BeyondTrust Privileged Remote Access Reviews

When organizations were previously using VPNs for IT infrastructure management, that tool got removed from the network with BeyondTrust Privileged Remote Access. This results in cost savings, and multiple product management and security features are enhanced by using this solution.

We use the session monitoring and recording feature in BeyondTrust Privileged Remote Access.

The session monitoring and recording feature definitely helps security and audit with BeyondTrust Privileged Remote Access. When anyone is making changes or editing, we can use it as a record as well.

We are looking for a feature where if someone is doing something risky during their session, it should alert and possibly disable their credentials.

The deployment time for BeyondTrust Privileged Remote Access depends on post-deployment requirements. Spinning up the instance and configuring basic components takes within one day. Additional configurations based on access and other requirements are discussed with the customer and implemented accordingly.

I have not yet utilized the endpoint least privilege management feature in BeyondTrust Privileged Remote Access.

There is a ready integration guide available for BeyondTrust Privileged Remote Access, so there are no major issues. All API integration is available to integrate with.

More organizations are moving towards cloud infrastructure with BeyondTrust Privileged Remote Access. They are choosing this because they do not want to manage their on-premises and other hardware infrastructure.

As we are not working with other vendors, I would rate BeyondTrust Privileged Remote Access a 10 out of 10.

We use the tool for vendor access, providing secure vendor access to manage systems. Most of our use cases involve selling the product for vendor access with high privileges. 

We also use it when users want to work from a home office on their systems. BeyondTrust Privileged Remote Access helps vendors connect into the hospital to their specific systems to update and manage these systems.

Our primary use case for the product is supporting vendors in securely managing customer systems. BeyondTrust Privileged Remote Access plays a fundamental role in cost reduction as it eliminates the need for on-site services, allowing vendors to provide remote support. For example, it enables a technician from China to provide remote assistance, which significantly reduces costs for hospitals.

For managing user privileges, there is a feature that allows granular configuration for vendors accessing a company's systems. This is particularly useful for settings like hospitals, where multiple vendors need controlled access to various systems. 

The secure access must be audited live, ensuring patient data protection. I suggest that the primary use case is vendor access management, where we grant the vendors highly privileged access to customer systems in a secure and audited way.

I recommend that we improve integration with other products like PasswordSafe, aiming for smoother integration. Better alignment between products would enhance manageability from a single point. 

Additionally, BeyondTrust should focus on automating the update process to reduce unnecessary ticket creation. Improved quality control for non-English language versions is needed to avoid translation and layout errors.

We have been using the product since its inception, which I believe is since 2015.

The product runs very stable once installed. However, updates sometimes introduce bugs or issues, especially with non-English versions. Quality control for updates, particularly for non-English languages, could be improved.

I would give it an eight or nine out of ten for scalability, possibly even a ten, as I do not see a limitation in scaling. The solution is very scalable.

Customer support used to be faster with chat options available. However, support now requires opening a ServiceNow ticket, which can be time-consuming. The removal of ad hoc chat support has made the process slower. Despite this, the support team has experienced personnel, and the overall support is still good, rating it a seven out of ten.

Neutral

The setup difficulty depends on our expectations. For superficial use, it is straightforward. However, if deep integration is desired, it becomes more complex. It is advised to attend the BeyondTrust University course for best practice knowledge.

I recommend we use a certified partner for integration or have individuals complete a BeyondTrust University course to ensure successful implementation.

The product contributes significantly to cost reduction by eliminating the need for on-site services, which would otherwise incur high costs, such as flying in a technician from China for a hospital.

My experience with pricing, setup cost, and licensing is that it is expensive, yet not the most expensive in the market, so the price can be considered justifiable.

I recommend using a certified partner for implementation or attending a BeyondTrust University course for a smooth setup. Following manufacturer best practice guides is important. 

Additionally, consider ISO 27001 and 27002 standards for implementation.

I'd rate the solution ten out of ten.

When we are using BeyondTrust Privileged Remote Access with FortiGate or some Cisco third-party products, we collaborate with both vendors, take the requirement, and follow up with the technical team of BeyondTrust Privileged Remote Access. Once they get back with the future, we implement it.

The features I find most effective in BeyondTrust Privileged Remote Access include the advantages of password safe for anyone using their web server designing or applications. When users want to share credentials, which can be dangerous, BeyondTrust Privileged Remote Access will not share the username and password. It will automatically change the password from the web servers and will not provide it to anyone. Instead, it gives the link to the user, and they should connect through the link to directly access the machine without requiring username and password.

I use the session monitoring and recording feature in BeyondTrust Privileged Remote Access, which is available.

These features in BeyondTrust Privileged Remote Access help enhance security completely. It helps track which user deleted files, what modifications were made to files, and all activities.

The positive impact BeyondTrust Privileged Remote Access brings for the company includes complete security for compliance purposes. For instance, instead of sharing credentials for web servers, I provide VPN access through BeyondTrust Privileged Remote Access, allowing users to access those machines securely.

Improving technical support for BeyondTrust Privileged Remote Access is essential.

When I communicate with technical support for BeyondTrust Privileged Remote Access, the response time is very slow.

My teams have been using it for more than three years, while I have been using it for eight to six months.

The deployment process of BeyondTrust Privileged Remote Access presents no challenges. Anyone with experience in Microsoft can manage it because it is based on Windows Server machine, and they implemented the PAM solution for managing passwords.

The approximate time for deploying BeyondTrust Privileged Remote Access depends on user requirements. Some clients have 200 users, while others have five or six machines. The BeyondTrust Privileged Remote Access password safe project typically takes one to two months to complete.

