Delinea Ecosystem

Delinea PAM Ecosystem Deep Dive

Target audience: PAM engineers, identity/access security architects, IT governance professionals
Scope: Company overview, product portfolio, technical architecture, competitive positioning, certifications, career roles, recent developments
Last updated: 2026-04-30

1. Company Snapshot

Corporate Structure & Ownership

Delinea is a privately held Privileged Access Management (PAM) and identity security vendor headquartered at 201 Redwood Shores Parkway, Redwood City, California, USA. The company was formed in April 2021 through the acquisition and merger of two established PAM leaders—Thycotic (founded 2002) and Centrify (founded 2005)—backed by TPG Capital (a global private investment firm) and other institutional investors including Insight Venture Partners and Bessemer Venture Partners.

The merger agreement was announced in March 2021, and the combined entity initially operated under the interim name ThycoticCentrify until February 1, 2022, when the company officially rebranded to Delinea—chosen to reflect the mission of "defining lines of privilege" and representing clarity and precision in access control.

Leadership

CEO: Art Gilliland (current, since March 2021)
Art Gilliland joined as CEO of ThycoticCentrify after the merger and continued leading through the Delinea rebrand. He brings 25+ years of enterprise software and cybersecurity leadership experience, including roles in product development, SaaS operations, go-to-market strategy, and large-scale team management.

Corporate Status (2025-2026)

Delinea remains a market leader in the PAM space as of October 2025, holding the 7th consecutive "Leader" designation in the Gartner Magic Quadrant for Privileged Access Management (2025). The company has consistently achieved leadership status since at least 2019, with particularly strong marks for vision and ability to execute. In October 2025, Delinea held a Gartner Peer Insights rating of 4.7/5.0 (based on 132 reviews in the preceding 12 months), reflecting strong customer satisfaction.

The company remains privately funded and shows no current indication of a public offering in the near term. Ongoing product development and market expansion (including the Fastpath acquisition in 2024) indicate strong operational momentum through 2025-2026.

2. Product Portfolio

Delinea's product suite spans vaulting, endpoint privilege management, cloud identity, session management, and DevOps secrets. All products integrate with a common architecture and shared policy engine.

Core Products

Secret Server (Enterprise Password Vault)

Purpose: Centralized credential vault for privileged account lifecycle management
Key capabilities:

• Encrypted vault securing secrets (passwords, SSH keys, API tokens, certificates)
• Automated password rotation with vendor-specific templates (Active Directory, SQL Server, SAP, Oracle, cloud platforms)
• Privileged session management (PSM) with RDP/SSH protocol bridging
• Advanced session recording and auditing (including keystroke capture and enhanced session analytics)
• Dependency tracking and circular rotation for multi-step account credential changes
• Integration with Privilege Manager for unified endpoint privilege management
• Out-of-the-box integrations with 150+ target systems and applications

Deployment: Self-hosted (on-premises, VM, or containerized) or cloud-hosted cloud-integrated deployments
Typical use cases: Large enterprises managing thousands of service accounts, compliance-heavy environments (PCI-DSS, HIPAA, SOC 2, GDPR), financial institutions, healthcare systems

Privilege Manager (Endpoint Privilege & Application Control)

Purpose: Least-privilege enforcement and application control on workstations and servers
Key capabilities:

• Discovery and inventory of privileged accounts across endpoints (Windows, macOS, Linux, cloud workstations)
• Real-time privilege monitoring and enforcement on Windows, macOS, Linux, and cloud VMs
• Application allowlisting and blocking policies per user/group/device
• Just-in-time (JIT) privilege elevation (temporary elevation with automatic revocation)
• Policy-based enforcement for admin rights management
• Integration with Secret Server for silent authentication (users never handle passwords)
• Least privilege by default—users request elevation when needed, approval required
• Supports zero standing privileges (ZSP) architecture

Deployment: Agent-based (Windows, macOS, Linux); agentless APIs for cloud instances
Typical use cases: Organizations implementing zero-trust and least-privilege security postures, call centers and shared workstation environments, DevOps teams requiring temporary elevated access, managed service providers (MSPs) managing large fleets

Server Suite (Centrify Legacy: Cross-Platform PAM)

Purpose: Unified identity and privilege management across Windows, Linux, UNIX, and network devices
Key capabilities:

• Active Directory bridging—extends Windows AD to non-Windows environments
• LDAP directory integration and synchronization
• Kerberos authentication and single sign-on (SSO) across heterogeneous systems
• Centralized password management for service accounts on UNIX/Linux
• Privilege delegation and role-based access control (RBAC)
• Smart card and multi-factor authentication (MFA) support
• Group policy extension to non-Windows platforms
• Network device management (routers, firewalls, switches)

Deployment: Agent-based on each managed host plus policy server
Typical use cases: Large enterprises with legacy UNIX/Linux estates, financial services, telcos, organizations requiring deep AD integration with non-Windows systems

Account Lifecycle Manager (ALM)

Purpose: Automated service account provisioning, governance, and lifecycle
Key capabilities:

• Discovery of all service accounts across Windows, cloud, and multi-cloud environments (Azure, AWS, GCP)
• Self-service request and approval workflows for new service account creation
• Automated provisioning and decommissioning
• Policy-based access controls and segregation of duties (SoD) checks
• Regular access reviews and certification workflows
• Integration with Secret Server for credentials post-creation
• Compliance reporting for SOX, SOC 2, HIPAA, PCI-DSS

Deployment: Cloud-native SaaS or on-premises
Typical use cases: Financial institutions, healthcare organizations, large enterprises with regulatory requirements, DevOps teams managing hundreds of CI/CD service accounts

Connection Manager

Purpose: Ad-hoc secure remote session handling and routing
Key capabilities:

• Just-in-time access to remote systems via RDP, SSH, Kubernetes, and HTTP/HTTPS
• Session routing through bastion/jump hosts without exposing systems directly
• Browser-based access without client installation
• Integrated MFA and device compliance checks
• Automatic session termination after fixed duration or user logout
• Detailed session logging and audit trails

