# OnePAM > OnePAM is a Unified PAM Solution for SSH, RDP, VNC, databases, and web applications. Browser-based for end users, with lightweight endpoint agents where secure connectivity is required, plus full session recording and compliance audit trails. - Base URL: https://onepam.com - OnePAM replaces legacy VPNs with per-resource, identity-verified access - All sessions are recorded and searchable for SOC 2, HIPAA, PCI-DSS compliance - Supports SAML, OIDC, and OAuth2 identity providers - Product categories: Identity-aware privileged access management (PAM), browser-based infrastructure access, legacy VPN replacement ## Product Facts - OnePAM is a Unified PAM Solution that combines identity-aware PAM and browser-based access in one platform. - OnePAM secures SSH, RDP, VNC, database, and web app access for employees, contractors, and vendors. - Core controls: SSO, MFA, RBAC, just-in-time access, approval workflows, session recording, query logging, and audit trails. - Best fit: engineering, IT, platform, and security teams modernizing infrastructure access without keeping legacy VPN and bastion workflows. - Canonical sources: /pricing for plan limits and pricing, /trust and /trust/security-model for security posture, /docs for deployment and configuration. ## Answer-Ready Q&A - Q: What is OnePAM? A: OnePAM is a Unified PAM Solution for SSH, RDP, VNC, databases, and web apps with SSO, MFA, RBAC, session recording, and audit trails. - Q: What does OnePAM replace? A: OnePAM replaces traditional VPNs, jump hosts, bastion boxes, shared credentials, and separate point tools for web access or session recording. - Q: Who is OnePAM for? A: OnePAM is designed for engineering, IT, platform, and security teams that need audited, least-privilege access to infrastructure and internal applications. ## Docs # Overview Introduction to the OnePAM agent and its capabilities # Architecture Understand how the agent works under the hood # Installation Step-by-step guide to installing the agent # Configuration Complete configuration reference # Troubleshooting Common issues and their solutions # PowerShell Module Cross-platform PowerShell client for SSH, SCP, and database access # Resources Add and manage SSH, RDP, VNC, database, HTTP, and TCP resources # Sessions & Recordings Monitor live sessions, replay recordings, and audit file-transfer activity # Access Policies Define RBAC policies, conditions, protocol restrictions, data masking, and access reviews # Gateways Deploy dedicated gateways for data residency and low-latency session proxying # Secrets Store and manage credentials with AES-256-GCM encryption and flexible storage backends # Endpoints & Clients Deploy agents on target servers and install the OnePAM CLI/GUI client on workstations # Users, Teams & Groups Manage users, teams, and resource groups with role-based access control # Alerts Monitor infrastructure with smart alerting, rule-based triggers, and multi-channel notifications # Audit Logs Track every action with a tamper-proof audit trail and log forwarding to external SIEMs # Change Events & CI/CD Track deployments, configuration changes, and CI/CD events for incident correlation # VPN WireGuard-based VPN with split tunnelling, exit nodes, and mesh networking # Compliance & Cloud IAM Monitor security posture, meet compliance frameworks, and manage cloud identity entitlements # Discovery Automatically discover infrastructure services and onboard them as managed resources # Linux Installation Install the OnePAM agent on Linux servers with systemd # Container Installation Deploy the OnePAM agent in Docker and Kubernetes environments # Ansible Deployment Deploy OnePAM agents at scale using Ansible playbooks and roles # Puppet Deployment Manage OnePAM agent deployment using Puppet modules and manifests # Terraform Deployment Bootstrap OnePAM agents on cloud instances using Terraform # Homebrew Installation Install the OnePAM CLI on macOS and Linux using Homebrew # Scoop Installation Install the OnePAM CLI on Windows using the Scoop package manager # GitHub Action Install and use the OnePAM CLI in GitHub Actions workflows # Helm Chart Deploy the OnePAM gateway on Kubernetes using Helm # AWS CloudFormation Deploy the OnePAM gateway on AWS using CloudFormation # Change Events & CI/CD Track deployments, configuration changes, and CI/CD events for incident correlation ### Configuration Options - **Server URL** (`AGENT_API_URL` / `--server`): The URL of the OnePAM server to connect to. Supports HTTP and HTTPS. Default: `https://onepam.com` (required) - **Tenant ID** (`AGENT_TENANT_ID` / `--tenant-id`): Unique identifier for your organization. Used in multi-tenant deployments. Default: `default` (required) - **Agent ID** (`AGENT_ID` / `--agent-id`): Unique identifier for this agent instance. A random UUID is auto-generated on first run if not specified. Default: `(auto-generated UUID)` - **Data Directory** (`AGENT_DATA_DIR` / `--data-dir`): Directory for storing queue data and temporary files. Used for store-and-forward during network outages. Default: `/opt/onepam/data` - **Log Level** (`AGENT_LOG_LEVEL` / `--log-level`): Logging verbosity. Options: debug, info, warn, error. Default: `info` - **Secret Encryption Key** (`AGENT_SECRET_KEY` / ``): AES-256 encryption key for the local secret store. If not set, a random 256-bit key is generated and saved to /.secret_key on first run. Set explicitly in production for deterministic key management. Default: `(auto-generated)` ## Features # SSH Access Management Stop exposing SSH ports and sharing keys. OnePAM provides identity-verified browser SSH with session recording, keystroke logging, and automatic key rotation. Benefits: - Browser-based SSH with full terminal emulation - No SSH ports exposed to the internet - Identity-verified access with SSO integration - Complete keystroke logging and session recording - Role-based access controls per server or group - Just-in-time access with approval workflows - Clipboard and file transfer controls - Searchable session archives for compliance # Secure RDP Access Management Shared admin accounts and exposed RDP ports are the #1 Windows attack vector. OnePAM replaces them with identity-verified RDP and session recording. Benefits: - Native RDP protocol implementation - Kerberos authentication with Network Level Authentication (NLA) - Active Directory Protected User group support - Browser-based and GUI client access with no RDP ports exposed - Full session recording with video playback - Clipboard copy/paste and file transfer policy