Regarding stability, if a company has Exchange Server on-premises, they should consider whether sharing passwords is safe. From my experience, sharing passwords is not recommended, but BeyondTrust Privileged Remote Access provides secure access without sharing passwords. The solution creates one link for users, allowing direct server access without exposing credentials. There are limited time-based access options available, such as five hours or two hours, and all activities can be recorded simultaneously.

The technical support of BeyondTrust Privileged Remote Access deserves a mark of three out of ten.

Neutral

In our company, we have more than 15 employees involved in the deployment of BeyondTrust Privileged Remote Access. There are 15 engineers on-site and 100 users working remotely.

There is a definite financial benefit for the company from using BeyondTrust Privileged Remote Access.

I cannot provide specific information about the pricing of BeyondTrust Privileged Remote Access as I am still training with my senior team. I understand that they purchase the license depending on the server requirements.

BeyondTrust Privileged Remote Access and Fortinet are two major vendors I work with, but I do not recommend Fortinet's PAM product. They should focus on network security only.

I have not utilized the endpoint least privilege management feature in BeyondTrust Privileged Remote Access as I have only been using it for eight or nine months.

I am not working with other products from Fortinet, such as FortiExtender, FortiRecon, FortiXDR, or FortiSOAR.

The role-based access control in BeyondTrust Privileged Remote Access is assessed as 0.5 out of 10. BeyondTrust Privileged Remote Access does not have a cloud basis. They provide it on VM machines in the company network. Previously, it was available as an on-premises device, but now they offer VM licenses.

I rate BeyondTrust Privileged Remote Access an 8 out of 10.

We are an MSP, and we have customers actively using the solutions and the services. We do the backend administration and implementation, troubleshooting and incident handling, and other things like that.

Our use cases include adding users, adding environments to the system, and general and advanced configurations for users and environments. Those are just the standard regular use cases. Other than those, we handle platform maintenance, and platform restoration and recovery in case of an incident.

We also use PRA to provide access to third-party vendors. It restricts access only to the devices and only to a certain section of that device or environment that the vendor would need to access. It can also limit access in terms of time and time of day. Access can be subject to approval, which adds an additional layer of security, and we can also set in advance the number of days that that vendor will have access through PRA.

Since PRA eliminates the need for a VPN, this has translated into cost reduction and reduced complexity. PRA has eliminated the human factor from managing critical credentials; it has restricted access only to specified devices and only on specific ports. The solution provides very restricted and very specific access, both in terms of the endpoints of devices being accessed and in terms of the protocols that are available to initiate the session.

The auditing capabilities are valuable because of the fact that the Privileged Remote Access platform can track and record everything that happens within a session. The solution also has integration with authentication providers, which is critically important. It allows multiple-factor authentication and also allows us to configure access based on groups and organizational units.

One of the most critical features is that PRA eliminates the need for a VPN. The fact that PRA can establish secure encrypted connections and limit those connections only to certain protocols eliminates the need to have one or multiple VPNs and administer and manage all of them. 

Another critical feature of not needing to use VPNs is that it also reduces the number of individuals who would have access to critical information, like authentication for those VPNs. I rate the security provided by PRA when it comes to access for remote and privileged users a four out of five.

Lastly, managing access through PRA rather than VPN is much more convenient, much more granular, and more efficient.

Firstly, when doing protocol panel jumps, the tool does not restrict what is recorded on the user's computer. So if a user has, let's say, three desktop monitors, the tool will expand to the entire desktop and record everything that happens on those screens, and not in the PRA window alone. Since a lot of people hold sensitive information outside of the PRA window, this creates some friction because they do not want that information recorded.

Restricting the recording to the PRA window during a protocol tunnel jump will be an improvement.

The second improvement is that PRA could be more flexible with privilege elevation on Linux endpoints.

The third improvement is that PRA should have more connectors for the most common applications it integrates with.

I was certified by the vendor a year ago, but I used BeyondTrust Privileged Remote Access a little bit before I got certified. I do administration and implementation for the solution.

The solution is very stable, there is nothing to complain about there.

PRA is not very scalable in its current form. We currently have an active/passive configuration, but should we change that to an active/active configuration, the entire underlying infrastructure would become ten times more complex and would require significant costs with licensing and resources, having to configure that underlying infrastructure. That would make everything at least five times more complex and more costly, so PRA is not scalable in its current form.

We have 300 users in my company and 150 users from our customers using PRA.

We have regularly scheduled calls with a technical account representative every two weeks, and we are in constant contact with their support department, if not on a daily basis, at least every other day. The technical support is excellent.

Customer support is always very responsive, they are very customer-oriented in that they are always keen on understanding the use case, the fault and what solution would be best suited to the environment. They are always willing to take the extra step to go above and beyond to find some exotic solution or approach for our specific needs. And they are always very patient.

It wasn't just once that they stepped outside the contractual agreement, they went above and beyond to give us the best support and the best solution.

Positive

I used CyberArk, but very slightly. I also used ManageEngine.

Since we are a managed service provider, ManageEngine did not fit with our profile, and we needed a solution we can deliver to multiple customers at the same time in a shared or private manner. Secondly, from a licensing perspective, ManageEngine was slightly costlier, based on how it was implemented from our side.

The setup was mildly complex. It took four working days from the moment we received the appliance from BeyondTrust until we had the application ready to start onboarding stuff.

We implemented PRA in an active/passive configuration, integrated with Password Safe. It is not open to the Internet and can connect to only one destination via proxy.

Since PRA lacks connectors with applications it integrates with, we had to build them ourselves.