Deployment: SaaS or self-hosted
Typical use cases: DevOps engineers accessing cloud infrastructure, system administrators managing remote server farms, zero-trust network architectures

DevOps Secrets Vault (DSV)

Purpose: API-first secrets management for DevOps pipelines and microservices
Key capabilities:

• Cloud-native, API-as-a-Service secrets management
• Native Kubernetes integration with sidecar injection and secrets operator
• Support for Terraform, Ansible, Jenkins, GitLab CI, GitHub Actions, etc.
• Encryption-as-a-Service (EaaS) for at-rest and in-transit protection
• Automated secret rotation policies
• Fine-grained RBAC and API access tokens
• Audit logging and compliance reports
• Multi-region high-availability deployment (99.999% SLA via AWS DynamoDB global tables)

Deployment: Cloud SaaS only (AWS-backed, dual-region by default)
Typical use cases: Cloud-native teams, CI/CD pipeline security, microservices architectures, multi-tenant SaaS platforms

Cloud Suite (Delinea Cloud Authentication Service)

Purpose: Cloud identity and access management with zero-trust capabilities
Key capabilities:

• Cloud-based directory service (alternative to on-premises Active Directory)
• Multi-cloud identity federation (Okta, Entra ID, Ping Identity integrations)
• Zero-trust conditional access policies
• Just-in-time elevation in cloud environments
• Passwordless authentication (FIDO2, WebAuthn)
• Risk-based adaptive MFA
• Session recording for cloud application access

Deployment: SaaS only
Typical use cases: Cloud-first enterprises, hybrid multi-cloud environments, organizations phasing out on-premises AD

Supporting Products & Integrations

• Delinea Iris AI (August 2025 launch): AI-powered authorization agent providing real-time, context-aware access decisions; intelligent session auditing with threat detection; and adaptive access controls that adjust dynamically as user context changes. Features include behavior analysis, unusual command detection, and evidence-based access reasoning.
• Secret Server API & SDKs: REST API for custom integrations and automation
• Privilege Manager API: For custom policy enforcement and auditing workflows
• Connectors: 150+ pre-built integrations (Splunk, ServiceNow, Slack, Jira, Salesforce, PagerDuty, etc.)

3. Technical Architecture

Vault & Encryption Model

Core vault: Secret Server uses AES-256 encryption for secrets at-rest; TLS 1.2+ for in-transit encryption. Vault can be deployed on-premises (SQL Server, PostgreSQL, MySQL backends) or in Delinea-managed cloud infrastructure.

Key management: Encryption keys are separated from encrypted data and stored in a dedicated key vault module. Key rotation policies are configurable per organization.

HSM support: Enterprise deployments can leverage hardware security modules (HSMs) via PKCS#11 interfaces for enhanced key protection.

Multi-Factor Authentication (MFA)

Delinea integrates with major MFA platforms:

• RADIUS-based MFA (Duo, RSA SecurID, Microsoft Authenticator)
• LDAP/Active Directory MFA
• Push notifications and TOTP (time-based one-time passwords)
• Hardware security keys (FIDO2, YubiKey)
• Risk-based adaptive MFA (via Cloud Suite)

JIT elevation workflows enforce MFA at the point of access request approval, ensuring compromised credentials alone cannot grant elevated access.

Just-in-Time (JIT) Access Elevation

Architecture:

1. User requests temporary elevated access via Privilege Manager or Connection Manager UI
2. Request evaluated against policy (role, approval chain, business justification, device compliance, geo-location)
3. MFA challenged to confirm user identity
4. Approval chain executed (automated or manual) based on access level
5. Upon approval, temporary elevated credentials or privilege escalation granted
6. Session recorded and monitored in real-time
7. Automatic privilege revocation upon session timeout or logout

Policy engine: Hub-and-spoke model with centralized Policy Definition Point (PDP) and distributed Policy Enforcement Points (PEPs) on each endpoint, aligned with NIST SP 800-207 zero-trust architecture.

Session Recording & Auditing

• Protocol-level capture: RDP, SSH, Telnet, Citrix ICA, X11 terminal sessions
• Keystroke logging: Optional advanced keystroke capture for high-security environments
• Intelligent auditing (Iris AI): Automatic analysis of recorded sessions to flag elevated commands, suspicious behaviors, deletions, file transfers, and unusual secret access patterns; results delivered in seconds with evidence heatmaps
• Integration: Seamless integration with SIEM platforms (Splunk, Azure Sentinel, QRadar) via syslog, syslog-ng, or API
• Compliance archival: Long-term retention (configurable) with WORM (write-once-read-many) support for regulatory compliance

Active Directory Bridging

Delinea Server Suite provides AD bridging for cross-platform identity consolidation:

Supported platforms: Windows, Linux (RHEL, Ubuntu, Debian, CentOS), UNIX (Solaris, HP-UX, AIX), macOS

Key components:

• NSS/PAM modules on non-Windows hosts for local user/group lookup via LDAP against Active Directory
• Kerberos integration for SSO and passwordless authentication
• Group policy extension to non-Windows systems
• Smart card login support extended to Linux/UNIX
• Dynamic home directory provisioning based on AD attributes

Architecture: Typically a local Server Suite Agent (adclient) on each non-Windows host communicates via LDAP and Kerberos with the centralized Active Directory domain controller; optional Delinea Policy Server for advanced policy distribution.

