What should I check in a One Identity Safeguard PAM solution evaluation?

Evaluate the two halves separately and then together. Safeguard for Privileged Passwords handles vaulting, discovery, and approval workflows (including approvals from a phone through One Identity Starling), while Safeguard for Privileged Sessions is the proxy that records and inspects sessions. Confirm which form factor you will run: hardware appliance, virtual appliance, an AWS or Azure image (both bring-your-own-license), or the SaaS edition (Safeguard On Demand). Check version pairing, since an LTS major version of Passwords only works with the same LTS major of Sessions, and patch history on virtual appliances (CVE-2024-45488).

How does One Identity compare in a privileged access management evaluation?

Safeguard is a capable vault and session manager, but it rarely wins a greenfield PAM shortlist on its own against Idira (formerly CyberArk), Delinea, or BeyondTrust, which have deeper cloud and secrets coverage and more partner capacity. Its case is consolidation: if you already run One Identity Manager for governance or Active Roles for Active Directory, Safeguard lets privileged access sit in the same vendor, audit story, and contract. Also weigh the ownership change: One Identity announced on 24 June 2026 that it will separate from Quest Software.

Who owns One Identity Safeguard in 2026?

Safeguard is a One Identity product, and One Identity has been part of Quest Software, which is backed by Clearlake Capital. On 24 June 2026 One Identity announced plans to operate as an independent company with a new global headquarters in Cork, Ireland, under CEO Praerit Garg, saying milestones would be shared as the transition progresses through 2026. No new investor or deal terms have been published, and we could not confirm the separation has closed (checked 2026-11-05). Ask where your contract and support entity will sit.

How much does One Identity Safeguard cost?

One Identity publishes no list prices (checked 2026-11-05). The AWS Marketplace listing for Safeguard for Privileged Passwords states that pricing and entitlements are handled through an external billing relationship with the vendor, so you bring a license bought directly and pay AWS infrastructure on top. The Azure image is also bring-your-own-license. Expect a quote-based deal, often bundled with Identity Manager or Active Roles, and treat per-user figures in marketplace reviews as anecdotes rather than prices.

PAM

One Identity Safeguard

Name: One Identity Safeguard review
Item: One Identity Safeguard
Rating: 3.9
Author: SWI Community Team

Founded 2017Cork, IrelandQuest Software (Clearlake-backed); separation of One Identity to an independent company announced June 2026, not yet confirmed closedScore 3.9/5Evaluated 2026-11-05Website ↗

Capability scores

Methodology →

Authentication: 4.0
SSO & Federation: 4.0
Authorization: 4.5
Lifecycle & Provisioning: 4.0
MFA & Passwordless: 3.5
Governance & Audit: 4.5
Developer Experience: 3.0
Deployment Flexibility: 4.0
Pricing Transparency: 3.0
Support & Ecosystem: 4.0

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

One Identity Safeguard is the privileged access management suite from One Identity, covering credential vaulting (Safeguard for Privileged Passwords), session proxying and recording (Safeguard for Privileged Sessions), and privileged behavior analytics. In 2026 it is a specialist choice, strongest inside an existing One Identity governance program, and it is in the middle of an ownership change: One Identity announced on 24 June 2026 that it will become independent of Quest Software, with a new global headquarters in Cork, Ireland. No investor or deal terms have been published, and we could not confirm the separation has closed.

What it is good at

Session management and analytics are the standouts. Safeguard for Privileged Sessions acts as a proxy that brokers, records, and inspects privileged sessions (including RDP), and feeds the analytics layer that flags anomalous privileged activity, which helps both detection and session recording evidence for auditors.

Deployment choice is wide. Safeguard runs on hardware appliances, as a virtual appliance, from cloud images on AWS and Azure (both bring-your-own-license), or as SaaS through Safeguard On Demand. The password module discovers privileged accounts through host, directory, and network scans, and approvers can act from a phone through One Identity Starling without VPN access.

The real advantage shows with the wider portfolio: privileged access governed alongside Identity Manager and Active Roles gives auditors one coherent story instead of disconnected tools, which matters most in Active Directory heavy estates.

Where it falls short

For greenfield PAM buyers with no One Identity footprint, momentum sits with Idira (formerly CyberArk), Delinea, and BeyondTrust. Cloud-native and DevOps workflows (dynamic secrets, infrastructure-as-code, zero standing privileges for cloud roles) are lighter than in purpose-built modern tools.

Appliance hygiene needs attention. CVE-2024-45488 (CVSS 9.8) allowed unauthorized access through a cookie handling flaw in virtual appliance installs of Privileged Passwords before 7.5.2, 7.4.2, and 7.0.5.1 LTS; CVE-2024-40595 (5.3) affected RDP in Privileged Sessions. None is in the CISA KEV catalog (checked 2026-11-05). Version pairing also constrains upgrades, since an LTS major of Passwords only works with the same LTS major of Sessions.

Pricing

Quote-based; no list prices published (checked 2026-11-05). The AWS Marketplace listing routes pricing to a separate billing relationship with the vendor. Licensing is typically scoped within a broader One Identity engagement; model the all-in cost against standalone PAM with the TCO calculator.

Best for, and who should look elsewhere

Choose Safeguard when you already run One Identity or Quest and want privileged access consolidated into that governance program. For greenfield enterprise PAM, compare CyberArk vs BeyondTrust and CyberArk vs Delinea; for cloud-native infrastructure access, see Teleport and HashiCorp Boundary. See also One Identity alternatives.

Bottom line

A capable PAM suite with strong session analytics and flexible form factors, best for organizations consolidating privileged access inside an existing One Identity program.