All implementation was done in-house with support and consultancy from BeyondTrust. We had three permanent people involved in the initial setup, myself included, with an individual from BeyondTrust providing advice and consultancy from time to time.

PRA's pricing is competitive, but since we are one of the major customers, we might be benefitting from different discounts and pricing.

Note that we do not use BeyondTrust Vault since it is not an enterprise-grade vaulting solution, which is why we use Password Safe since that is an enterprise-grade vaulting solution.

Initially, we only went for the SaaS solution, and customer-related constraints made us deploy it on-prem as well. But when we chose BeyondTrust PRA, we were only considering SaaS.

PRA can also be used to manage network devices. It brings the same level of security into managing networks. It eliminates VPNs, especially multiple VPNs. Through the use of PRA, there is no need to share passwords with users, which is critically important.

We don't necessarily use PRA as a full solution, but it adds an additional layer of security by having the enterprise vaulting solution, which is Password Safe, and PRA separate. That also makes things more efficient in that when configuring PRA, we only focus on the connectivity and the session from PRA, we don't worry about the account management.

If you compare PRA to CyberArk, it's just as good. There is nothing that one solution has over the other. These are the two market solutions that are usually compared since they are pretty much on par. ManageEngine, at least in the incarnation that we were using, was more limited when it came to auditing and reviewing sessions.

I advise engineers choosing a PAM solution to be very careful. One important aspect when reviewing is the high availability capabilities, and the second aspect is the integration capabilities with other BeyondTrust products or other products in that customer environment.

I rate PRA an eight out of ten.

Our company provides a software/platform as a service to state and local governments, municipalities, and provinces. Since all of those need to be NIST 800-54 and FedRAMP compliant, we needed a privileged remote access tool to take care of that access piece. BeyondTrust fills that piece for us.

It certainly has made secure access something that is embraced rather than fought. People are willing to use the tool. That probably is the most significant thing about the product. It's easy, they like it, and it keeps us secure. Within three months, we started to realize the benefit of the product.

I don't know if I could pin down the best features to just one aspect. In terms of our users that use the product, it's really the overall ease of use. It saves our team hundreds of hours every year.

We like that Privileged Remote Access does not require a VPN. I suspect at the end of the day, if I used a one to ten scale, I would give it an eight. It's pretty important. Not having to go through a VPN is a win.

The security provided by PRA when it comes to access for remote and privileged users has been outstanding. It has met all of our objectives, everything from password rotation to securing and allowing us to clamp down access to the auditing and monitoring features.

When deciding on this solution, it was somewhat important that PRA is available in multiple formats as a physical and virtual appliance or SAS. We certainly needed virtual appliances. Over the long run, we may go with SAS.

PRA has had an effect on our network security. What I would say in terms of the effect is there's a whole element of password management that no one in managed services really needs to take care of anymore. That in and of itself has been a huge time saver.

It is extremely important that, through the use of a PRA, there is no need to share passwords with users. That takes us right back to the NIST 800-53 requirements.

We do use the solution to provide access to third-party vendors, however, not in the way intended, as we don't really let vendors in. In terms of the customers who purchase our platform services, there are instances where they need to be able to have access to the environment that we create for them. We are using the vendor features to give them access.

It is very important that PRA offers us SSO authentication. We use that for all of our users.

In terms of improvement, there are two things that come to mind. One is just in terms of the API interface, which needs some work. In terms of the ability to automate the creation of new accounts within it, it's still a bit laborious. The other piece that I would say I've been pushing for this whole period is simply to save a reason for access to the audit file as it's one of the requirements in NIST 800-53. It's been a pain working around that one, even though it's somewhat trivial.

I've used the solution for about three and a half years.

I've been running it for three and a half years. It has, by and large, been without issue. That's a pretty powerful statement. I wish I could say that about everything that I monitor.

It meets all our needs. We're running about 100 users and we're getting ready to upgrade our licensing. We'll be at about 350 nodes by end of the next couple of months. I don't see us hitting any issues with it for the foreseeable future.

We've got about a total base of about 100, however, I would say 60 are active users. Of that 60, 20% would be administrative, managed services, IT support, and that level. About five percent would be actual customer access, for any product user access. The rest would be the software development team that are the ones that manage our platform on the servers.

Our bread and butter are the platforms that we deploy to our end-user customers. It is in use at 100% of those. Every time we bring on new clients, we expand the usage. We've won a number of RFPs and bids this year. Over the next six to twelve months, it's going to probably increase by 30%.

Technical support is pretty solid. There's probably a little bit of room for improvement, however, we can get help when we run into an issue. If it's an issue, the resolution happens, not as quick as I would like, however, it gets done. Overall, I'd still give them an excellent mark for the support.

Positive

We previously used a different solution. We used TPAM. Trusted Privileged Access Management, was too cumbersome. We had to click 30 times to get into a server. Users hated it so much that there was an increased push to migrate away from Privileged Remote Access. That was really just not an option. We had to get off of that platform before we lost the ability to have any sort of monitoring going on for our access. I can't say enough bad things about TPAM. It is probably the worst product that I've ever worked with in terms of the designed interface. It met all of the security requirements that it needed to. It was excellent with that. However, the problem was that it was so burdensome to use and nobody wanted to use it.

The initial setup ended up being complex. The product still hadn't matured. I tried multiple times to align it to the security requirements that I had, and that proved to be extremely challenging initially. So much so that I thought we were going to have to ditch the product. With some really very excellent support from BeyondTrust, I was able to get through. However, it was not trivial.

The deployment started in November, December, and January. The deployment took two or maybe two and a half months.

I handled the deployment myself. As far as ongoing maintenance, it's not even a full-time requirement. I would say it requires maybe ten hours a month of staff time.