DevOps Secrets Vault Architecture (DSV)

Infrastructure:

• SaaS-only, hosted on AWS
• Dual-region, active-active deployment for 99.999% uptime
• AWS DynamoDB global tables for data replication with <1-second RPO/RTO
• Auto Route 53 failover if primary region fails (<1 minute failover time)
• Auto-scaling to demand

Core components:

• Vault Engine: REST API endpoint for secret storage/retrieval; auto-scales on demand
• DSV Agents (Engines): Lightweight agents deployed on customer infrastructure or CI/CD platforms; maintain real-time bidirectional communication with vault; execute tasks on remote systems (password rotations, config updates)
• Encryption: TLS 1.2+ in-transit; AES-256 at-rest; customer-managed or Delinea-managed keys

Integrations:

• Kubernetes: native K8s Operator and sidecar injection
• Docker: Docker secret provider
• Terraform: official Terraform provider
• CI/CD: Jenkins, GitLab Runner, GitHub Actions, CircleCI, Azure Pipelines
• Configuration management: Ansible, Puppet, Chef

Iris AI Architecture (2025+)

Delinea Iris AI is not a chatbot but an integrated neural component across the platform:

Data inputs:

• User identity and role
• Device posture and location
• Historical behavior patterns
• Business context (time of day, project associations)
• Real-time risk signals (failed logins, anomalous IP, suspicious privilege use)
• Active Directory and cloud directory metadata
• Recorded session activity

Authorization engine: Real-time context evaluation during every access request; outputs evidence-based approval/denial with clear reasoning; supports dynamic elevation (e.g., grant lower privilege initially, escalate on justification).

Auditing engine: Analyzes recorded sessions post-facto to detect elevated commands, file transfers, unusual secrets access, and failed authorizations; produces heatmaps and summaries for security teams.

Policy adaptation: Can dynamically adjust access policies based on detected risk patterns (e.g., tighten MFA requirements if risk score rises).

4. Competitive Position vs. Major Competitors

vs. CyberArk

CyberArk remains the market leader (Gartner 2025) with the broadest vision and deepest enterprise integrations.

Delinea strengths:

• Simpler deployment (days vs. weeks)
• Lower total cost of ownership (especially mid-market)
• Tighter Windows/AD integration via Server Suite heritage
• Faster time-to-value
• Strong endpoint privilege management (Privilege Manager)

CyberArk strengths:

• Broader cloud ecosystem integrations
• More extensive ITSM/SIEM pre-built connectors
• Market dominance in financial services and heavily regulated sectors
• Larger professional services ecosystem
• Advanced threat analytics (behavioral analysis)

Verdict: Delinea best for mid-market, fast deployment, and hybrid AD-heavy environments; CyberArk best for large enterprises with complex multi-cloud and ITSM ecosystems.

vs. BeyondTrust

BeyondTrust offers a balanced approach with strong endpoint privilege management and remote support unification.

Delinea strengths:

• Superior cloud secrets management (DSV)
• Better zero-trust architecture (Iris AI)
• Stronger vaulting for password rotation
• Better multi-OS support via Server Suite

BeyondTrust strengths:

• Best-in-class endpoint privilege management (arguably parity or edge case)
• Strong remote support integration (single console for EPM + remote access)
• Simpler GUI for endpoint policies
• Strong in financial services

Verdict: Comparable in EPM; Delinea stronger in cloud/DevOps/vaulting; BeyondTrust stronger in remote support and unified endpoint solutions.

vs. HashiCorp Vault

HashiCorp Vault is a widely-adopted open-source secrets management tool for DevOps.

Delinea DSV strengths:

• Fully managed SaaS (no infrastructure to run)
• Native Kubernetes operator with sidecar injection out of box
• AI-powered auditing and anomaly detection
• Pre-built integrations (Terraform, Ansible, etc.)
• Higher SLA (99.999%)

HashiCorp Vault strengths:

• Open-source (audit ability, no vendor lock-in)
• Can run entirely on-premises
• Large OSS community
• Advanced policy language (HCL)
• Free tier available

Verdict: DSV better for managed simplicity and high SLA; Vault better for on-premises, open-source requirements, and control.

vs. Saviynt

Saviynt specializes in Identity Governance and Administration (IGA) and access reviews.

Delinea strengths:

• Deeper technical PAM (session recording, endpoint privilege management)
• Better for just-in-time elevation workflows
• Stronger DevOps secrets integration

Saviynt strengths:

• Superior access certification and review processes
• Deeper role-based provisioning workflows
• Better for large-scale SOD enforcement
• More granular compliance reporting

Verdict: Delinea + Saviynt often complementary (Delinea bought Fastpath IGA in 2024 to close this gap); Delinea stronger on technical access, Saviynt stronger on governance reviews.

Gartner Magic Quadrant Position (2025)

Delinea: Leader (7th consecutive year)

• High "Ability to Execute"; mid-to-high "Completeness of Vision"
• Noted strengths: ease of deployment, secret management, Iris AI innovation
• Areas for growth: multi-cloud ecosystem depth, advanced threat analytics

Competitive cluster: CyberArk (strongest Completeness and Execution), Delinea (strong in both), BeyondTrust (strong Execution, growing Vision)

5. Certifications & Training

Delinea Security Academy

Delinea offers a formal Security Academy certification program focused on product knowledge and technical proficiency.

Certification Tiers

1. Delinea Certified Associate (Secret Server & Privilege Manager)

   • Format: Online, self-paced or instructor-led
   • Duration: 2-4 weeks typical completion
   • Content: Product overview, deployment basics, policy configuration, integrations
   • Exam: Multiple-choice, typically 60-80 questions, 75% pass threshold
   • Cost: ~USD $500-$1,000 (vendor pricing not publicly listed; third-party courses vary USD $300–$1,200)
   • Renewal: Typically 2-3 years; recertification exam required

2. Delinea Certified Engineer (Secret Server & Privilege Manager)

   • Format: Instructor-led bootcamp or private remote training
   • Duration: 3-5 days (full-time intensive)
   • Content: Advanced architecture, complex deployments, troubleshooting, security hardening, performance tuning, custom integrations
   • Hands-on labs: Mandatory (live lab environment with sandbox infrastructure)
   • Prerequisite: Delinea Certified Associate or equivalent PAM experience
   • Cost: ~USD $3,000–$5,000 per person (venue, instructor, materials included; exact pricing by request only)
   • Renewal: 3 years; recertification exam or continuing education credits

3. Delinea Certified Solutions Architect

   • Format: Advanced instructor-led (by invitation, partner-focused)
   • Duration: 2-3 days
   • Content: Enterprise design patterns, multi-cloud architecture, competitive positioning, pre-sales skills
   • Prerequisite: Delinea Certified Engineer or 5+ years PAM experience
   • Cost: Not publicly disclosed; varies by engagement
   • Target audience: Partner sales engineers, pre-sales consultants, internal Delinea architects

