#pam

SWI's Identity Pricing Transparency Index 2026 classified the pricing of 296 identity vendors on October 30, 2026. 80 publish a price for any paid tier, 158 are quote-only, and the market scores 38 out of 100. Who the vendor sells to predicts transparency better than what it sells.

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, writes authentication and secure defaults into law for products sold in the EU, and lists identity management, PAM and password managers as important products. Its reporting duty started on 11 September 2026. What it asks of teams that buy identity products and teams that build them, and what to do before December 2027.

Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A patch closes the door, but the passwords, keys and certificates that walked out stay valid until you rotate them.

CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.

Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, and takes it into territory owned by PAM vendors.

The largest deal in security industry history closed on 11 February 2026. CyberArk shareholders took 45 dollars cash plus 2.2005 Palo Alto shares per ordinary share, and privileged access management now sits inside a network security platform.