I did not use an integrator, reseller, or consultant. I did purchase professional services from BeyondTrust. They were great to work with and I would use them again. In many cases, they went above and beyond.

The ROI has been huge. If I compare it to just TPAM, our time savings per month over the TPAM product was close to 100 hours a month. Multiply that times a year, times three years, and the average FTE price is about $100 to $120 an hour. That's a lot of money. It's more than paid for itself.

Pricing was one of the big draws. It came in substantially less than some of its competition. I did a POC with four different competitors plus we already had TPAM. Hands down, this solution won on all accounts. Only the setup was a pain and I was able to work around the issues that I ran into.

When compared to some competitive products that are add-ons to PAM solutions, it was important to us that PRA stands on its own as a full solution. Sometimes just for keeping the product patched and current, to make sure there are no holes. That was very important.

PRA compared with other solutions when it comes to sessions, auditing, and monitoring of third-party and remote worker access is good. However, it doesn't necessarily give all of the logging features that some of its competitors do. It is adequate to meet what we need for the NIST and FedRAMP controls. At the end of the day, that is really my primary concern.

The advice I would give to others using the solution is to know what you are trying to accomplish and weigh the product in light of the goals or tasks you need to meet. There are some features or functionalities that may not fit some organizations as well as others. Just do a POC, test the product, and it in front of users. They are the ones that ultimately are going to have to live with your choice.

There's always a way if you're crafty. Get plugged in with the company. Through so many different phone calls with BeyondTrust, I ended up with access to one of their directors of product management and that opened a lot of doors.

I'd rate the solution nine out of ten. There's a little bit of room for improvement, however, it performs well.

We use it for remote support for our clients. The main reason we use it is that it allows us to elevate our privileges remotely. While we're using it or supporting the users, we can elevate our smart card.

We are currently using the latest available version of Bomgar. In terms of deployment, we like to have solutions like this on-prem, but it is good to know that it is available in the cloud because we are moving a lot towards the cloud. In the future, once this appliance dies out, we might just transition over to a cloud version. It is good to know that we have the flexibility to do that.

It is the software that our call center uses all the time, and it is very important for us that Privileged Remote Access doesn't require a VPN. Otherwise, if the VPN is down or something like that, we won't be able to access a computer. With PRA, we're able to get to them even if the VPN is down.

The security provided by PRA when it comes to access for remote and privileged users is great. It is really good. They take a lot of interest and put effort into making sure that the product is very secure because everything has to go through the appliance.

It is easy to do things and set up everything. We have it integrated with Active Directory. So, the customer service group can log in really quickly and easily whenever they need to assist someone. It is a great product. I have no issue with it.

It is used by our IT engineers and customer services team. One of its great features is that you can install it on computers in the DMZ to which they usually don't have network access. They can then use it to access them. Because we all have to use our smart cards to log in, the ability to pass the smart card over to the client is the best thing. It is the golden feature that we like to use. It just makes it easier to quickly help people resolve any issues. A lot of times we try to monitor the computer in different ways, such as through on-calls, and it lets us in. If the elevator screen comes up, you can still view the screen, whereas if you are sharing your screen on Teams or something like that, it might blank out when you elevate your privileges. It is a necessary tool that we have. It is deeply integrated into our process.

It is very important that through the use of PRA, there is no need to share passwords with users. That's very much needed. We definitely don't want to share passwords with the clients. It is a highly needed feature, and it is great that we have that ability.

It offers SSO authentication, which is very important because it allows secure transmissions. We know that no one is eavesdropping. It meets all the latest security requirements. They're doing away with a lot of the older formats.

It is pretty good in terms of session auditing and monitoring of third-party and remote-worker access. It is very detailed, and it is very granular. I like the fact that it can record the actual session. You can pretty much audit anything.

I like all of it. You can access computers that are on a DMZ. You can access computers that are off the network and on the network. You pretty much have access to computers wherever they are. As long as they have the client on them, you can get to them. So, it is convenient, but its main feature is that you can use your smart card to elevate your privileges remotely. That's a great feature.

Another great feature of it is being able to use it on mobile phones as well. If it is an agency or a company that has a lot of BYOD devices or company-provided phones and tablets, you can provide support for them as well.

Their support is A+. I've spent many hours on the phone with them. They're very prompt. They call you right back. They follow up all the time, and they stick with you all the way until the issue is resolved. I've never had a problem where I was not able to contact anyone.

It works perfectly. I haven't had any issues with the service account or anything else. It is almost a set-it-and-forget-it solution. Things don't break that often. The way it is set up now, I have no issue with it. It is a good system.

It makes remote access highly secure. We don't have a fear that anyone is eavesdropping on a session. In that aspect, it has had a positive effect.

I would love to have a web console and the ability to use the smart card with the web console to provide remote support. If you are on a computer that doesn't have the Bomgar console, you should be able to use the web console to provide support. That's the only thing right now. A web console is nice when you're jumping into a computer, but if you need to elevate the privileges, you currently can't do it with the smart card. If they could figure that out, that would be money.

One thing that's confusing is the way of setting up group policies and permissions. It is very complicated. There are a lot of small pieces to it. The way they have set everything up is weird. I'm sure there is a reason for that, but I feel it should be a lot easier to provide different permissions and things like that.

I have been using this solution for at least six years. I'm using it just about every day.

It is highly stable. It is almost set-it-and-forget-it. You don't have to constantly check on it and make sure it is working. It just works. When it breaks, you definitely know that something is wrong. Currently, it is showing that it has been up for 18 days, which could be because we had a power cut, but usually, it is up for months with no issue.