Delinea Partner Training (Channel Program)

• Partner Sales Certification: 1-2 days, covers positioning vs. competitors, sales scenarios, ROI calculation
• Partner Engineer Certification: Advanced technical training for systems integrators and MSPs
• Account Manager Training: Go-to-market strategy, customer success best practices
• Cost: Typically bundled with partner agreement; not a la carte

Third-Party & Online Bootcamp Providers

Major training companies offer Delinea courses:

• MindMajix: Self-paced Secret Server certification (~USD $400)
• Gologica: Online Secret Server training with labs (~USD $500)
• SecApps Learning: Secret Server bootcamp with certification (~USD $800)
• Multisoft Systems: Instructor-led Privilege Manager training (~USD $1,200 per seat)
• TechSolidity: Hands-on Delinea PAM bootcamp (pricing on request)

Exam Details (General)

• Proctored? Yes (for certification exams); supervised online or in-person test centers
• Retake policy: Typically 1 free retake; subsequent retakes ~USD $100-$200
• Expiration: Certifications valid 2-3 years depending on track
• Continuing education: Approved Delinea training, conference attendance, or exam retake

6. Career Roles: Privileged Access Management Engineer

Role Definition

A PAM Engineer (also called PAM Architect, Identity & Access (IAM) Engineer, or Privilege Management Specialist) designs, deploys, and operates privileged access management systems for organizations—typically in mid-to-large enterprises, financial services, healthcare, critical infrastructure, or government.

Core Responsibilities

• Design & Architecture: Map organizational privilege requirements; choose vault, endpoint, and session recording components; design high-availability and disaster recovery
• Deployment & Configuration: Install and configure Secret Server, Privilege Manager, Server Suite, DSV, or Account Lifecycle Manager; integrate with Active Directory, cloud directories, and existing systems
• Policy Development: Define baseline privilege policies; create role-based access control (RBAC) models; design just-in-time elevation workflows
• Integration: Connect PAM systems to SIEM, ITSM, HR systems, and cloud platforms; build automation via APIs and custom scripts
• Operations & Maintenance: Monitor vault health, manage secret rotation, troubleshoot authentication failures, patch and upgrade systems
• Compliance & Audit: Ensure adherence to regulatory frameworks (SOX, HIPAA, PCI-DSS, GDPR, SOC 2); generate audit logs; participate in access reviews
• Security Hardening: Implement MFA, encryption, network segmentation, and zero-trust principles

Core Skills

Technical:

• Active Directory and identity management (LDAP, Kerberos, DNS)
• Networking fundamentals (TCP/IP, firewalls, VLANs, load balancing)
• Windows and Linux system administration
• SQL databases (for vault backend configuration)
• Scripting (PowerShell, Bash, Python)
• API integrations and REST concepts
• Cloud platforms (Azure, AWS, GCP, Kubernetes)
• SIEM and log aggregation

Security:

• Zero-trust principles (NIST SP 800-207)
• Least privilege concept and enforcement
• Encryption fundamentals (symmetric, asymmetric, PKI)
• Authentication methods (MFA, passwordless, SSO)
• Compliance frameworks (SOX, HIPAA, PCI-DSS, ISO 27001)
• Threat modeling and risk assessment

Soft Skills:

• Communication with non-technical stakeholders
• Project management and change control
• Vendor/consultant management
• Problem-solving and troubleshooting

Education & Certifications

Entry-level (0-2 years):

• CompTIA Security+
• Microsoft Certified: Windows Server
• Cisco CCNA or similar networking
• Any IT operations background (help desk, system administrator)

Mid-career (2-5 years):

• Delinea Certified Associate (Secret Server or Privilege Manager)
• CISSP (Certified Information Systems Security Professional)
• CompTIA CASP+
• Cloud certifications (AWS Security Specialty, Azure Security Engineer)

Senior/Architect (5+ years):

• Delinea Certified Engineer
• Delinea Certified Solutions Architect
• CISSP or ISSAP (Information Systems Security Architecture Professional)
• Advanced cloud certifications
• Industry-specific: HCISPP (Healthcare), CCSK (Cloud Security)

Salary Ranges (2025-2026)

United States (USD)

Data source: Glassdoor (USD $141,921 median for PAM Engineer), ZipRecruiter (USD $115k–$263k range), Talent.com (USD $130k–$220k range); variance by metro area, company size, and specialization.

Geographic multipliers (approximate):

• San Francisco Bay Area / NYC: +20–30% vs. national average
• Austin, Seattle, Denver: +10–15%
• Secondary metros (Atlanta, Dallas, Phoenix): -5–10%
• Remote (distributed team): Often tied to headquarters or median of service area

South Africa (ZAR)

Specific PAM engineer salary data for South Africa is limited in public sources. Comparable engineering roles:

Data source: PayScale (Professional Engineer in ZA: ZAR 412k–ZAR 773k base; security specialization suggests +20–40% premium); TimeDoctor (average salary South Africa 2026: ~ZAR 450,000); Glassdoor (limited ZA-specific data for PAM roles).

Considerations:

• PAM roles in South Africa are less common than in North America; may attract foreign expat/remote premiums
• Bilingual (English + Afrikaans) can command +5–10% premium in enterprise roles
• Contract/consulting rates often 30–50% higher than permanent

Job Market Outlook

Demand: Strong. PAM is a compliance-critical function; regulatory pressure (PCI-DSS, SOX, GDPR, HIPAA) drives adoption across industries.

Growth factors:

• Zero-trust architecture adoption
• Cloud migration and multi-cloud complexity
• DevOps and microservices scaling
• Insider threat and privileged abuse incidents increasing C-suite focus
• Regulatory compliance tightening globally

Career trajectory: PAM Engineer → Principal Engineer / Solutions Architect → Director of Identity & Access → CISO or VP of Security

7. Recent News & Developments (2025-2026)

Fastpath Acquisition (June 2024, announced Feb 2024)

Delinea completed the acquisition of Fastpath, an Identity Governance and Administration (IGA) platform, in June 2024. Fastpath specializes in access reviews, access certification, request/approval workflows, and SoD (segregation of duties) enforcement.

