Keyring
Scheduled Sep 13, 2026Privileged access, vaulted and recorded, in your account.
Replaces
- CyberArk Privilege Cloud · CyberArk Software Ltd. — $44,712 per contract per year (Privilege Cloud — Standard, 25-user pack)
- Delinea Secret Server · Delinea Inc. — no published list price
Rented, per year
Not published
These vendors quote privately. We use your contract, not a guess.
Owned, per year
$16,080
AWS infrastructure only. Azure is $17,040.
Build
20 weeks
3 engineers. To parity on the ten core features above, including onboarding of 3,000 privileged accounts, SSH, RDP and database brokering, rotation for Active Directory, Linux, PostgreSQL, MSSQL and cloud IAM, and a documented break-glass procedure tested under observation.
Difficulty
5/5
Among the hardest in Techtons. Read the parity table closely.
Reference organisation: 400 privileged operators, 3,000 managed accounts, ~9,000 brokered sessions/month, 2 TB of recordings under 7-year retention, prod + non-prod. 3-year Compute Savings Plan on Fargate and EC2 / 3-year reservation on Container Apps and VM Scale Sets. Azure figure assumes Key Vault Premium, not Managed HSM, which adds roughly $2,300/month. Includes NAT Gateway and immutable recording storage at the stated retention. Excludes vendor support plans. Figures are infrastructure only and exclude the build.
What it is
Keyring is privileged access management: a credential vault with automatic rotation, brokered sessions to servers, databases and cloud consoles without the operator ever seeing the secret, full session recording with searchable transcripts, and just-in-time elevation with approval. It is for organisations with 100 to 2,000 privileged operators — infrastructure, DBAs, third-party support — where the PAM licence costs more per administrator than the administrator's laptop and the deployment still has not covered half the estate. Keyring runs entirely inside your own network boundary, which is where a credential vault ought to be.
Why this one stops making sense
- CyberArk's own AWS Marketplace listing is $44,712 a year for 25 privileged users. That is $1,788 per administrator per year to store and rotate passwords.
- Delinea publishes nothing at all, so the only way to price Secret Server is to start a sales conversation and hope your negotiating position is good.
- PAM projects stall on coverage, not capability. The systems that never get onboarded are the ones with awkward protocols, and per-user licensing gives you no reason to push through.
- Session recordings are evidence. Keeping them in a vendor's storage, under a vendor's retention policy, at a vendor's export rate, is the wrong place for evidence.
- A vault that phones home to a SaaS control plane is a design decision you did not make and cannot audit. Owning the code means the trust boundary is one you drew.
What ships
- Credential vault with envelope encryption, per-secret access policy and automatic rotation on schedule and on checkout
- Session brokering for SSH, RDP, database protocols and cloud consoles, with the operator never receiving the credential
- Full session recording: keystroke and protocol capture for SSH and database, screen capture for RDP, all searchable
- Just-in-time elevation with approval workflow, time-boxed grants and automatic revocation
- Discovery of privileged accounts across Active Directory, Linux estates, databases and cloud IAM
- Application-to-application secrets: short-lived credentials issued to workloads, no static keys in config
- Dual control and four-eyes checkout for the highest-risk accounts
- Break-glass procedure with sealed offline recovery and mandatory post-use review
- Live session monitoring with the ability to join, annotate or terminate a session in progress
- Immutable audit trail and recording archive under legal hold, exportable in full
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind, plus a browser-based terminal and RDP client so operators need no local agent
- backend
- NestJS on Node 22 for the control plane; the session broker is a separate Go service speaking SSH and RDP natively
- database
- PostgreSQL 16 with Row Level Security; secrets stored as ciphertext with data keys wrapped by KMS, never as plaintext columns
- cache
- Redis 7 for session tokens, checkout locks and rate limiting — never for secret material
- queue
- BullMQ for rotation schedules, discovery scans and recording post-processing
- auth
- OIDC against the customer IdP with mandatory step-up and phishing-resistant factors for any checkout
- search
- PostgreSQL tsvector across session transcripts, accounts and audit records
- ai
- Optional session summarisation for reviewers, generated from the transcript through an LLM gateway that runs inside the same boundary
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought CyberArk Privilege Cloud, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | CyberArk Privilege Cloud | Ours | Note |
|---|---|---|---|
| Credential vaulting with automatic rotation | Yes | Yes | — |
| Session brokering without credential disclosure | Yes | Yes | SSH, RDP, PostgreSQL, MySQL, MSSQL, Oracle and cloud console federation. |
| Session recording, searchable and immutable | Yes | Yes | SSH and database sessions are recorded as structured protocol streams, so the transcript is grep-able rather than a video you have to watch. |
| Just-in-time elevation with approval | Yes | Yes | — |
| Privileged account discovery across the estate | Yes | Yes | — |
| Application-to-application secrets with short-lived credentials | Yes | Yes | Backed by your cloud provider's native short-lived credential issuance where available. |
| Dual control and four-eyes checkout | Yes | Yes | — |
| Live session join, annotate and terminate | Yes | Yes | — |