It is highly scalable. If we need to add more licenses and more users, it is easy. We had to do that during COVID when everyone worked remotely. It was easy to just buy a license and add more users. If we need to add another appliance, which we won't, it would be very easy to do that.

Currently, about 100 people are using it, but only 40 people can use it concurrently. Overall, we have about 100 users who have access to it, and they range from engineers to Tier One, Tier Two, and Tier Three customer support. Pretty much everyone on my team has access to it.

It is being used all the time. At any given point, at least 15 to 20 people are signed into it. It is tightly integrated into our daily operations. In terms of expanding its usage, I'm not too sure because our agency only has about 5,000 employees at this time. Something that I've always tried to get them to do is to get it integrated with the service desk or ticketing system, but they don't want to put money into integrating it. I have been pushing for a couple of years, but they just don't want to. The management over there doesn't see the benefits of it.

Whenever I call Bomgar support, they provide AAA support. Based on the products I have used, they are one of the best in terms of support. I have no complaints or issues there. I would rate them a ten out of ten.

Positive

We just had the regular Windows remote desktop or something like that. We didn't have any solution like this.

It is straightforward and very easy. It took about a day. You can get everything set up within a day, but I had to do testing and things like that. It took me about a month to get everything worked out. If this was a private company, I probably could have done it in a couple of days, but because we have to get approval for a lot of different things before we can deploy anything, it took about a month. However, setting it up and testing it out to say that we have it working took about a day.

It was a virtual box. I planned out the permissions and backed up the old appliance. I had a virtual appliance. I installed the software, imported the information, and started importing all the users. I then just started testing it out from there.

I take care of its deployment and maintenance, and one person is enough for that.

We have definitely seen an ROI. It is worth its weight in gold. If it goes down, we are at a standstill. We can't provide adequate support to our users if we don't have this software. 

It is tightly integrated with our operations. We use it all the time across the board. Every single person who is a part of IT uses this system, and it is great. I don't have the metrics for the ROI, but 100% of the IT department uses it. It has definitely helped us out on many occasions, and it is used every day.

Its price is pretty good for the features and services that it provides. It is not outrageous. I'm not aware of any additional charges or anything like that.

It won't hurt to give it a shot. I know they have a virtual trial where they can let you use it to try out things. It is a great product. It simply works once it is all set up and configured. If there is an issue, it is easy to troubleshoot and figure out what the problem is. It is usually pretty easy to figure it out. 

It is very important that PRA stands on its own as a full product, as compared to some of the competitive products that are add-ons to PAM solutions. We wouldn't want to be forced to set up another system just so that we can use PRA. It is great that it is separated out. So, we can just use one portion of it.

I would rate it a ten out of ten. It is a great product that I enjoy using, but they should work out the smart card on the web console.

It is remote support for our customers. We use it to connect to our clients.

We have a lot of external customers who don't have access to their networks. BeyondTrust helps us access our services inside their networks without the setup of that entire process.

Our use case has to be on-premises. We are not allowed to use cloud stuff. So, we need an on-premises solution. If that went away, we would have to find a new vendor. This is very important for us.

It is used 24/7, as we are a 24/7 operation. So, it is used all the time very extensively. We just increased usage of it last week, increasing our licenses and everything on them.

It is very important that Privileged Remote Access does not require a VPN. We don't have access to a lot of people's networks. We have a lot of external customers and BeyondTrust allows us to access our stuff on their premises without having to set up 20 VPNs or having different WeVPNs per customer. So, it simplifies the process of onboarding a new customer.

As a whole, Privileged Remote Access is very secure. We have never had a customer deny us having access to it. That is a huge plus for us as it is basically an industry standard at this point. The solution is very highly regarded by anyone and everyone who uses it. That is why we use them.

Since we use it mainly for support, our support team is able to do so much more without having to actively engage our customers. This saves us time and money, helping our customer get back up. Normally, when they are engaging with us, it is a support issue. Therefore, the faster that we can alleviate that support issue, the better it is for our customers. Also, the better it looks for us.

It helps us maintain connections to outside stuff without having to compromise our internal networks when accessing external clients.

It is very important to us that PRA stands on its own as a full solution because of the nature of some of our clients. We can't have too much coupled into our internal stuff versus the stuff that we use to interact with our clients. We use this solution because it is a standalone product that is highly regarded in our industry.

In recent days, the most valuable feature would be the Vault. Overall, the most valuable feature would be that ability to do remote support.

Vault does a good job of providing visibility for domain accounts, endpoints, and local accounts associated with discovery jobs.

The report tools are very robust. I know they have their report tools that you can filter through, which also give you access to the data. So, if you ever want to just do a data dump and your own analytics on it, then you could, which is really nice. We also integrate with the API for reports, which is really nice as well.

We use the solution’s Vault for service account management. It has gotten much better with the most recent update. It has been clunky but that has gotten a lot better. I would give it seven out of 10. There is definitely improvement that needs to be done on it over the long term, but I am very pleased with the progress so far.

I would like a better dark theme. The dark theme is still new but a little harsh on the eyes with the colors it shows

I would like better administrative tools for the Vault.

I have been using it for three years. The company has been a customer for more than 10 years.

It is very stable. In the three years that I have been administering this solution, I have never had downtime on the box because of BeyondTrust.

Once you have it up and running, it hums along on its own little thing.

We are very small scale. We have 22 users who are mostly support and development.

I know it is scalable, but I have never actually done it.

They are very technical. I have only engaged with support twice when we were migrating from an older appliance to a newer appliance, and they answered every single question wonderfully. I would rate them as nine out of 10 since there is always room for improvement.