Strategic rationale:

• Delinea previously focused on technical access (vault, endpoint, session recording)
• Fastpath adds governance layer (who should have access, access reviews, compliance certification)
• Combined product enables end-to-end identity lifecycle: provision → use → review → decommission
• Fastpath's risk intelligence complements Delinea's Iris AI
• Strengthens position against Saviynt and Okta Identity Governance

Current status: Fastpath remains available as standalone product; integration into broader Delinea platform ongoing (2025-2026).

Impact: Delinea now offers fuller suite competing with CyberArk's broader ecosystem.

Delinea Iris AI Launch (August 2025)

Announced in August 2025, Delinea Iris AI is a significant platform-wide innovation:

Components:

1. Iris Authorization: Context-aware real-time access decisions—evaluates user, device, location, behavior, policy alignment; provides evidence-based approval/denial; supports dynamic elevation
2. Iris Auditing: AI-driven session analysis—detects elevated commands, suspicious behaviors, file transfers, unauthorized secret access within seconds; highlights risk heatmaps and summaries
3. Iris Adaptive Control: Dynamic policy adjustment based on risk signals

Launch timing: Feature previews available to customers in August 2025; broader rollout Q3–Q4 2025

Market impact:

• First AI-powered authorization component in PAM (ahead of CyberArk and BeyondTrust at launch)
• Differentiator in Gartner MQ 2025 assessment (cited as reason for continued leadership)
• Increases ease of use for security teams (less manual alert review)

Leadership & Organizational Changes

No major leadership changes announced in 2025-2026 beyond Art Gilliland's continued tenure as CEO. Company remains stable and focused on product development and acquisition integration.

Market & Competitive Movements

• CyberArk: Continued focus on cloud ecosystem; expanded threat analytics; increased M&A activity (various smaller acq.)
• BeyondTrust: Strong momentum in endpoint privilege management; growing remote support suite
• Okta: Expanded Identity Governance via internal development + 1Password acquisition (credentials management); positioning for broader IAM consolidation
• Saviynt: Shifted focus to AI-powered access controls; strong in large enterprise governance

Delinea positioning: Fast-mover on AI; strong in hybrid/on-premises + cloud; closing governance gap via Fastpath; competitive but not yet market-leading on pure governance depth

8. Learning Path (PAM Engineer Specialization)

Phase 1: Foundation (3-6 months)

Goal: Understand PAM concepts, Windows/Linux admin, identity fundamentals

Topics:

• IT Operations basics (ITIL)
• Windows Server administration (AD, Group Policy, DNS, DHCP)
• Linux administration (CentOS/RHEL, user/group management, sudo, SSH keys)
• Networking fundamentals (IP, DNS, firewalls, VLANs)
• Introduction to IAM concepts (authentication, authorization, MFA)
• Least privilege principle and zero-trust overview

Certifications:

• CompTIA A+ (foundational IT)
• CompTIA Network+ (networking)
• CompTIA Security+ (security fundamentals)
• Microsoft Windows Server Admin courses (70-740, 70-741)

Resources:

• "The Phoenix Project" (Gene Kim, Kevin Behr, George Spafford)—understanding enterprise IT operations
• Microsoft Learn paths (Windows Server, Active Directory)
• Pluralsight Security+ prep course
• TryHackMe or HackTheBox (hands-on labs)

Phase 2: PAM Fundamentals (3-4 months)

Goal: Master Delinea Secret Server and Privilege Manager basics

Topics:

• Secret Server architecture, deployment, and configuration
• Vault encryption and key management
• Password rotation workflows and templates
• Privilege Manager endpoint privilege policies
• Active Directory integration
• Basic RBAC and segregation of duties (SoD)
• Compliance basics (PCI-DSS, HIPAA, SOX password requirements)

Certifications:

• Delinea Certified Associate (Secret Server)
• Delinea Certified Associate (Privilege Manager)

Resources:

• Delinea official documentation (docs.delinea.com)
• Delinea Certified Associate course (online self-paced or instructor-led)
• Third-party bootcamps (MindMajix, Gologica, SecApps Learning)
• Hands-on lab: deploy Secret Server in Docker or VM; integrate with Active Directory; configure password rotation for 3-5 target systems

Phase 3: Intermediate Architecture & Integration (4-6 months)

Goal: Design and deploy multi-component solutions; integrate with enterprise systems

Topics:

• Just-in-time (JIT) access design and implementation
• Privilege Manager policy design for complex organizational structures
• Active Directory bridging (Server Suite for Linux/UNIX)
• Multi-factor authentication (MFA) integration
• Session recording and auditing setup
• SIEM integration (Splunk, Azure Sentinel, Elastic)
• API-driven integrations and custom automation
• High-availability and disaster recovery design

Certifications:

• Delinea Certified Engineer (Secret Server & Privilege Manager)
• Optional: CompTIA CASP+ (advanced security)

Resources:

• Delinea Certified Engineer bootcamp (3-5 days, hands-on lab-intensive)
• Delinea documentation (architecture guides, API docs)
• "Zero Trust Architecture" (NIST SP 800-207)
• "Defense in Depth" (Schneier, Kelsey)—advanced security thinking
• Hands-on lab: deploy Secret Server + Privilege Manager in HA config; integrate with SIEM; test JIT elevation workflows; configure session recording and audit export

Phase 4: Advanced Specializations (ongoing, 6+ months)

Pick 2-3 specializations aligned with career goals:

A. Cloud & DevOps PAM

• Focus: DevOps Secrets Vault (DSV), Kubernetes integration, CI/CD pipeline security, cloud identity (Azure AD, AWS IAM, GCP)
• Certifications: AWS Security Specialty, Azure Security Engineer, Kubernetes Security (CKSA)
• Projects: Deploy DSV for Terraform/Ansible workflows; Kubernetes sidecar injection; GitHub Actions secret injection

