IdentityMesh Vault
Privileged checkout, rotation, and tamper-evident audit — built into the identity platform you already deploy for synchronization. No second vendor. No second agent. No second contract.
CyberArk and Delinea sell a standalone vault that you then integrate with your identity stack. IdentityMesh Vault is the identity stack. It governs credentials for accounts already represented through IdentityMesh connectors, encrypts material through the existing ISecretStore, and decides who may request an account from the same mesh objects and group memberships the connectors already imported.
One deployment.One audit chain.One operations model.
| Criterion | IdentityMesh Vault | CyberArk PAM | Delinea Secret Server |
|---|---|---|---|
| Deployment | Module of the identity platform you already run | Standalone platform (Vault + CPM + PSM + PVWA) | Standalone Secret Server, on-prem or Cloud |
| Time to stand up | Days | Months, with dedicated admin | Faster than CyberArk, still a separate rollout |
| Licensing | Included with IdentityMesh | Per privileged account + per-module add-ons | Per user, tiered; Cloud Platinum sold at premium |
| Typical cost / user / year | Included | ~$600–$1,400 | ~$45–$110 Server; Cloud materially higher |
| Rotation | Per-target setters for AD (LDAPS), SQL logins, and Entra ID (Graph); owner-provided or blind nomination; per-policy schedule with failure backoff | CPM plug-ins per platform | Discovery + remote password changers per platform |
| Secret store | Existing Azure Key Vault, DPAPI, or HashiCorp-backed ISecretStore | Proprietary Vault appliance | Encrypted DB with HSM options |
| Audit | Extends the ER-005 append-only hash chain | Session recording + SIEM export | Event subscriptions + SIEM export |
| Roles | Existing Viewer / Operator / Admin get scoped Vault permissions | Multiple product roles across modules | Distinct roles per Secret Server function |
Competitor pricing reflects publicly published benchmarks. Contact us to model your specific quote.
IT & identity
Your CyberArk quote asks for a vault appliance, CPM, PSM, PVWA, and a dedicated admin. IdentityMesh Vault ships as a module of the sync engine you already own. Nominate an account, check it out, roll it back in — same UI, same roles, same install.
Migration
You already picked IdentityMesh to retire Microsoft Identity Manager. Adding CyberArk or Delinea on top puts you back into the two-product operations you were trying to escape. Vault lives in the same repos, ships in the same MSI, and audits into the same ER-005 hash chain.
Security & risk
Vault events extend the ER-005 append-only hash chain — its column order is frozen because reordering it would invalidate prior verification. One active checkout is enforced by policy and a filtered unique index. A missing source account locks the record instead of silently de-vaulting on transient import failure.
Vault uses the existing ISecretStore — Azure Key Vault, DPAPI, or HashiCorp-backed depending on your deployment. No second KEK configuration system.
Rotation is delegated to the IVaultPasswordSetter registered for the connector type: Active Directory over LDAPS, a SQL login over its own connection, an Entra ID user over Graph. A connector type with no setter is refused at nomination rather than half-supported. The new password is written to the secret store under a pending reference before it touches the target, so a crash mid-rotation never loses a live credential.
OwnerProvidedBlindRotation
Policy and a filtered unique index enforce a single active session per account. Row-version concurrency and idempotent request identifiers protect against API races and client retries. A credential is revealed strictly once, through a one-time URL that is claimed before the secret is read.
A Vault scope binds accounts to mesh groups. Who may request an account is derived from group membership the mesh already holds, imported from AD or built by Composer rules, instead of a hand-maintained safe. Accounts in no scope are restricted by default, and vault.admin does not bypass the rule on checkout.
A missing source account blocks new checkouts and preserves its audit history. A transient import or replication failure cannot cause a vaulted account to silently disappear.
Vault seeds vault.audit.read for the existing Viewer role rather than adding a new Auditor role. Admin and Operator receive broader Vault permissions.
IM_VaultAuditEvents sits alongside IM_AdminAuditEvents and IM_ObjectAuditEvents in the append-only hash chain. Column order is frozen — reordering would invalidate verification of prior events.
Marketing pages that claim everything are worth nothing. Here is the current scope, honestly.
If session recording is a hard requirement, pair Vault with a session-recording tool of choice or stay with your current PAM for that workload. We would rather be clear than complete.
Send us your CyberArk or Delinea quote. We'll map each line item to what's already included in IdentityMesh Vault — and be honest about what isn't.
Pricing benchmarks: Vendr and Vendor Benchmark 2026 (CyberArk, Delinea). Deployment complexity: Comparisec and StrongDM comparisons. Gartner Peer Insights review counts as of 2026.
