# delinea

Source: https://startwithidentity.com/vendors/pam/delinea/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

Delinea formed from the 2021 merger of Thycotic and Centrify under TPG and is the largest independent [PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/) vendor now that [CyberArk](https://startwithidentity.com/vendors/pam/cyberark/) sits inside Palo Alto Networks. Its positioning is deliberate: strong privileged access that is faster to stand up and easier to operate than the heaviest enterprise suites. The company [reported passing 400 million dollars in ARR](https://delinea.com/news/delinea-surpasses-400m-in-arr-and-expands-global-momentum) in August 2025, with SaaS the majority of that footprint.

## What it is good at

Time to value and usability. Secret Server (the Thycotic heritage) is an approachable vault, paired with privileged session management, just-in-time access, and cloud entitlement features. Three acquisitions filled the historical gaps: Authomize (January 2024) added ITDR and CIEM, Fastpath (April 2024) added identity governance, and [StrongDM](https://startwithidentity.com/vendors/pam/strongdm/) (closed 5 March 2026) added just-in-time runtime authorization for human and non-human identities. Secret Server reached [FedRAMP High authorization](https://delinea.com/news/delinea-achieves-fedramp-high-authorization-for-secret-server) on 8 July 2026 under partner UberEther, which opens US public sector deals. The platform runs on Azure across seven hosting geographies with active-active regional pairs, though data is replicated within a geography and not across them.

## Where it falls short

At the very top of the enterprise market CyberArk still goes further in breadth and reference depth. Pricing transparency is poor even by PAM standards: there is no public pricing page, and every quote runs through sales.

The bigger current concern is patch exposure. In September 2026 Delinea disclosed four critical on-premises Secret Server flaws in two weeks, including a FIDO2 registration [authentication bypass](https://startwithidentity.com/techniques/) scored 9.8 and a SAML bypass scored 9.5. Cloud tenants were unaffected in every case, which is a real argument for Secret Server Cloud over self-hosting, but self-hosted operators need a fast patch cycle. See Delinea's [security advisories](https://delinea.com/security-advisories) for current versions.

## Pricing

Quote-based across vaulting, session management, and cloud privilege modules, SaaS or self-hosted. Delinea publishes no list prices, so model the all-in cost with our [TCO calculator](https://startwithidentity.com/tools/tco-calculator/) and expect to negotiate.

## Best for, and who should look elsewhere

Choose Delinea for audit-ready PAM a normal-sized team can run, especially in the mid-market or where FedRAMP High is required. Choose CyberArk for the largest estates, [BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) for a similar footprint with stronger remote access, or [Teleport](https://startwithidentity.com/vendors/pam/teleport/) if the need is purely modern infrastructure access. See [CyberArk vs Delinea](https://startwithidentity.com/compare/cyberark-vs-delinea/).

## Bottom line

The leading independent PAM for buyers who want enterprise-grade privileged access without enterprise-grade operational overhead, provided they can patch on-premises deployments promptly.