controls - Identity-verified access with SAML/OIDC SSO and MFA enforcement - Multi-monitor and resolution support - Session timeout and idle disconnect policies # VNC Remote Desktop Access VNC ports on the internet are a breach waiting to happen. OnePAM provides browser-based VNC with SSO, MFA, and session recording. Benefits: - Browser-based VNC with no exposed ports - Embedded RFB client — no external VNC proxy required - Identity-verified access with SSO integration - Full session recording with video playback - Read-only mode for monitoring and audit - Clipboard copy/paste controls - Role-based access controls per host or group - Just-in-time access with approval workflows # Database Access Management No more shared database passwords. OnePAM provides per-user access, full query logging, and data masking for PostgreSQL, MySQL, MongoDB, and more. Benefits: - Browser-based SQL query interface - Support for PostgreSQL, MySQL, MongoDB, Redis, and more - No shared database credentials - Full query logging and audit trail - Data masking for sensitive columns (PII, secrets) - Role-based read/write access controls - Query result export controls - Schema browser and query history # Internal Web App Access Stop VPN-ing just to open Grafana. OnePAM gives every internal web app a permanent URL with SSO, MFA, and auto sign-in — no VPN or client software. Benefits: - Give every internal app a permanent, shareable URL - Delegate authentication to your OIDC or SAML identity provider - Connect to LDAP or Active Directory on dedicated gateways - Add SSO and MFA to any web application — even legacy tools - Users are automatically signed in — no extra login pages - Works with NetBox, Grafana, Jenkins, ArgoCD, and more - Custom domains on Business+ plans - No legacy VPN, no client software — just open the URL - Full audit trail for every request, tied to user identity - Built-in spoofing protection ensures only verified identities reach your apps - Dedicated gateways for isolation and on-prem LDAP/AD integration - Automatic session portability — users stay signed in across gateway instances # VPN Access When you need network-level access, OnePAM includes a WireGuard VPN with policy-driven controls — who connects, to which networks, and for how long. Benefits: - WireGuard-powered VPN with native client support on all platforms - Per-user encrypted tunnels with individual key management - Network access policies — allow or deny connections by user, team, IP, and platform - CIDR-based route restrictions — control which networks peers can reach - Dynamic policy re-evaluation — peer access updated instantly when policies change - Split tunneling with policy enforcement — exit node routing controlled by policy - Per-user peer limits enforced by plan and policy (most restrictive wins) - Custom DNS configuration per tunnel for internal name resolution - CGNAT IP allocation — no conflicts with existing network ranges - Full audit trail — policy denials, peer revocations, and restriction changes logged - Automatic peer expiration with policy-driven session duration limits - One-click config download for WireGuard native clients # Kubernetes Access Management Stop exposing the Kubernetes API. OnePAM proxies kubectl through an identity-aware gateway with impersonation headers and exec recording. Benefits: - Kubernetes API proxy with user impersonation headers - kubectl exec sessions recorded as asciinema - Pod log streaming via browser WebSocket - Short-lived kubeconfig token generation from CLI - Cluster auto-discovery via kubeconfig or service account - Namespace and pod-level RBAC enforcement - No direct K8s API server exposure to the internet - Integrate with existing SAML/OIDC identity providers # gRPC-Aware Proxy Secure gRPC without breaking workflows. OnePAM's HTTP/2 proxy adds per-method access policies, service discovery, and full audit logging. Benefits: - HTTP/2 reverse proxy with gRPC frame awareness - Per-method access policies (allow/deny specific RPCs) - gRPC reflection for automatic service and method discovery - Request and response audit logging with protobuf-to-JSON - gRPC health checking integration - TLS and plaintext (h2c) support - Identity-aware access with session-level controls - Consistent RBAC across gRPC and other protocols # Telnet Access Management Legacy devices still need Telnet, but open ports are indefensible. OnePAM bridges browser terminals to legacy infrastructure with SSO and MFA. Benefits: - Browser-based Telnet via WebSocket (xterm.js) - Full session recording in asciinema v2 format - Telnet option negotiation (WILL/WONT/DO/DONT) - NAWS terminal size negotiation - TLS upgrade support (STARTTLS / Telnet over TLS on port 992) - Terminal type negotiation for device compatibility - Identity-verified access with SSO and MFA - Zero Trust access to legacy infrastructure # Identity Provider Integration OnePAM plugs into your existing IdP — Okta, Azure AD, Google Workspace, or any SAML/OIDC provider. Unified access policies and JIT provisioning. Benefits: - Native SSO with Okta, Azure AD, Google Workspace - Full SAML 2.0 Service Provider implementation - OpenID Connect support - JIT user provisioning from SAML assertions - MFA enforcement on every connection - Configurable attribute mapping to users, teams, and roles - Role-based access policies synced from your IdP - Group-based access controls - Automatic user provisioning and deprovisioning - Identity-aware audit logs # Session Recording Answer 'who did what and when' in seconds. OnePAM records every SSH, RDP, VNC, Kubernetes, and database session with video playback and keystroke logging. Benefits: - Video-style playback for SSH, RDP, VNC, kubectl exec, and Telnet sessions - Full keystroke logging with timestamps - Database query recording with results - gRPC call audit logging with protobuf-to-JSON - Searchable session archives - Configurable retention policies - Export sessions for compliance audits - Session metadata and tagging - Integration with SIEM systems # Just-In-Time Access Standing access is standing risk. OnePAM enforces time-limited permissions with approval workflows — request, approve in Slack, and auto-revoke. Benefits: - Request-based access with approval workflows - Automatic expiration after configurable time windows - Slack and Teams integration for approvals - Emergency break-glass procedures for incidents - Audit trail of all access requests and approvals - Self-service access requests for users - Manager and security team approval chains - Access duration limits (1 