No more typing reviews! Try our Samantha, our new voice AI agent.

ACF2 vs Idira Privileged Access Manager comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 2, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ACF2
Ranking in Mainframe Security
4th
Average Rating
9.0
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Database Security (12th)
Idira Privileged Access Man...
Ranking in Mainframe Security
1st
Average Rating
8.6
Reviews Sentiment
6.8
Number of Reviews
230
Ranking in other categories
User Activity Monitoring (1st), Enterprise Password Managers (2nd), Privileged Access Management (PAM) (1st), Operational Technology (OT) Security (3rd)
 

Mindshare comparison

As of July 2026, in the Mainframe Security category, the mindshare of ACF2 is 12.4%, up from 11.4% compared to the previous year. The mindshare of Idira Privileged Access Manager is 5.8%, up from 2.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Mainframe Security Mindshare Distribution
ProductMindshare (%)
Idira Privileged Access Manager5.8%
ACF212.4%
Other81.8%
Mainframe Security
 

Featured Reviews

reviewer1077621 - PeerSpot reviewer
IT Examiner at a financial services firm with 10,001+ employees
A reliable, scalable product for security and auditing of our mainframe environment
It is a good product. It has been used for years. As long as it is configured correctly, it is a very stable product. It depends on how an institution or a company configures it. It depends on an institution's risk appetite. You need to make sure it is configured as per the concept of least privilege, and the logging features, detection and control mechanism, and other things like that are enabled. If you configure it to give access to the public, then there could be compromises. You should also have someone who independently checks it to make sure that it is configured keeping security in mind. If it has been configured for a while, when there are enhancements to the product or when you enhance it, you need to make sure that security is also looked at, and it is configured according to an institution's security policies. I would rate it a nine out of 10.
Atul-Gujar - PeerSpot reviewer
CyberArk manager at a comms service provider with 10,001+ employees
Secures critical infrastructures with essential user session audit records
A potential area for improvement is enhancing support for cluster environments and distributed Vaults. Clients in multiple countries that need central access have different challenges that require better solutions from CyberArk. For financial services, CyberArk can improve incident response by ensuring fast support for critical priority tickets to meet compliance requirements. Providing more documentation on CyberArk is recommended for new team members to enhance their troubleshooting capabilities. I understand it's up to the client, but 99% fail to change the demo key, so it's crucial for CyberArk to emphasize changing the key and documenting it as part of the installation process.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Without the product, extracting this information may take us as much as several days; instead, we can get it in real time."
"Know that this tool is a great tool, a good tool to use, because you can quickly automate, quickly provision, and deprovision new users, which is essential when you are bringing new people onboard."
"Logging and monitoring are most valuable. It is for the mainframe environment, and it is at the forefront for security and resilience."
"It is a good product."
"By providing a high level of access control to the z/OS systems, ACF2 allows us to maintain tight controls on dataset and system access and helps us keep unauthorized users from accessing PHI or PII data."
"I am deeply impressed with the quality and depth and breadth of security and functionality in CA’s ACF2 and Top Secret products."
"The NOACCESS by default is another very good feature. Also, access rules are straightforward, and easy to understand."
"Excellent real-time reporting that saves time and resources."
"It gives us the capability to rotate passwords."
"Security is the solution's most valuable feature. As far as I know, this solution is the most secure system of this class on the market today, even considering another management system like Fudo Security, which we also use. The integration capabilities are very good; it helps strengthen our overall security."
"CyberArk PAS provides isolated and recorded sessions for third-party/outsourced admin access."
"Rather than multiple tools for maintaining regulatory compliance around passwords and privileged accounts, we have centralized as much as possible with CyberArk. This is now a one stop shop for end users to access their elevated credentials."
"CyberArk is one of the best PAM solutions and one of the most expensive, but it works better than the others, so the pricing is fair."
"I love how easily we could operate within Password Vault and get things done. It was almost effortless."
"Implementing the CyberArk solution helps these companies to think about their privileged accounts, organize them in the CyberArk solution, and then get control of their privileged accounts to safely store and manage these, knowing that only the correct persons can access these accounts and that the different devices can only be managed via one central entry point to the datacenter."
"The most valuable feature is the special management. It records the activity and the actions that we use for auditing."
 

