# cyberark-conjur

Source: https://startwithidentity.com/vendors/secrets/cyberark-conjur/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

## Overview

Conjur is CyberArk's [secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/) solution, available as an open-source core and a hardened enterprise edition. It provides policy-as-code secrets for applications, containers, and CI/CD pipelines, and it integrates tightly with CyberArk's privileged access platform. In the [secrets management category](https://startwithidentity.com/vendors/secrets/) it is the enterprise, governance-heavy option, most compelling for organizations already standardized on CyberArk for human privileged access who want to extend the same controls to machine and application identities. Palo Alto Networks retired the CyberArk brand on 12 May 2026, relaunching the portfolio as [Idira](https://www.paloaltonetworks.com/idira), with customer-visible changes from 31 May. Conjur Cloud and Conjur Enterprise are now sold as Idira Secrets Manager (SaaS and Self-Hosted editions), while Conjur Open Source keeps its name. Idira Secrets Hub is a separate product that syncs secrets into cloud-native vaults.

## What it is good at

The policy model is the differentiator: secrets, roles, and access rules are defined as declarative, version-controlled policy, which suits teams that treat security configuration like code. Authorization is granular, and audit and governance are strong, with detailed logging that satisfies demanding compliance regimes. Integration with the broader CyberArk platform means privileged human access and machine secrets sit under one governance umbrella. Kubernetes, OpenShift, and CI/CD integrations are mature, and the open-source core lets teams evaluate before committing.

## Where it falls short

Conjur is heavier to operate than newer developer-first tools. The policy-as-code approach has a learning curve, and standing up and running the enterprise edition takes real platform investment. Its value is highest inside the CyberArk ecosystem; standalone, lighter-weight needs are over-served. Developer experience, while solid, is less frictionless than tools built SaaS-first.

## Pricing

Open-source Conjur is free to self-operate. The enterprise edition is quote-based, typically licensed alongside the CyberArk platform. No public list pricing. Model it against a managed alternative with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Conjur when you are a CyberArk customer extending privileged access to applications and DevOps, or you want policy-driven secrets with strong audit. If you want lighter, developer-first secrets, see [Doppler](https://startwithidentity.com/vendors/secrets/doppler/) or [Infisical](https://startwithidentity.com/vendors/secrets/infisical/); for cloud-native AWS, [AWS Secrets Manager](https://startwithidentity.com/vendors/secrets/aws-secrets-manager/). Compare directly via [HashiCorp Vault vs CyberArk Conjur](https://startwithidentity.com/compare/hashicorp-vault-vs-cyberark-conjur/).

## Bottom line

A strong, governance-heavy enterprise secrets engine, most compelling for organizations already invested in CyberArk, now Idira.