B. Enterprise Governance

• Focus: Account Lifecycle Manager (ALM), Fastpath IGA, access reviews, SoD enforcement, compliance automation
• Certifications: CISSP, CCSK (cloud), HCISPP (healthcare), ISO 27001 Lead Implementer
• Projects: Design ALM for 500+ service accounts; build access review workflows; compliance reporting dashboard

C. Security Architecture & Design

• Focus: Zero-trust architecture design, threat modeling, architecture decision records, multi-cloud PAM design
• Certifications: ISSAP (CISSP concentration), Delinea Certified Solutions Architect
• Projects: Design enterprise-wide zero-trust PAM for 5,000+ users; threat model exercise; competitive analysis writeup

D. DevSecOps & Automation

• Focus: Infrastructure-as-Code (Terraform, Ansible), secret rotation automation, custom integrations via APIs and SDKs
• Certifications: HashiCorp Certified: Terraform Associate, HashiCorp Certified: Vault Associate
• Projects: IaC for Secret Server; custom Python integrations; auto-remediation workflows

Phase 5: Leadership & Architecture (3+ years in-role)

Goal: Move toward Principal Engineer, Solutions Architect, or Security Leader roles

Topics:

• Vendor management and RFP evaluation
• Customer success and account architecture
• Security strategy and enterprise risk
• Pre-sales technical consulting
• Team leadership and mentoring
• Industry trends and competitive intelligence

Certifications:

• Delinea Certified Solutions Architect
• CISSP or ISSAP (if not done earlier)
• Advanced cloud certs (AWS Solutions Architect Professional, Azure Solutions Architect Expert)
• Optional MBA or executive education in technology/security strategy

Resources:

• "Enterprise Architecture as Strategy" (Ross, Weill, Robertson)
• "The Art of Enterprise Information Architecture" (Zachman)
• Industry analyst reports (Gartner, Forrester, IDC)
• Conference participation (RSAC, Black Hat, Delinea-sponsored events, industry user groups)
• Internal certification teaching or external thought leadership (blogs, speaking)

Recommended Reading

Foundational:

• "The Phoenix Project" (Gene Kim, Kevin Behr, George Spafford)—operations culture and DevOps thinking
• "The Unicorn Project" (Gene Kim)—modern IT and fast feedback
• "Security in Software Engineering" (Gary McGraw, John Steven)—secure design

PAM-Specific:

• NIST SP 800-207 "Zero Trust Architecture"
• NIST SP 800-63B "Authentication and Lifecycle Management"
• CIS Benchmarks (Active Directory, Windows, Linux, Cloud)
• Delinea whitepapers and case studies (available at delinea.com/resources)

Advanced:

• "The Art of Enterprise Information Architecture" (Zachman)
• "Enterprise Architecture as Strategy" (Ross, Weill, Robertson)
• "Threat Modeling: Design for Security" (Adam Shostack)
• Industry standards (ISO 27001, COBIT, ITIL)

9. Sources

Official Delinea & Parent Company

• Delinea corporate homepage: https://delinea.com
• Delinea products: https://delinea.com/products
• Delinea training & certification: https://delinea.com/training/certification-program
• Delinea Secret Server: https://delinea.com/products/secret-server
• Delinea Privilege Manager: https://delinea.com/products/privilege-manager
• Delinea DevOps Secrets Vault: https://delinea.com/products/devops-secrets-management-vault
• Delinea Account Lifecycle Manager: https://delinea.com/products/account-lifecycle-manager
• Delinea Server Suite: https://delinea.com/products/server-suite
• Delinea Cloud Suite: https://delinea.com/products/cloud-suite
• Delinea Connection Manager: https://delinea.com/products/connection-manager
• Delinea Iris AI: https://delinea.com/products/delinea-platform-iris-ai
• Delinea leadership: https://delinea.com/leadership

News & Press Releases

• Delinea news: https://delinea.com/news
• "ThycoticCentrify is now Delinea": https://delinea.com/news/thycoticcentrify-is-now-delinea (2022 rebrand announcement)
• "Delinea Named a Leader in 2025 Gartner Magic Quadrant for PAM": https://www.globenewswire.com/news-release/2025/10/16/3168107/0/en/Delinea-Named-a-Leader-in-2025-Gartner-Magic-Quadrant-for-Privileged-Access-Management-for-Seventh-Consecutive-Time.html (Oct 2025)
• "Delinea Completes Acquisition of Fastpath": https://delinea.com/news/delinea-completes-acquisition-of-fastpath-modernize-identity-security (June 2024)
• "Delinea Iris AI" announcement: https://www.globenewswire.com/news-release/2025/08/05/3127330/0/en/Delinea-Unveils-Delinea-Iris-AI-to-Make-Identity-Security-Simpler-Stronger-and-Smarter.html (Aug 2025)

Technical Documentation

• Delinea documentation library: https://docs.delinea.com
• Secret Server & Privilege Manager integration: https://docs.delinea.com/online-help/integrations/delinea/privilege-manager-secret-server.htm
• DevOps Secrets Vault architecture: https://docs.delinea.com/online-help/architecture/secret-server/secret-server-dsv/index.htm
• DSV architecture & security: https://docs.delinea.com/online-help/devops-secrets-vault/concepts/arch-and-security/index.htm
• Active Directory bridging: https://delinea.com/what-is/active-directory-bridging
• Server Suite AD bridging architecture: https://docs.delinea.com/online-help/server-suite/install/deployment/architecture/index.htm
• Just-in-time access: https://delinea.com/what-is/just-in-time-access