Cons

"It needs longer rules. The max rule is 32K."
"I would like my team and me to be able to use simple browsers, like Chrome, to be able to access mainframe data and provision users using the browser.​"
"They can work on its ability to work in a distributed environment."
"The user access review could also be improved. It produces a lot of false positives."
"Reporting can sometimes include false positives."
"They can work on its ability to work in a distributed environment. It's a mainframe product. As many companies move to the cloud, depending on what cloud models they choose, such as a public, hybrid, or private cloud, it should be deployable. I am not sure if it can be deployed on those platforms. It has been there since the '50s or '60s, and it's still scalable. It has survived all these years, and it's scalable to many platforms, but I don't know about the cloud."
"Initial setup could be complex if you rely on contractors to help with implementation."
"Having a centralized place to manage the solution has been something that I have always wanted, and they are starting to understand that and bring things back together."
"We would like to expand the usage of the auto discovery accounts feed, then on our end, tie in the REST API for automation."
"It is only good as a PAM solution. If they could work more on Privileged Threat Analytics, it would be beneficial. It has limitations, so improvements on PTA would be fine."
"The downside is that it's a big program. To scale excessively, locally, on an on-prem application, takes a lot of servers."
"Improved user-friendliness, granularity, and functionality would enhance the product further."
"There was a functionality of the solution that was missing. I had noticed it in Beyond Trust, but not in this solution. But, recently they have incorporated something similar."
"The reporting should be improved. There should be more customization. The report should show how we are going to mitigate the risk because we cannot show the system environment to each and every auditor."
"Improvements in CyberArk Privileged Access Manager should focus on simplifying installation and upgrade times, and also consider making professional services training more accessible to implementers and partners."
 

Pricing and Cost Advice

Information not available
"They have two types of licensing: purchase and subscription. You have to pay for each admin user, such as Microsoft admin, mail admin, database admin, etc."
"Overall, its pricing is really good. The main difference from all the other vendors is that they have one package that covers all the functionality and modules of the basic PAM, except the add-on modules like adware and server protection. It also doesn't include the licenses for domain controller protection or maybe an API call-related feature. For the basic privileged access management, the bundle pricing is really good, but when it comes to an agent-based solution for advanced cyber protection or application identity managers, it is expensive. Services are also very expensive if you hire the services team from CyberArk, but these guys are really good. For a couple of large banking projects, we had an experience with them. The banks wanted to have things quickly and efficiently, so we had to hire them. If we take four weeks, these guys can do everything on a weekend. They charge quite a big sum of money, but they know the system well."
"Quite expensive"
"The SaaS version of CyberArk Enterprise Password Vault is very expensive, but the on-premises version is relative, e.g. depending on the size of the environment, it can be a bit pricey, but it's relatively okay compared to the others."
"CyberArk provides all the features bundled. This is compared to other vendors who provide them as a different license for each functionality."
"The price of CyberArk Privileged Access Manager is expensive. There are no other fees other than the standard licensing fees."
"The solution is costly but we get what we pay for."
"I do not have any opinions to add about the pricing of the product."
report
Use our free recommendation engine to learn which Mainframe Security solutions are best for your needs.
906,829 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
18%
Educational Organization
10%
Manufacturing Company
10%
Comms Service Provider
8%
Financial Services Firm
12%
Manufacturing Company
10%
Outsourcing Company
8%
Construction Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise4
By reviewers
Company SizeCount
Small Business59
Midsize Enterprise42
Large Enterprise175
 

Questions from the Community

Ask a question
Earn 20 points
How does Sailpoint IdentityIQ compare with CyberArk PAM?
We evaluated Sailpoint IdentityIQ before ultimately choosing CyberArk. Sailpoint Identity Platform is a solution to manage risks in cloud enterprise environments. It automates and streamlines the m...
What is your experience regarding pricing and costs for CyberArk Privileged Access Manager?
My thoughts on the pricing of CyberArk Privileged Access Manager depend entirely on the vendors' requirements. If they want their things to be secure, they have to spend accordingly. We have four t...
What needs improvement with CyberArk Privileged Access Manager?
I believe account discovery and rolling support need to be improved. Account discovery is important when integrating with other systems, as other PAM solutions can perform account discovery and onb...
 

Also Known As

CA ACF2
CyberArk Privileged Access Security, CyberArk Enterprise Password Vault
 

Overview

 

Sample Customers

Sky, Rogers Communications
Rockwell Automation
Find out what your peers are saying about ACF2 vs. Idira Privileged Access Manager and other solutions. Updated: June 2026.
906,829 professionals have used our research since 2012.