| Endpoint privilege management on workstations | Yes | No | CyberArk Endpoint Privilege Manager removes local admin rights on Windows and macOS endpoints with an agent, an application catalogue and years of policy content. Keyring governs servers, databases and cloud, not laptops. If least privilege on the endpoint is the requirement, that is a separate product and a separate purchase. |
| FIPS 140-2 validated cryptographic module and vendor-certified vault architecture | Yes | No | CyberArk's Digital Vault carries certifications, a documented hardening standard and decades of red-team scrutiny that a new codebase cannot claim. Keyring uses your cloud KMS or HSM, which is itself validated, but the surrounding vault software is not independently certified. For some regulators and some cyber-insurance policies, that certification is the control. |
| Mainframe, AS/400 and legacy protocol session brokering | Yes | Partial | Keyring brokers SSH, RDP and the major database protocols. Terminal emulation for mainframe estates is out of scope. |
| Recording storage and retention priced by the vendor | Yes | No | Recordings land in your own object storage under your own lifecycle policy. Seven-year retention on 2 TB is about $46 a month, not a contract line. |
| Vault runs inside your own network boundary with no vendor control plane | Partial | Yes | There is no phone-home path. If your network is isolated, Keyring still works. |
| Threat analytics on privileged behaviour | Yes | Partial | Keyring scores sessions against your own baseline and streams to your SIEM. It has no cross-customer attack corpus. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate for the control plane; the session broker runs on EC2 in a private subnet with a fixed Elastic IP through a NAT Gateway
- Data
- Aurora PostgreSQL Multi-AZ, ElastiCache Redis, both in isolated subnets with no internet route
- Storage and edge
- S3 with Object Lock in compliance mode for recordings, a dedicated KMS CMK per safe
- Identity
- Cognito federated to the customer IdP, with WebAuthn enforced for checkout
- Observability
- OpenTelemetry to CloudWatch and X-Ray; every checkout and every session start emits a separate CloudTrail-adjacent event
- Infrastructure as code
- Terraform, one module per environment, remote state in S3 with a DynamoDB lock
Services
The decision worth arguing about
The non-obvious decision is recording SSH and database sessions as structured protocol streams — gzipped asciicast for terminals, statement logs for databases — rather than as video. Video is what every PAM vendor demos because it looks convincing, and it is close to useless: a 40-minute session is a 40-minute watch, you cannot search it, and it costs about 300 times more to store. Keyring writes the terminal stream as timestamped JSON to S3 with Object Lock, which makes a year of sessions searchable with a full-text index and lets a reviewer answer 'did anyone run a DELETE against the production ledger in Q2' in a second. The trade is real and it is on RDP: graphical sessions have no equivalent structured representation, so those are captured as frame-differenced video with OCR run over the frames to make something searchable. That path is heavier, slower to review and the OCR is imperfect, which is a reason to push Windows administration towards PowerShell remoting where the session is text again.
Microsoft Azure
- Compute
- Container Apps for the control plane; the session broker runs on a VM Scale Set in a dedicated subnet with a NAT Gateway for deterministic egress
- Data
- Azure Database for PostgreSQL Flexible Server with private endpoint only, Azure Cache for Redis with private link
- Storage and edge
- Blob Storage with immutable policy and legal hold for recordings, Managed HSM or Key Vault Premium for safe master keys
- Identity
- Microsoft Entra ID with Conditional Access requiring a phishing-resistant factor and a compliant device for checkout
- Observability
- Azure Monitor with Application Insights, recordings indexed into Log Analytics for the transcript search path
- Infrastructure as code
- Bicep in an azd-compatible layout
Services
The decision worth arguing about
On Azure the argument is whether to use Azure Bastion for the RDP and SSH hop instead of running Keyring's own broker. Bastion is managed, hardened and already in most customers' subscriptions at about $140 a month for the Standard tier plus egress, and it terminates the session for you. We do not use it, and the reason is recording ownership: Bastion's native session recording writes to a storage account in a format Keyring does not control, on a lifecycle Keyring cannot enforce, and it does not exist at all for database protocols, so half the estate would have one evidence model and half another. Splitting the evidence chain across two systems is precisely the thing that makes an audit expensive. Keyring runs its own broker on a VM Scale Set behind a NAT Gateway with a fixed egress IP, which also gives target firewalls a single address to allow. The cost is that we now own patching for those VMs, which is a real operational burden and is why the Bicep pins them to an image gallery with an automated monthly rebuild rather than in-place updates.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| CyberArk Privilege Cloud | Privilege Cloud — Standard, 25-user pack | $44,712 / contract/year | 2026-09-05 | aws.amazon.com/marketplace/pp/prodview-tdokb CyberArk publishes no rate card on its own site. This is the listed AWS Marketplace price for a 12-month contract covering 25 standard privileged users — about $1,788 per privileged user per year — and CyberArk directs larger buyers to a private offer. |
| Delinea Secret Server | Secret Server Platinum | Not published | 2026-09-05 | delinea.com/products/secret-server Delinea publishes no list price; the Secret Server product page carries no figures and routes every pricing question to a contact form. |
Should you still be paying for CyberArk Privilege Cloud?
Two weeks, fixed price. We audit what you actually use, map it against Keyring, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.