needs. Secrets, roles and access rules are declarative, version-controlled policy, and the product page describes SPIFFE workload identities that expire within hours. Idira Secrets Hub, a separate product, syncs secrets into cloud-native vaults.

Migration notes

There is no direct import path; plan an application-by-application cutover. Inventory secrets and consumers first, recreate access policy in the target model (Vault policies and auth roles, or Conjur policy files), then repoint each workload's auth method and rotate every secret as it moves, since anything exported has been exposed. Sync can bridge the gap: Vault Enterprise and HCP Vault Dedicated sync secrets to AWS, Azure and GCP secret stores, and Secrets Hub does the same on the Idira side. Teams leaving Vault over the license also look at OpenBao; see Vault alternatives.

Who should pick which

HashiCorp Vault: platform teams standardizing secrets management across clouds, with engineers to operate it.
Conjur / Idira Secrets Manager: Idira customers extending privileged access governance to applications and pipelines, especially in regulated industries.
Neither: developer-first teams with no PAM program may prefer Doppler or Infisical; AWS-only shops, AWS Secrets Manager.

Frequently asked questions

CyberArk Conjur vs HashiCorp Vault: which should I choose?: Choose HashiCorp Vault when a platform team owns secrets across multi-cloud and Kubernetes and needs dynamic credentials, PKI and a broad engine catalog. Choose CyberArk Conjur, now sold as Idira Secrets Manager, when you already run CyberArk (Idira) for human privileged access and auditors expect machine secrets under the same governance.
What is CyberArk Conjur called now?: Idira Secrets Manager. Palo Alto Networks completed its CyberArk acquisition on 11 February 2026 and relaunched the portfolio as Idira on 12 May 2026. Conjur Cloud and Conjur Enterprise are now sold as Idira Secrets Manager in SaaS and self-hosted editions, while the open-source core keeps the name Conjur Open Source.
Which is easier to learn, Conjur or HashiCorp Vault?: For most engineers, Vault, because far more tutorials, Terraform providers and community answers exist for it. Conjur's declarative policy files are readable once learned, and PAM teams already on CyberArk will find its governance model familiar. Vault's breadth (26 secrets engines and 21 auth methods documented) is also what makes it harder to operate well.
What is the difference between CyberArk Vault and Conjur?: The CyberArk vault is the core of Privileged Access Manager, storing and rotating credentials for human administrators and privileged accounts. Conjur, now Idira Secrets Manager, serves applications, containers and CI/CD pipelines that need secrets at runtime. They integrate, so one policy program can cover both.
How much do HashiCorp Vault and Conjur cost?: Neither publishes list prices (checked 2026-11-05). Vault Community is free to self-host; HCP Vault Dedicated bills per cluster-hour plus per unique active client per month. Idira Secrets Manager is quote-only via a demo request, usually licensed alongside the wider Idira platform, and Conjur Open Source is free to run.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.