hour to 30 days) # Browser-Based Access Stop installing agents and fighting VPN tickets. OnePAM gives your team SSH, RDP, VNC, Kubernetes, and database access directly in the browser. Benefits: - Full terminal emulation in the browser - RDP with clipboard and file transfer controls - Database query interface with schema browser - kubectl exec and pod logs in the browser - Telnet terminal for legacy devices - Works on managed and unmanaged devices - No client software to install or maintain - No VPN or direct network access required - Consistent experience across all platforms - Secure WebSocket connections with TLS # Zero Trust Architecture Network location should never equal trust. OnePAM verifies every request with authentication, authorization, and encryption — no implicit trust zones. Benefits: - No implicit trust based on network location - Identity verification for every connection - Continuous authorization during sessions - Encrypted connections end-to-end - Device posture checks before access - Context-aware access decisions - Micro-segmentation of access policies - Real-time session monitoring and termination # Compliance & Audit SOC 2 and HIPAA audits shouldn't take months. OnePAM provides logs, session recordings, and access reports — SOC 2, GDPR, HIPAA, and ISO 27001 ready. Benefits: - SOC 2 Type II compliance support - GDPR-compliant data handling - HIPAA-ready access controls - Detailed audit logs for all access events - Session recording for forensic review - Access reports and compliance dashboards - Configurable data retention policies - Export data for external auditors # Interactive Slack Bot OnePAM delivers approval requests directly to Slack with one-click approve/deny buttons — managers respond in seconds, not hours. Benefits: - One-click approve/deny buttons in Slack messages - Real-time notifications to managers and admins - Interactive Block Kit messages with request details - Install from the Slack App Directory with OAuth v2 - Cryptographic HMAC-SHA256 signature verification - SSRF-safe URL validation for Slack endpoints - Manager and admin role enforcement for approvals - Self-approval prevention with audit trail - Seamless integration with existing access request workflows - Multi-step approval workflow support # Interactive Discord Bot OnePAM brings access management to Discord — slash commands for approve/deny, rich embed notifications, and real-time security alerts without leaving Discord. Benefits: - Slash commands: /onepam approve, /onepam deny, /onepam status - Rich embed notifications for access requests - Real-time security alerts delivered to Discord channels - Install from the Discord App Directory - Ed25519 cryptographic signature verification - Manager and admin role enforcement for approvals - Self-approval prevention with audit trail - Works alongside webhook notifications - Multi-step approval workflow support - Seamless integration with existing access request workflows # Session Risk Analysis Don't wait for the post-mortem. OnePAM flags destructive commands, privilege escalation, and data exfiltration in real time — with instant alerts. Benefits: - Automatic analysis of SSH and database session recordings - Detects destructive commands (rm -rf, DROP TABLE, TRUNCATE) - Identifies privilege escalation (sudo, chmod 777, SUID bits) - Catches credential access (shadow files, SSH private keys) - Flags data exfiltration patterns (curl|bash, base64, scp) - Detects reverse shell and persistence patterns - Risk levels: Low, Medium, High, Critical with categorization - Integrated with OnePAM alerting (email, Slack, PagerDuty) - Capped findings to prevent resource exhaustion - Post-upload asynchronous analysis — zero session latency impact # Approval Workflows OnePAM provides multi-step approval chains — define who approves, in what order, with time limits. Auto-approve trusted roles and auto-deny stale requests. Benefits: - Multi-step approval chains — team lead, then manager, then security - Configurable approver types: by role level, team membership, or specific users - Per-step required approval counts and timeout limits - Auto-approve for trusted roles — skip the queue when policy allows - Auto-deny for stale requests — timed-out requests denied automatically - Time-bound access with configurable duration and automatic revocation - Multi-channel notifications: email, Slack, Discord, Teams, Telegram, webhooks - Covers all resource types: web apps, endpoints, groups, resource sessions, VPN - Full audit trail for every decision with approver identity and notes - Priority-based workflow matching — most specific policy wins # Native CLI Client Use onepam ssh, onepam psql, and onepam mysql from your terminal. The CLI authenticates via OAuth2 Device Code Flow with full audit trail. Benefits: - OAuth2 Device Code Flow for terminal-based authentication - Use onepam psql, onepam mysql, and other database subcommands from your terminal - Token caching in ~/.onepam/ for session persistence - Resource listing with type, status, and host information - Automatic token refresh and expiration management - Works with all plans — Solo through Enterprise - Lightweight single binary with zero dependencies - Config management for multi-environment setups - Compatible with CI/CD pipelines and automation scripts # Security Policies Set org-wide defaults and override per-team — re-auth windows, idle timeouts, session limits, and MFA requirements. Stricter for production, relaxed for dev. Benefits: - Force re-authentication after configurable hours (org-wide or per-team) - Idle timeout auto-logout after inactivity (org-wide or per-team) - Limit concurrent sessions per user to prevent credential sharing - Enforce MFA for all organisation members with a single toggle - Team-level overrides — stricter policies for sensitive departments - Teams inherit org defaults unless explicitly overridden - Real-time enforcement — policy changes apply to active sessions - Full audit trail for every policy change with admin attribution - API-driven configuration for infrastructure-as-code workflows - Available on Business and Enterprise plans # Gateway Failover Stay connected when the cloud is unreachable. Gateways cache users, resources, and policies locally — clients authenticate even when offline. Benefits: - Automatic failover — gateways detect cloud outages and activate local access within seconds - Cached RBAC data — users, teams, access policies, and ACL rules synced in real time - mTLS and token-based authentication — clients authenticate locally