Skip to content
Start with Identity
Join free
PAM

BeyondTrust

Founded 2006Atlanta, GA, USAPrivate (Francisco Partners and Clearlake)Score 4.5/5Evaluated 2026-11-05Website ↗

Capability scores

Methodology →
Authentication
4.0
SSO & Federation
3.5
Authorization
4.5
Lifecycle & Provisioning
3.5
MFA & Passwordless
3.5
Governance & Audit
4.5
Developer Experience
3.0
Deployment Flexibility
4.5
Pricing Transparency
3.0
Support & Ecosystem
4.0

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

BeyondTrust is a PAM leader, named a Leader in the October 2025 Gartner Magic Quadrant for Privileged Access Management for the seventh consecutive edition, that competes directly with Idira (formerly CyberArk), now part of Palo Alto Networks, and Delinea, with a distinctive strength in endpoint privilege management and secure remote access. Its roots in remote support give it a more complete story for controlling and recording third-party and vendor access, and it acquired Entitle in April 2024 to add cloud just-in-time and entitlement capabilities.

What it is good at

Endpoint Privilege Management (removing local admin rights while allowing approved elevation) is among the best in the market, which matters because standing local admin is a common breach enabler. Password and session management, privileged session recording, and secure remote access for employees and third parties are mature and well integrated. Flexible SaaS or self-hosted deployment suits regulated buyers, and the Entitle acquisition brings modern cloud JIT into the portfolio.

Where it falls short

The security record is the main caveat, and it sits in the very product that is a strength. Remote Support is a privileged control plane, and it has been breached twice. In December 2024 a compromised Remote Support SaaS API key let attackers reset local account passwords on 17 SaaS customer instances, the route into US Treasury workstations; BeyondTrust patched CVE-2024-12356 and CVE-2024-12686 that month. In October 2026 advisory BT26-05 disclosed CVE-2026-102764, a CVSS 9.3 flaw in self-hosted Remote Support exploited as a zero-day since August and added to CISA KEV on 16 October. Run self-hosted appliances on a short patch cycle and keep their logs off the box.

Like its peers, this is enterprise software with real implementation weight, and the product set spans several modules that take planning to deploy coherently. Developer experience and cloud-native infrastructure-access ergonomics trail newer entrants like Teleport and StrongDM. Pricing is quote-based.

Pricing

Quote-based and modular across password and session management, endpoint privilege, and remote access. SaaS and self-hosted options price differently; budget for implementation.

Best for, and who should look elsewhere

Choose BeyondTrust when endpoint privilege management and secure remote/third-party access are priorities, or when you want a strong CyberArk alternative with flexible deployment. For the deepest vaulting at the largest scale consider CyberArk; for modern cloud infrastructure access consider Teleport or StrongDM. See CyberArk vs BeyondTrust.

Bottom line

A top-tier PAM with the best endpoint-privilege and remote-access story, and a pragmatic CyberArk alternative for mid-market and enterprise.

Breaches involving BeyondTrust

Incidents in our sourced breach database where BeyondTrust was the abused surface or the path in. Inclusion is not a judgement on the product: most record stolen credentials, tokens or misconfiguration on the customer side, and each record says which.

Browse the full database

BeyondTrust: frequently asked questions

Is BeyondTrust Remote Support affected by CVE-2026-102764?
Yes. BeyondTrust advisory BT26-05, issued 15 October 2026, describes a critical improper origin validation flaw (CWE-290, CVSS v4 9.3) in an internal messaging component of Remote Support, affecting self-hosted versions 26.2.3 and earlier. The fix is patch BT26-05-RS for versions 24.3.1 through 26.2.3; older appliances must upgrade first. SaaS instances were patched by BeyondTrust. The flaw was exploited as a zero-day from late August 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 16 October 2026.
Was BeyondTrust involved in the US Treasury breach?
Yes. In December 2024 BeyondTrust found that a Remote Support SaaS API key had been compromised and used to reset passwords of local application accounts on 17 Remote Support SaaS customer instances. On 8 December 2024 it told the US Treasury, whose workstations were accessed through the service; Treasury attributed the intrusion to a China state-sponsored actor. BeyondTrust revoked the key, rebuilt affected instances, and patched CVE-2024-12356 and CVE-2024-12686 in Remote Support and Privileged Remote Access. It says no products other than Remote Support SaaS were affected.
Who owns BeyondTrust?
It is private. Francisco Partners has been an investor since 2018, when its portfolio company Bomgar bought BeyondTrust and took its name, and Clearlake Capital joined as an institutional shareholder in a deal announced on 1 June 2021 and closed on 17 August 2021. BeyondTrust acquired Entitle, a just-in-time access and identity governance vendor, in April 2024.

BeyondTrust comparisons

More PAM vendors

All PAM →
Last reviewed By SWI Community TeamSuggest a correctionHow we research

By SWI Community Team · Last evaluated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.