Positive

It is very important for us that there is no need to share passwords with users. Our previous solution was terrible in regards to this. Using PRA has been much nicer. Our customers like it a lot more that our frontline reps don't know the passwords to get into anything that they share with us. It is managed and logged. There is actually governance around it.

I personally have used LogMeIn and some other software in the past. As an end user, this is much easier to use.

I have only been involved when we migrated from multiple boxes. 

We have seen ROI. Our customers constantly rate our company very highly in support, and that is what we mainly use Privileged Remote Access for. The longer that we keep customers, the more reoccurring revenue we get from them.

It is expensive. However, in the grand scheme of things for us, since we are 24/7 and haven't had any downtime in the last three years, it is an easy check to write every year. It definitely pays for itself.

Overall, the product is great. I am the administrator of it. I have to use it every day. I use it for both endpoints and that is very easy on both sites.

I would rate it as nine out of 10. Right now, it is just all the minor little things for the most part.

I use the tool in my lab. I am involved in the product's testing phase in my lab, where I am trying to check out the solution.

The issue I found with the product revolves around the fact that RDP and SSH sessions take too much time, making it an area of concern where improvements are required. The product should be able to handle RDP and SSH sessions in a span of ten to fifteen seconds.

I have been using BeyondTrust Privileged Remote Access for four weeks. My company has a partnership with BeyondTrust.

Our company will be contacting the product's technical support soon.

I used Delinea two years ago. The seniors in my company decide the solutions that we need to work on within our company. My company also deals with the solutions that our customers want.

I have experience with Delinea, which I found to be more complicated compared to BeyondTrust Privileged Remote Access. In Delinea and BeyondTrust Privileged Remote Access, areas like configuration, RDP, and SSH are almost the same.

Any PAM solutions, like ARCON, Delinea, or BeyondTrust Privileged Remote Access, offer the same features, while there may be some differences. I am checking for the differences between different products and learning about such areas in depth.

I rate SailPoint a ten out of ten.

I rate Delinea a seven out of ten.

Speaking about the use of the product for vendor management, I would say that I am currently working in SSL Wireless, where we work with BeyondTrust Privileged Remote Access for the deployment of products like Asha Cement in Bangladesh for over two months. I joined the team in my company around four weeks ago, after which I have been trying to install BeyondTrust Privileged Remote Access in my lab for testing purposes and use cases so that I can try to figure out what the organization wants to do or try with the solution.

The product has improved remote support capabilities since it works fine. In my company, we found some issues with our clients who found it to be time-consuming, especially when they started a session with the help of the product. Our company's clients have concerns related to why it takes too much time when it comes to RDP sessions. If I want to handle multiple sessions at a single point in time and want to access two or three servers at the same time, I have experienced that it closes the sessions after two or three minutes. The clients don't want sessions to be closed when using the product, meaning they want to be able to use three or four servers at the same time since, at times, they want access to network devices while simultaneously being able to work with application servers or any other servers.

The feature of the product that I found to be the most effective for controlling remote access stems from the fact that I didn't find any differences between the sessions offered by the solution, but there are some queries related to the sessions from the clients' end. I am waiting to have a session with the product's support team. I have made a checklist before communicating with the product's support team so that I can clear out the confusion related to the solution.

Any PAM solutions, like ARCON, Delinea, or BeyondTrust Privileged Remote Access, offer the same features, while there may be some differences. I am checking for the differences between different products and learning about such areas in depth.

When I try to access multiple servers with the help of the product, the solution should work properly since I am not someone who works with one server at a time. I may need access to multiple servers, during which I may face issues with BeyondTrust Privileged Remote Access.

I have tried to access the product without a VPN in a local environment. I haven't used any VPNs on the servers I use. If given a chance, I can try to use VPNs, along with BeyondTrust Privileged Remote Access.

Considering that I have used Delinea in the past, I would choose BeyondTrust Privileged Remote Access in the present. I cannot speak about other PAM solutions in the market.

I rate the overall product an eight out of ten.

I work for a massive company. They have 6,000-plus servers integrated into the PRA solution. BeyondTrust is a remote solution for administrators and other privileged accounts across the organization. It controls access to critical servers, domain controllers, Active Directory, Exchange, or any client servers they'll be using. Right now, there are about 10 products on the market globally, and BeyondTrust is the market leader. Within BeyondTrust, there are multiple sub-products, including Password Safe, Privileged Remote Access (PRA), and Endpoint Protection. PRA is unique among BeyondTrust products and other solutions.

We use Password Safe to store all the passwords in a vault, indicating when a privileged user attempts to access a privileged account on a server. PRA doesn't provide direct access to the process. Instead, we'll provide PRA access to Password Safe through a connector. In other words, the user doesn't have access to the critical account via Password Safe. 

Whenever a user wants to initiate a session, they will log into Password Safe, which will inject the credentials. PRA limits access to Password Safe itself. Only a Password Safe engineer has access to that solution, and the engineer is responsible for onboarding the servers and end users. The user will initiate the session via PRA, which will retrieve the credentials. In addition to this core feature, it has reporting tools to record sessions, providing a list of clear logs. 

Right now, BeyondTrust is an on-premise solution. We have a cloud version, but we are not using it. Eventually, we plan to move it to the cloud. BeyondTrust is being used extensively in our organization. There are between 100 and 130 concurrent sessions daily. Our server can easily maintain that usage level, so we don't need to add another. 

Using BeyondTrust has made our end users happy because they have trouble logging into multiple sessions. Now, they only need to open the client to start a session. It has shortened and simplified various processes, like approval requests. They can do several sessions, with a session time of 15 minutes. 