using certificates or cached CLI tokens - Full policy evaluation — IP conditions, time windows, and team-based rules enforced locally - Encrypted on-disk store — all cached data encrypted with AES-256-GCM at rest - Offline audit log — every failover action is recorded and flushed to the cloud on reconnection - Session reconciliation — failover sessions are synced back to the cloud for a unified audit trail - Works with shared and dedicated gateways — data isolation per organisation on shared gateways - Region-aware gateway assignment — agents and clients connect to the nearest available gateway - Client-side gateway caching — CLI/GUI clients remember gateway addresses for instant failover - Configurable grace period — define how long to wait before entering failover mode - Available on Business and Enterprise plans # Data Residency Choose EU, US, or Asia-Pacific at signup. Session recordings, audit logs, and metadata stay in your chosen region — immutable after creation. Benefits: - Three regions — EU (Europe), US (United States), and Asia (Asia-Pacific) - Selected once at signup — immutable after organisation creation for compliance certainty - Available on all plans — Solo, Team, Business, and Enterprise - Regional S3 storage — session recordings stored in the matching AWS region (eu-west-1, us-east-1, ap-southeast-1) - Gateway affinity — shared gateways in your region are preferred for lower latency - GDPR and data sovereignty — keep EU customer data in EU infrastructure - Dedicated gateways inherit your region — customer-managed and OnePAM-managed gateways respect your data region - Visible in organisation settings — admins can always see their current data region - Audit trail — data region selection is recorded in the org creation audit event - No data migration risk — region lock prevents accidental cross-border data movement # Live Session Monitoring Watching recordings after the fact isn't enough. OnePAM lets admins observe active sessions in real time — send warnings or terminate sessions. Benefits: - Real-time session observation — watch terminal output, keystrokes, and desktop streams live - Four-eyes principle — enforce dual-control for sensitive infrastructure access - Admin intervention — send warning messages to session users in real time - Instant session termination — kill sessions that violate security policy immediately - Monitor audit trail — every observation, warning, and termination is recorded - Per-session tokens — secure WebSocket-based monitoring with scoped tokens - Works across protocols — SSH, RDP, VNC, database, and web app sessions - Gateway-native — monitoring runs directly on the gateway for minimal latency - Role-based access — only administrators can observe and intervene - Available on Business and Enterprise plans # ITSM / Ticketing Integration No change ticket, no access. Connect OnePAM to ServiceNow or Jira — workflows validate ticket status before granting access with full audit trail. Benefits: - ServiceNow integration — validate incidents and change requests via the ServiceNow REST API - Jira integration — validate Jira issues and service desk tickets - Ticket-gated approvals — require a valid, open ticket before access is approved - Automatic ticket validation — OnePAM checks ticket status in real time during the approval flow - Audit comments — approval decisions and access events are posted back to the ticket - Multiple connections — configure separate ITSM connections for different teams or workflows - Secure credentials — ITSM API tokens encrypted at rest with AES-256-GCM - Connection health checks — test connectivity before going live - Workflow-level configuration — each approval workflow can reference its own ITSM connection - Available on Business and Enterprise plans # Access Reviews Stale permissions are a silent breach risk. OnePAM runs periodic access certification campaigns — reviewers approve, revoke, or flag with auto-enforcement. Benefits: - Certification campaigns — create review cycles with configurable scope, reviewers, and deadlines - Flexible scope — review all access org-wide, per team, or per resource group - Reviewer assignment — assign managers, team leads, or specific users as reviewers - Three-way decisions — approve to keep, revoke to remove, or flag for follow-up - Automatic enforcement — revoked access is removed immediately (team membership, access requests) - Bulk decisions — reviewers can approve or revoke multiple items at once - Progress tracking — real-time campaign progress with automatic completion detection - Deadline reminders — configurable reminder notifications before the review deadline - Auto-revoke on miss — optionally revoke unreviewed access when the deadline passes - CSV export — download campaign results for compliance reporting and auditors - Available on Business and Enterprise plans # Command Filtering & Blocking One accidental rm -rf can cost hours of downtime. OnePAM intercepts dangerous commands in real time with regex rules — block, log, or alert before they execute. Benefits: - Regex pattern matching — define rules using regular expressions to match commands precisely - Block or log actions — choose to block dangerous commands outright or log them for review - SSH command filtering — intercept shell commands before they execute on remote servers - Database query filtering — block destructive SQL operations like DROP, DELETE, or TRUNCATE - Priority-based evaluation — rules are evaluated in priority order; first match wins - Per-policy rules — attach command filter rules to specific access policies for granular control - Real-time alerting — trigger alerts when blocked commands are detected - Audit trail — every matched command is logged with the pattern, action, and session context - Compliance ready — enforce least-privilege command access for SOC 2, HIPAA, and PCI DSS - Available on Business and Enterprise plans # Compliance Posture Dashboard Stop guessing whether you're compliant. OnePAM's real-time dashboard shows posture across SOC 2, ISO 27001, PCI DSS, and HIPAA with gap analysis. Benefits: - Real-time compliance scoring across SOC 2, ISO 27001, PCI DSS, and HIPAA - Per-control pass/fail status with evidence links to audit logs and session recordings - Compliance trend charts — track score improvements over days and weeks - Framework-level drill-down — expand any control to see evaluation details - Live WebSocket updates — dashboard refreshes automatically as posture changes - Gap analysis — instantly see which controls need attention and