Competitive & Market Research

• Gartner Magic Quadrant PAM 2025: https://delinea.com/resources/gartner-magic-quadrant-pam
• "Delinea: A PAM Leader in 2025 Gartner Magic Quadrant": https://delinea.com/blog/pam-leader-in-2025-gartner-magic-quadrant
• Gartner Peer Insights for Delinea PAM: https://www.gartner.com/reviews (4.7/5.0 as of Oct 2025)
• CyberArk vs Delinea vs BeyondTrust comparison: https://techcloudpro.com/blog/cyberark-vs-delinea-vs-beyondtrust-pam-comparison/ (2026 update)
• "CyberArk vs Delinea vs BeyondTrust: Which PAM Tool to Learn in 2026?": https://www.identityskills.com/blog/cyberark-vs-beyondtrust-vs-delinea-which-pam-tool-should-you-learn-in-2026/
• "Top 7 Privileged Access Management Solutions 2026": https://www.keepersecurity.com/blog/2025/09/10/top-privileged-access-management-solutions/
• BeyondTrust vs Delinea comparison: https://heimdalsecurity.com/blog/beyondtrust-vs-delinea/
• "CyberArk, BeyondTrust, and Delinea Dominate Gartner MQ for PAM": https://www.bankinfosecurity.com/cyberark-beyondtrust-delinea-dominate-gartner-mq-for-pam-a-23160

Salary & Career Data

• Glassdoor PAM Engineer salary: https://www.glassdoor.com/Salaries/pam-engineer-salary-SRCH_KO0,12.htm
• ZipRecruiter PAM Engineer: https://www.ziprecruiter.com/Jobs/Privileged-Access-Management-Engineer
• Talent.com PAM Engineer salaries: https://www.talent.com/salary?job=pam+engineer
• PayScale Professional Engineer (South Africa): https://www.payscale.com/research/ZA/Job=Professional_Engineer/Salary (ZAR salary baseline)
• TimeDoctor average salary South Africa 2026: https://www.timedoctor.com/blog/average-salary-in-south-africa/

Standards & Frameworks

• NIST SP 800-207 "Zero Trust Architecture": https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
• NIST SP 800-63B "Authentication and Lifecycle Management": https://pages.nist.gov/800-63-3/sp800-63b.html
• CIS Controls: https://www.cisecurity.org/cis-controls/
• ISO/IEC 27001:2022 Information Security Management: https://www.iso.org/standard/27001

Training & Education Providers

• Delinea Security Academy: https://delinea.com/training
• MindMajix Delinea training: https://mindmajix.com/thycotic-secret-server-training
• Gologica Delinea Secret Server: https://www.gologica.com/course/thycotic-secret-server-training/
• SecApps Learning PAM bootcamp: https://secappslearning.com/course/delinea-secret-server-pam-selfpaced-online-training
• Multisoft Systems Delinea training: https://www.multisoftsystems.com/cyber-security/thycotic-secret-server-training
• TechSolidity Delinea PAM sessions: https://techsolidity.com/delinea-training

CEO & Leadership Information

• Art Gilliland LinkedIn: https://www.linkedin.com/in/artgilliland
• Art Gilliland Crunchbase: https://www.crunchbase.com/person/art-gilliland
• Delinea leadership page: https://delinea.com/leadership

Delinea Blogs & Thought Leadership

• Delinea blog (general): https://delinea.com/blog
• "Iris AI: Practical AI for the Modern Enterprise": https://delinea.com/blog/iris-ai-practical-ai-for-the-modern-enterprise
• "Zero Standing Privileges with JIT Access": https://delinea.com/blog/just-time-jit-zero-standing-privileges
• "Just-in-Time Access in a Zero-Trust World": https://delinea.com/blog/just-in-time-access-strengthening-security-in-a-zero-trust-world
• "What is Active Directory Bridging?": https://delinea.com/blog/ad-bridging
• "AD Bridging and Linux/Unix Identity Consolidation": https://delinea.com/demos/server-suite-demo-ad-bridging-linux-unix
• "Layered Privilege Security": https://delinea.com/blog/layered-privilege-security-with-secret-server-and-privilege-manager

Document metadata:

• Compiled: 2026-04-30
• Scope: Delinea PAM ecosystem, Q4 2025 status
• Audience: PAM engineers, identity architects, IT governance teams
• Citation compliance: All claims tied to vendor, analyst, or public sources (URLs included)
• Notes on salary data: South Africa ZAR figures are extrapolations due to limited public PAM-specific data for that market; USD figures sourced from aggregated job boards

10. Additional Free Training (YouTube + Vendor Channels)

Official Delinea & Vendor Channels

• Delinea Official YouTube: https://www.youtube.com/channel/UCm0K3Fhc9y8BIrovwPx4wpg

  • Featured playlists: "Delinea's Approach To PAM User Training", "Delinea's Privileged Access Management Strategy", "Privileged Access Management (PAM) | Delinea Secret Server | Use Cases"

• Delinea Video Resources Hub: https://delinea.com/videos — centralized access to all PAM strategy and technical videos

• Delinea Community (Secret Society): https://community.delinea.com/knowledge-base

  • Free knowledge base access (no account required for browsing)
  • Hands-on guides, documentation, troubleshooting resources
  • Free community forums for peer support

• Delinea Free Trial & Sandbox: https://delinea.com/secret-server-free-trial

  • 10-user Secret Server trial (30 days); includes credential vault, user roles, auditing, auto-discovery, password rotation
  • Full feature access for hands-on lab work

• Delinea e-Learning Platform: https://delinea.com/training — free video courses + quizzes for all customers and partners covering vault, endpoint privilege, identity discovery

Third-Party Security YouTube Channels (PAM / IAM / Active Directory)

• Identra (SailPoint IAM focus): https://www.youtube.com/@identraIAM

  • Step-by-step SailPoint IdentityIQ tutorials, IGA project walkthroughs, career guidance

• Identities & Access (One Identity): https://www.youtube.com/channel/UC... (see One Identity channel for IAM, IGA, ADMS, PAM content)

  • Identity Governance & Administration (IGA), PAM, Active Directory security, IGA case studies

• John Hammond (Cybersecurity researcher, Huntress): https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw

  • Covers malware analysis, dark web research, ethical hacking; some PAM/Keeper PAM promotional content; general privilege escalation and lateral movement tactics

• Identity at the Center Podcast: https://identityatthecenter.com/ (podcast series on identity security, IAM industry news)

Summary

Free YouTube & Community Resources:

• Delinea official: strategy talks, product demos, use-case walkthroughs
• Community portal: knowledge base, peer forums, vendor docs
• Third-party IAM channels: broader identity security context (SailPoint, Azure AD, privilege management)
• No direct cost to access videos, community, or free trial