From an administrative point of view, BeyondTrust has streamlined user onboarding, a never-ending process. Every day, we are onboarding and deactivating users on the server. It's easy, and I don't need to change passwords or worry about who has access. My users access the servers through PRA exclusively. It's enough to remove a user's access to the server from PRA. Later, I can clean up the password or access control.

I can remove user access with one click, then figure out the other offboarding activities later. It's convenient for an administrator and the end users. Every channel has been monitored and recorded, so it's highly secure.

After getting the password, a user can initiate a direct connection to the target server. Any user working on a server can log into Password Safe to pull the password and store it somewhere. Next time, they won't need to log in to Password Safe. After that, they will directly initiate the session. PRA has a connector that allows it to retrieve the password. 

PRA also doesn't require a VPN, which is a substantial cost saving for our organization. In the past, we needed a VPN license for every administrator operating from home to connect to the server. That's a massive expenditure. By implementing PRA, we could completely get rid of our VPN solution. It works like Microsoft but allows direct access, so I don't need to worry about a VPN. I log in to my PRA control and initiate the session. It's easy for any user. A domain name is more than enough. I can log into my PRA control, and I'll be able to access my server.

I like the enterprise credential manager. It's a connector that sits in PRA and tests the credentials for the end user with a process that will clean the password. This is one of PRA's primary features and simplifies user onboarding. There aren't many restrictions or complications. We can add the user while only opening one port, which is more than enough to access the PRA server. Every organization requires only four critical servers out of a hundred and some 50 production servers.

In PRA, it's easy to secure production and non-production environments. You can secure an organization's entire ecosystem. On a development server, we have privileged access and essential activities we will perform in production. The development server will be onboarded, and the consumed license will be less compact than other products.

Connecting to the target server takes at least 30 seconds with other tools. It is more straightforward in PRA, so the target connection takes five or ten seconds. Managing users, accounts, and services and upgrading the agents are all incredibly straightforward.

There are two methods of integration. We don't need to create accounts when it's onboarded to the PRA solution because the same server has already been onboarded to the process. You can initiate multiple sessions across the solution whenever your user wants. You can open the same server and various licenses. Users can unlock numerous servers and other products, features, and tasks. Users who don't want to access the server directly can initiate a connection without worrying about the desktop. 

Let's say I'm a user with access to the production server. I'll be using a privileged account with access to the development server. Usually, a PAM solution will try to secure one leader-created account so they don't need to worry about the development account. There is a single pane of glass so the user can be brought into the PRA solution in a fraction of a second. My area account will be given to the dynamic team to add some security groups, and the security group will be added to my PRA solution. If I'm in that security group, I'll be able to see all my servers easily.

Nobody can log in through my server without PRA access, so it maintains excellent access control. Even if I know the password, I cannot access the server because that is a restriction we can implement across the organization. We can ensure that any protocol—43, 00, SDP, 22, etc.—goes through PRA. This is a simple tool, and any access management person can easily handle it.

They can see the system information, including the voice operating system details. Everything will be flashed over there. There are two methods of connecting to PRA: jump client and jumpoint. The jumpoint method is agentless. If there's a critical server where the owner doesn't allow you to install an agent, you can still onboard that server into the PRA solution with the agentless method. 

Another great feature is built-in remote support. If an administrator needs help from the vendor, a third-party provider, or someone else within their organization, they can invite the person from within the PRA console. We can restrict the person's access to only what's necessary to provide support. With other tools, I would need to set up a video conference on WebEx or Teams and share my screen with them, and everything is in the picture. 

PRA lets you invite somebody immediately from within the console. There is a small tab on the right side. I can put the email address in and send an invitation to the other person's mailbox. They only need to launch the URL to join my session quickly.

This works on mobile devices. They can use their mobile phone to log into my session and access me. If they want to do mouse control, I can allow them to work on my screen. I can minimize my session and do other work. I can also see a complete recording of the third-party support's troubleshooting steps.  

I can provide direct access to the vendor through a separate app, but I have to open that domain. For example, if you are from XYZ domain, I can just add the domain to PRA and provide access, but creating an AD account for the vendor is a better option. However, most organizations will never give direct access to any third party. Instead, we'll create a dummy account that will be set up using my ID, and that account will be shared with you. I must access that secure area through my account whenever you want to log in. It's convenient for the third-party vendor, and the session is monitored, so you don't need to worry about complaints.

Third parties shouldn't have direct access, but maybe some guy also can log into the domain using this password. We create an account in our environment that provides access to the PRA control. They can easily access the solution using their account in my domain.

The vault functionality is straightforward. I have an account managed by Password Safe, which holds the password. Every password change is tracked in the vault, so I don't need to worry about that. I log into PRA and launch a server. Then it will prompt me for my service or local account. It's my only account. I can keep the service account, and this PRA solution will pull the service account's password from the vault. It is going to this credential over here when I log into the PRA solution, which works in this space.

BeyondTrust has multiple products, including Password Safe and PRA, integrated natively. Providing direct access to Password Safe might cause some issues, which is why PRA exists. We want to restrict the direct access to Password Safe for anyone except the password administrator. A user could be an administrator or end-user when they are onboarded to our service area, and the administrator will be onboarded for the accounts in Password Safe.

That's why we keep passwords in the vault and only provide access to the PRA solution. PRA will retrieve the passwords. If there is a server on which other services are running, PRA doesn't consider anything like it for the account. You can initiate the session and open the session server. You can see what services are running from there or whether the password has changed. 

Password Safe performs every job, and PRA is only an intermediary that takes the password from the person and opens the session. It's like a proxy server or a jump server.