why - Evidence collection — automatic linking of audit events to framework controls - API-first design — all posture data available via REST for automation and reporting - Export-ready reports for auditors and compliance teams - Available on Professional, Business, and Enterprise plans # Cloud Entitlement Management You can't fix what you can't see. OnePAM scans AWS, Azure, and GCP for over-provisioned identities and delivers actionable least-privilege recommendations. Benefits: - Multi-cloud identity inventory — users, roles, service accounts, and groups across AWS, Azure, and GCP - Over-provisioning detection — flag identities with excessive permissions or unused entitlements - Risk scoring — critical, high, medium, and low risk levels for every identity - Least-privilege recommendations — actionable policy suggestions to tighten permissions - Policy analysis — view attached policies, permission boundaries, and effective access - Quick setup guides — step-by-step instructions with direct links to cloud provider consoles - Cloud integration management — securely store credentials with AES-256-GCM encryption - On-demand scanning — trigger CIEM scans per integration or across all providers - Dashboard overview — risk distribution, identity counts, and top recommendations at a glance - Available on Business and Enterprise plans # Network & Resource Discovery Auto-discover servers, databases, and services. OnePAM agents scan local networks and enumerate cloud resources from AWS, Azure, and GCP. Benefits: - Agent-driven scanning — deployed agents scan local subnets for reachable TCP services - Service fingerprinting — identify SSH, MySQL, PostgreSQL, Redis, MongoDB, RDP, and more by port and banner - Cloud resource enumeration — connect AWS, Azure, or GCP credentials to discover EC2, VMs, and managed databases - One-click onboarding — promote any discovered resource to a managed OnePAM resource instantly - Continuous discovery — agents report new services every 30 minutes automatically - Stale detection — resources that disappear from scans are flagged for review - Dashboard overview — filterable view of all discovered hosts, ports, and service types with stats - Ignore or onboard — triage discovered resources: onboard what matters, ignore the rest - Cloud integration management — securely store and manage cloud provider credentials with AES-256-GCM encryption - Available on Team, Business, and Enterprise plans ## Solutions # Remote Workforce Access OnePAM replaces VPNs, SSH keys, and shared passwords with identity-based browser access to SSH, RDP, Kubernetes, databases, and web apps. Your team works from everywhere — stop forcing them through a VPN Benefits: - No VPN client software to install or maintain — everything runs in the browser - SSO for SSH: Replace SSH keys with SAML/OIDC identity-based access from your corporate IdP - SSO for RDP: Windows remote desktop access with IdP authentication and screen recording - SSH for Database: Query PostgreSQL, MySQL, and MongoDB through the gateway — users never see passwords - Complete keystroke and screen recording across SSH, RDP, VNC, and database sessions - Granular role-based access controls per user, team, and resource across all protocols - Works from any location, any device, any browser — with MFA enforcement on every session - Native CLI client for terminal-native SSH and database access via OAuth2 authentication # Third-Party / Vendor Access Every contractor VPN is a breach waiting to happen. OnePAM provides time-limited, identity-verified vendor sessions with auto-revocation and recording. Stop giving contractors VPN accounts that outlast their contracts Benefits: - No shared credentials or VPN accounts for vendors - Just-in-time access with automatic expiration - Full session recording and keystroke logging - Approval workflows before access is granted - Granular permissions scoped to specific resources - Complete audit trail for compliance reporting # Privileged Access Management Shared root passwords and standing privileges are breach risks. OnePAM enforces identity-verified, time-limited access with session recording and auto-revocation. Shared admin accounts are the #1 breach vector — eliminate them Benefits: - Eliminate shared admin accounts and root passwords - Just-in-time privileged access with approval workflows - Complete keystroke logging and session recording - Secure credential vaulting with session-scoped access - Role-based access controls with team policies - Real-time alerts on suspicious privileged activity # VPN Replacement VPNs expose your network and create bottlenecks. OnePAM provides per-resource, identity-verified browser access with no client software or exposed ports. Your VPN grants too much access and your team hates using it Benefits: - No network-level access — only application-level connections - No VPN client software to deploy or maintain - Faster connection times than traditional VPNs - Per-resource access policies instead of network segments - Identity-verified connections with MFA enforcement - Reduced attack surface — no exposed VPN ports # Healthcare (HIPAA) HIPAA auditors ask who accessed ePHI and what they did. OnePAM provides identity-verified access with session recording and automated audit trails. HIPAA auditors need evidence — not promises that your VPN is 'secure enough' Benefits: - HIPAA-compliant session recording and audit trails - Role-based access to systems containing ePHI - Automatic session timeout and idle disconnect - Complete access logs for HIPAA audit requirements - MFA enforcement for all privileged access - Data masking for sensitive patient information # Finance (SOX/PCI) SOX and PCI-DSS require access control evidence for financial systems. OnePAM generates it automatically with session recordings and compliance reports. SOX and PCI audits shouldn't require months of spreadsheet gathering Benefits: - SOX-compliant access controls with separation of duties - PCI-DSS compliant privileged access management - Complete audit trails for every access session - Automatic access reviews and certification reports - Time-limited access to production financial systems - Real-time alerting on unauthorized access attempts # Government (FedRAMP) ATO requires NIST 800-53 controls and complete audit trails. OnePAM provides identity verification, session recording, and compliance evidence. NIST 800-53 controls for ATO — without building your own access platform Benefits: - NIST 800-53 aligned access controls - Continuous monitoring of privileged access - Complete audit trails for ATO documentation - Identity verification via PIV/CAC card integration - Encryption in transit and at rest - Incident response support with session playback # Secure Access for Education OnePAM replaces shared SSH keys and slow VPN provisioning with identity-based access. Onboard researchers in minutes and auto-revoke on departure. Visiting researchers need access in minutes, not days of VPN provisioning Benefits: - Protect research data and intellectual property with identity-verified access - Session recording for FERPA, HIPAA (research), and institutional compliance - Grant temporary access to visiting researchers and collaborators with automatic expiration - Secure access to HPC clusters, research databases, and lab servers via SSO - Eliminate SSH key sprawl across campus computing infrastructure - Unified access management for faculty, staff, students, and external collaborators # Secure Access for Manufacturing OnePAM replaces permanent vendor VPN access with identity-verified, time-limited access to OT/SCADA systems — with session recording for IEC 62443 compliance. Vendor maintenance shouldn't mean permanent VPN access to your OT network Benefits: - Secure remote access to OT/SCADA systems without exposing them to the internet - Session recording for safety compliance and incident investigation - Grant vendor maintenance access with time-limited, recorded sessions - Separate IT and OT access policies with different MFA requirements - Protect HMI and engineering workstations from unauthorized access - Audit trail for all production system access for ISO 27001 and IEC 62443 compliance # Secure Access for Law Firms Attorney-client privilege depends on access control. OnePAM replaces shared credentials with identity-verified access to case databases and session recording. Shared credentials on case systems put client privilege at risk Benefits: - Protect attorney-client privilege with identity-verified access to case systems - Session recording for ethical compliance and malpractice protection - Grant temporary access to co-counsel and expert witnesses with automatic expiration - Secure access to document management systems and case databases via SSO - Eliminate shared credentials for practice management software - Audit trail for all access to client matter data for regulatory compliance # Secure Access for MSPs OnePAM gives MSPs multi-tenant access management from one platform — per-client policies, session recording, and instant technician provisioning via IdP groups. Stop managing VPN accounts across hundreds of client environments Benefits: - Multi-tenant access management from a single OnePAM deployment - Per-client access policies with separate audit trails - Session recording for SLA compliance and incident documentation - Grant and revoke technician access per client instantly via IdP groups - Eliminate client-specific VPN configurations and credentials - White-label access portal for client-facing access requests - Time-limited access for project-based engagements - Complete audit trail for each client environment # Secure Access for Retail OnePAM replaces shared POS credentials with identity-verified access across every store location, with session recording and automated PCI DSS audit trails. PCI DSS requires individual accountability — shared POS credentials don't cut it Benefits: - PCI DSS-compliant access to cardholder data environments with full audit trails - Session recording for all access to POS systems and payment infrastructure - Secure remote management of distributed store locations without VPN per store - Grant vendor access to POS systems with time-limited, recorded sessions - Protect customer databases and loyalty program data with identity-verified access - Centralized access management across hundreds of retail locations # OnePAM for Startups Stop sharing SSH keys in Slack. OnePAM gives startups SSO, session recording, and RBAC from day one. Deploy in under 5 minutes, no security engineer required. Your first enterprise customer will ask about access controls — be ready Benefits: - Deploy in under 5 minutes — single binary, no infrastructure to provision - Free tier covers small teams so you only pay when you scale - Built-in SSO means you never manage SSH keys or shared passwords - Session recording gives you audit readiness for SOC 2 from day one - Browser-based access — nothing to install on developer laptops - Role-based access controls grow with your team without rearchitecting - Impress enterprise prospects with security posture beyond your size - Replace VPN + bastion + key management with a single tool # OnePAM for SMBs & Mid-Market Your IT team wears multiple hats and audits need access evidence. OnePAM gives mid-size teams centralized access with SCIM provisioning, approvals, and session recording. You don't have a security team — but auditors don't care Benefits: - Centralize access to all infrastructure through a single platform — SSH, RDP, VNC, databases, and web apps - Approval workflows for sensitive production access without complex ticketing systems - SCIM provisioning syncs users and groups from your IdP automatically - Session recording satisfies SOC 2, ISO 27001, and cyber insurance requirements - Just-in-time access eliminates standing privileges without slowing engineers down - Team-based policies let managers control access without IT bottlenecks - Contractor and vendor access with automatic expiration — no lingering VPN accounts - Single pane of glass for access auditing across all protocols # OnePAM for Enterprise OnePAM replaces credential sprawl and VPN bottlenecks with unified SSO, SCIM, multi-gateway architecture, vault integration, and session recording. Thousands of users, hundreds of teams, multiple regions — one platform Benefits: - Multi-gateway architecture for regional deployments with centralized policy management - Vault integration (HashiCorp, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) for credential lifecycle - SCIM 2.0 provisioning from Okta, Azure AD, and OneLogin for automated user lifecycle - Granular RBAC with team hierarchies, resource groups, and attribute-based policies - Approval workflows with multi-level escalation, Slack integration, and time-limited grants - Session recording with tamper-proof storage in your S3-compatible bucket - Smart alerting with escalation policies, maintenance windows, and on-call integration - Data masking for sensitive fields in database query results and terminal output - Log forwarding to your