11. Additional Paid Course Platforms

Udemy

Privileged Account (Access) Management (PAM) Courses:

• Multiple PAM courses available; search query "privileged access management" returns 40+ options
• Typical price: USD $15–$80 (frequent promotions; instructor-led pricing varies)
• Coverage: remote access, session recording, audit, automated password rotation, compliance
• Example: https://www.udemy.com/course/privileged-account-access-management-pam/ and https://www.udemy.com/course/privileged-access-managementmastering-security-fundamentals/
• Note: No Delinea-specific courses found on Udemy; courses cover generic PAM concepts and competing platforms (CyberArk, BeyondTrust)

Pluralsight

Privileged Access Management (PAM) Learning Path: https://www.pluralsight.com/paths/privileged-access-management-pam

• Structured learning path covering PAM components, security, automation, threat defense
• Modules: "PAM Components & Architecture", "PAM Security & Automation", "PAM Against Modern Threats"
• Price: Pluralsight subscription (USD $299/year individual; enterprise pricing varies)
• Specific course: PAM Secure Implementation — covers credential vaulting, session monitoring, risk-based access

Identity and Access Management (IAM) Learning Path: https://www.pluralsight.com/professional-services/security/identity-and-access-management

• Broader IAM context; complements PAM training

Coursera

Coursera PAM / Identity Courses:

• Direct PAM-specific courses were not prominently featured in search results
• Recommendation: Search Coursera directly for "Privileged Access Management", "Identity Management", or "Azure AD" courses
• Typical price: USD $39–$99 per course (audit free; certificate paid)
• Access: Most courses include video, peer forums, graded assignments

CBT Nuggets

CBT Nuggets Platform: https://www.cbtnuggets.com/all-courses

• No specific PAM courses returned in search results
• Recommendation: Browse their full catalog directly; they offer extensive IT security and network training
• Typical price: USD $59/month or $299/year subscription

Alternative Platforms with PAM Content

• Cybrary (Free): https://www.cybrary.it/course/privileged-access-management

  • Free Privileged Access Management course with hands-on labs
  • Covers PAM fundamentals, best practices, industry standards

• Oxford Computer Training: https://www.oxfordcomputertraining.com/courses/privileged-access-management-pam/

  • Instructor-led PAM for Microsoft Identity Manager (MIM) environments
  • Price on request

• Red Education: https://www.rededucation.com/cyberark/privileged-access-management-pam-administration/

  • CyberArk PAM administration focus
  • Price on request

• Bravura Security: https://www.bravurasecurity.com/services/learn/pam-intro

  • Introductory PAM training
  • Free resources available

Summary

Paid Platforms with PAM Content:

• Pluralsight: USD $299/year; comprehensive PAM learning path + general IAM
• Udemy: USD $15–$80 per course; many options but mostly vendor-agnostic
• Cybrary: Free option with hands-on labs
• Coursera: USD $39–$99 per course; audit free; strong on identity courses; direct PAM courses limited
• CBT Nuggets / Oxford / Red Education: Specialized platforms; pricing varies; check directly

12. Books — Full Citations (PAM & Identity Security)

Citations Notes:

• Haber's "Attack Vectors" series (Privileged, Identity, Cloud, Asset) are the most authoritative foundational books for PAM/identity/compliance professionals; all published by Apress (Springer Nature)
• NIST SP 800-207 is the official U.S. zero-trust architecture standard; free PDF
• Schneier & Kelsey's Defense in Depth (1999) remains influential for defense-in-depth security thinking
• Shostack's Threat Modeling (2014) is standard for architectural threat assessment
• Phoenix Project & Unicorn Project (Gene Kim) introduce DevOps culture and IT operations mindset; foundational for SRE/DevOps engineers moving into PAM/identity

13. ZAR Salary Detail (South Africa)

Identity & Security Engineer Salary Ranges (ZAR, 2026)

Key Observations

1. PAM-Specific Data Gap: Direct "Privileged Access Management Engineer" salary data is scarce in South African job portals (Pnet, CareerJunction, PayScale ZA). Identity/IAM engineer roles are the closest proxy, typically commanding +15–40% premium over general IT engineer roles due to specialization demand.

2. Industry Context: Security roles in South Africa have seen sustained demand from financial services (Johannesburg), government, telecommunications, and large enterprises. Premium roles (architect, solutions engineer) attract +30–50% above standard engineer base.

3. Geographic Variation:

   • Johannesburg / Gauteng: Highest concentration of security jobs; baseline data reflects Johannesburg premium
   • Cape Town: Similar demand; slightly lower average (–5% vs. Johannesburg)
   • Durban / KwaZulu-Natal: Lower baseline; -10% vs. Johannesburg

4. Bilingual Premium: English + Afrikaans fluency commands +5–10% in enterprise environments.

5. Consulting/Contract Premium: Short-term consulting or contract rates typically +30–50% above permanent salary (ZAR 650k–1.5M annually for mid-senior roles).

Sources

• Glassdoor: https://www.glassdoor.com/Salaries/johannesburg-south-africa-information-security-engineer-salary-SRCH_IL.0,25_IM1023_KO26,55.htm; https://www.glassdoor.com/Salaries/south-africa-security-engineer-salary-SRCH_IL.0,12_IN211_KO13,30.htm
• PayScale: https://www.payscale.com/research/ZA/Job=Cyber_Security_Engineer/Salary; https://www.payscale.com/research/ZA/Job=Security_Engineer/Salary
• SalaryExpert (ERI): https://www.salaryexpert.com/salary/job/identity-and-access-management-engineer/south-africa/durban; https://www.salaryexpert.com/salary/job/information-security-engineer/south-africa
• BusinessTech 2026 Salary Guide: https://businesstech.co.za/news/business/850070/what-people-earn-across-114-jobs-in-south-africa-in-2026-with-some-earning-r125000-a-month/
• Pnet 2026 Salary Guide: https://www.bizcommunity.com/article/pnet-2026-salary-guide-insights-for-job-roles-across-11-sectors-395238a

End of remediation block (appended 2026-04-30)