Multiple areas can be improved. We've seen lots of updates in the past year.  They have a portal where we can submit our ideas. BeyondTrust is immediately implementing user suggestions. The UI could be more informative. Initially, there were two or three connectors, and now we have five or six. It would be nice if they added a few more connectors for third-party integration. There are multiple tools, but the clients may require more for their convenience.

I have been using BeyondTrust for around 18 months.

We haven't faced any issues in the past 18 months.

PRA should be scalable, but it depends on the client. We've never had any issues. We have 400-plus admins on the accounts. The total number of end users is huge, but no end users log into the privileged server. There are more than 400 admins onboarding and 6,000 trust servers.

I rate BeyondTrust support an eight out of ten. We are still in the initial stage, so we are building servers and onboarding. We have frequent calls to ensure that we are fully utilizing the product's features.

Positive

In my previous company, I worked with BeyondTrust, but I didn't use PRA.

I was not part of the initial setup, but I came on board toward the end of the deployment. I was involved in onboarding our client data. Setting up BeyondTrust PRA is simpler than other products. You have three or four servers and a primary server. Based on your recommendations, you can set up a gem server across multiple server types. It takes three or four hours, and you need to have the prerequisites in place.

It all depends on the company's requirement or the access session that is happening daily. We can use only one server or several, and it's easy to attend to those servers. I don't think integration is the hardest part. It's lightweight in terms of maintenance, but while implementing the solution, we should be careful about how we are pointing the solution so the DCD should be working properly. If you want to bring other appliances in, it's plug-and-play. 

I rate BeyondTrust Privileged Remote Access an eight out of ten. If you are using a BeyondTrust product and you want to secure that process, you should use PRA, which enables you to skip a step. You don't need to worry about users having direct access to the process. 

It is used for remote access for all our partners. We bought it to replace our VPN connection for all our third-party partners and providers.

All our sensitive services are required to be hosted on-premises. That is why we needed something that offered an on-premises solution.

It has almost removed all the burdens that we had due to partner interactions via the VPN. The portal is easy to use and the self-service is really well-designed. End users are able to work without a lot of intervention from our teams. Also, when there is an issue with a password or two-factor authentication, they can reset it using the self-service option. There is not much to do now when supporting external partners.

Privileged Remote Access has improved external access to our network, which has had a positive impact on our network security.

It is very important to us that, through use of PRA, there isn't a need to share passwords with users. One of the basic best practices for securities is to avoid sharing passwords. We try to enforce this in our organization, so this is something that is mandatory for us.

It is used 90% of the time by external vendors and partners. That is the main reason why we bought this product. In terms of an attack in the network, PRA limits the possibility of access into our internal networks. The only point where they have access is PRA. According to its design, you can only access what has been configured. At the end of the day, we don't worry about what the external vendor can access on our internal network. We are just working on making sure that we give them the highest access to PRA.

In terms of security, PRA offers SSO authentication, which is a plus. It is very important to limit the use of multiple passwords, then we can just help a user focus on their jobs, not handling data passwords. 

I like the ability to have locks on every session and connection that happens on our system from the outside. So, we can do a review or investigation if something happens.

The proxy mode allows us to reproduce our attack surface.

It is really secure for remote and privileged users. It has helped us to go into detail on what someone can or cannot do on each system.

We can find real information that we need in terms of auditing and access using the Vault feature. In terms of visibility, we have all the information that we need.

PRA stands on its own as a full solution. This is important because it reduces the need to maintain a lot of different services. Also, the integration between those services are sometimes not easy to maintain. So, having a solution like BeyondTrust Privileged Remote Access reducing our workload gives us enough time to work on our other issues. The system just runs and does what it is supposed to do.

The solution's Vault is a nice feature. It helps to securely share a security password in teams, but it is not at the level of a password management solution. So, it is just really a vault. We were expecting to have more features to better manage passwords, but that is something that you can work around if you also have a password safe solution. I would like them to have features like password rotation or password auditing, e.g., old passwords.

I would like to improve access to the web application, simplifying the web jumps. I would also like them to improve the Vault, which should have features closer to a light password management solution.

I have been using it for two and a half years.

The system is stable. Updates don't require a lot of work to implement. I haven't had to do a callback after a deployment or upgrade.

Two people from our team are needed for deployment and maintenance.

It is scalable, though we haven't utilized that yet.

We have around 50 users utilizing the system. Four of those are admins.

We are using the solution extensively for 100% of our needs. We are not looking to add more users to the solution at this time. If we extend our partnership to more vendors, then we might consider extending our use of the solution.

The technical support is good. Their knowledge base is well-documented. I would rate the support as nine out of 10.

Positive

We were using a VPN solution that allowed external parties to have more access and capabilities on our network. Whereas, with PRA, all access is handled by the server, though there isn't a direct connection to the end server. This limits the access and capabilities of external checks on our Internet networks. 

The initial setup was straightforward.

It took about a week to have all our systems up and running on PRA as well as have our vendors connected to the system.

We went from training to the initial deployment with BeyondTrust's Professional Services. Then, our teams handled the next step of the deployment, which was onboarding all our systems. After that, we started the migration from all our VPN solutions to PRA with our end users. We did a few parallel runs between PRA and the old solution, then we went full-on into production.

PRA was one of the cheapest solutions that we evaluated.

We did tests before purchasing the solution. We tested three other solutions. PRA's auditing was the best. It provides a lot of information. It even lets you search through video logs, which was something that we really liked.

I recommend testing some other solutions then trying Privileged Remote Access. You will notice the difference. It is robust and easy to use with many good features, like the SSO.

I would rate the solution between eight and a half and nine (out of 10).