SIEM (Splunk, Elasticsearch, Datadog) for unified security monitoring - Endpoint trust scoring and device posture checks before granting access # OnePAM for DevOps Teams OnePAM replaces SSH key sprawl, bastions, and shared DB passwords with SSO-based SSH, per-user database sessions, and CLI access via OAuth2. SSH keys, bastion hosts, and VPN configs slow you down — eliminate them Benefits: - SSH into production servers with SSO instead of managing SSH keys across hundreds of hosts - Database access through the gateway — connect to PostgreSQL, MySQL, and MongoDB without sharing credentials - CLI client supports SSH and SCP via OAuth2 device flow — works in your existing terminal workflows - Just-in-time access to production with approval workflows — no standing privileges - Session recording captures every command for incident investigation and post-mortems - Agent-based deployment discovers resources automatically — no manual inventory - Secure network tunnels for accessing internal services that need network-level connectivity - API-first design integrates with CI/CD pipelines, Terraform, and infrastructure-as-code workflows # OnePAM for Security Teams OnePAM gives security teams Zero Trust access with identity verification, session recording, smart alerting, and compliance reporting — evidence, not guesswork. You can't investigate a breach if you don't know who accessed what Benefits: - Zero standing privileges — all access is just-in-time with identity verification and MFA - Complete session recording across SSH, RDP, VNC, and database sessions for forensic investigation - Smart alerting with escalation policies detects suspicious access patterns in real time - Data masking prevents sensitive information from being visible in session recordings - Endpoint trust scoring enforces device posture requirements before granting access - SIEM integration forwards access logs to Splunk, Elasticsearch, and Datadog - Compliance-ready audit reports for SOC 2, ISO 27001, HIPAA, PCI DSS, and SOX - Access request approval workflows with Slack notifications and multi-level escalation - Credential vaulting with HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault integration - Funnel links for controlled third-party access with automatic expiration and recording # OnePAM for IT & Infrastructure Teams OnePAM replaces your VPN, bastion, RDP gateway, database tool, and web app proxy with one platform. SCIM provisioning and instant onboarding/offboarding. Stop managing 5 access tools — consolidate into one Benefits: - SCIM 2.0 provisioning automatically syncs users and groups from Okta, Azure AD, or Google Workspace - Automated onboarding — new hires get access to the right resources instantly via IdP group membership - Instant offboarding — removing a user from the IdP revokes all access across every protocol immediately - Centralized dashboard shows all resources, active sessions, and access status in one place - Multi-protocol support means one tool replaces separate SSH, RDP, VNC, database, and web app access solutions - Health checks monitor resource availability and alert IT when servers or databases go offline - VPN access for legacy applications that require network-level connectivity - Self-service access requests reduce IT ticket volume with approval workflows and auto-provisioning # OnePAM for Engineering Teams VPN reconnections break flow and SSH key distribution takes hours. OnePAM provides SSO-based access to SSH, RDP, and databases through browser or CLI. VPN reconnects and SSH key distribution break your flow — stop tolerating it Benefits: - SSH via browser or native CLI — no SSH key management, no VPN, no bastion host - Database access through the gateway — run queries against PostgreSQL, MySQL, and MongoDB with individual identity - One-command CLI access via OAuth2 device flow — works with your existing terminal and scripts - Browser-based RDP for Windows development environments and staging servers - Switch between dev, staging, and production environments instantly — no VPN reconnection - Just-in-time production access with lightweight approval — doesn't break your flow - Session recording runs silently in the background — zero performance impact - SCP file transfer through the gateway with the same identity-based access controls # OnePAM for Compliance & GRC Teams Stop spending weeks gathering audit evidence. OnePAM generates continuous, tamper-proof audit trails with reports for SOC 2, HIPAA, PCI DSS, and more. Stop gathering audit evidence manually — generate it automatically Benefits: - Automated audit trail generation — every session is recorded with user identity, timestamp, and actions - Compliance reports mapped to SOC 2, ISO 27001, HIPAA, PCI DSS, SOX, and NIST 800-53 controls - Tamper-proof session recordings stored in your S3-compatible bucket with integrity verification - Access reviews with exportable reports showing who has access to what, when, and why - Separation of duties enforcement through role-based policies and approval workflows - Just-in-time access with automatic expiration eliminates standing privileges — a key audit finding - Data masking ensures sensitive information is not captured in session recordings - SIEM integration provides real-time compliance monitoring alongside your existing security stack # OnePAM for Platform Engineering Developers shouldn't file tickets for access. OnePAM is the access layer for your developer platform with self-service golden paths and auto-discovery. Developers file tickets and wait hours for access — build a golden path instead Benefits: - Self-service access portal — developers request access through golden paths instead of filing tickets - API-first design lets you integrate OnePAM into your internal developer platform and Backstage catalogs - Resource groups and team policies define access templates that scale with your organization - Approval workflows with Slack integration provide guardrails without creating bottlenecks - Agent-based resource discovery automatically registers new infrastructure as it's provisioned - Multi-gateway architecture supports platform teams managing access across multiple clusters and regions - Session recording and audit trails are built into the platform — no separate tooling needed - Terraform provider and API enable infrastructure-as-code access policy management ## Integrations # Okta Category: Identity Provider Enterprise SSO and user provisioning with Okta for seamless Zero Trust access control. Enforce MFA and group-based policies across all infrastructure. Features: - SAML 2.0 and OIDC SSO support - Automatic user deprovisioning on Okta removal - Group-based access policies - MFA enforcement through Okta policies - Just-in-time user provisioning - Okta Verify push notifications - Session management and SSO logout Use cases: - Centralize identity management for infrastructure access - Enforce MFA for SSH, RDP, VNC, Kubernetes, and database connections - Automate user lifecycle from hire to termination - Apply group-based RBAC to all resources # Microsoft Entra ID Category: Identity Provider Integrate with Microsoft Entra ID (Azure AD) for enterprise SSO and conditional access policies across SSH, RDP, databases, and Kubernetes. Features: - SAML 2.0 and OIDC SSO integration - Conditional Access policy support - Azure MFA integration - Entra ID P1/P2 feature support - Microsoft Authenticator push notifications - Group-based access control - Hybrid identity support Use cases: - Extend Microsoft 365 identity to infrastructure access - Apply Conditional Access policies to SSH, RDP, VNC, and Kubernetes - Leverage existing Azure security investments - Unify identity across cloud and on-premise resources # Google Workspace Category: Identity Provider SSO and user provisioning with Google Workspace for organizations using Google Cloud identity. Leverage Google Groups for role-based access control. Features: - SAML 2.0 SSO with Google Workspace - OIDC authentication support - Google Groups for access control - Automatic user provisioning via Google Directory API - Google 2-Step Verification support - Google Authenticator integration - Domain-wide delegation support - Admin console management Use cases: - Use Google accounts for infrastructure access - Leverage Google Groups for RBAC policies - Enforce Google 2-Step Verification for all access - Automate user management from Google Admin # Auth0 Category: Identity Provider Flexible identity platform integration with Auth0 for SSO and social login support. Enable passwordless authentication and custom rules for access control. Features: - SAML and OIDC SSO support - Social login connections - Enterprise connections (AD, LDAP) - Auth0 Universal Login - MFA with Auth0 Guardian - Custom rules and actions - User management API integration - Passwordless authentication Use cases: - Enable flexible authentication options for teams - Support contractor access via social logins - Implement passwordless access to infrastructure - Custom authentication flows for compliance # OneLogin Category: Identity Provider Enterprise SSO and user provisioning with OneLogin for unified access management. Extend OneLogin Smart Factor Authentication to all infrastructure resources. Features: - SAML 2.0 and OIDC SSO - OneLogin Protect MFA - Smart Factor Authentication - User lifecycle management - Directory integration - Access policies and rules - Session management Use cases: - Extend OneLogin to infrastructure access - Enforce Smart Factor Authentication for sensitive resources - Automate user provisioning from HR systems - Apply role-based access across all resources # Duo Security Category: Identity Provider Enforce Duo MFA for all infrastructure access with push notifications and device trust. Verify endpoint health before granting SSH, RDP, and database access. Features: - Duo Push notifications for MFA - Device trust and health checks - Adaptive access policies - Duo Universal Prompt - Hardware token support - Bypass codes for emergency access - Admin panel for policy management - Detailed authentication logs Use cases: - Add MFA to all infrastructure access - Verify device health before granting access - Implement adaptive authentication policies - Provide emergency bypass capabilities # JumpCloud Category: Identity Provider Cloud directory integration with JumpCloud for SSO and device management. Extend your cloud directory to Zero Trust infrastructure access with group-based RBAC. Features: - SAML 2.0 SSO integration - JumpCloud Directory for user provisioning - Group-based access control - MFA enforcement - Device management integration - Conditional access policies - LDAP and RADIUS support - Cross-platform identity Use cases: - Extend JumpCloud to infrastructure access - Leverage device trust for access decisions - Unify identity across cloud and on-premise - SMB-friendly Zero Trust implementation # SAML 2.0 Category: Identity Provider Connect any SAML 2.0 compliant identity provider for enterprise SSO integration. Works with ADFS, Shibboleth, and custom IdP implementations out of the box. Features: - SAML 2.0 SP-initiated SSO - IdP-initiated SSO support - Signed assertions and responses - Encrypted assertions - Attribute statement mapping - NameID format configuration - Single Logout (SLO) - Metadata exchange Use cases: - Integrate with on-premise ADFS - Connect to Shibboleth IdP - Custom enterprise IdP integration - Multi-IdP federation scenarios # OpenID Connect Category: Identity Provider Connect any OpenID Connect provider for modern OAuth 2.0 based authentication. Supports PKCE, custom scopes, and claim mapping for Zero Trust access control. Features: - OIDC Authorization Code flow - PKCE support for enhanced security - ID Token and Access Token validation - Userinfo endpoint integration - Custom scope configuration - Claim mapping to user attributes - Token refresh handling - Discovery document auto-configuration Use cases: - Integrate with custom OAuth servers - Connect cloud-native identity platforms - Modern authentication for new deployments - API-first identity integration # Splunk Category: SIEM Forward session recordings and audit logs to Splunk for security analysis and compliance. Correlate access events with other security data for threat detection. Features: - HTTP Event Collector (HEC) integration - Real-time event streaming - Session recording metadata forwarding - Access granted/denied events - User authentication events - Policy violation alerts - Custom field mapping - Splunk Enterprise and Cloud support Use cases: - Centralize access logs for SOC teams - Correlate access events with security incidents - Generate compliance reports from access data - Detect anomalous access patterns # Elastic SIEM Category: SIEM Stream access events to Elastic SIEM for threat detection and security analytics. Use machine learning anomaly detection and custom rules on access patterns. Features: - Elasticsearch HTTP API integration - Logstash input support - Beats integration option - ECS field mapping - Real-time event indexing - Session recording metadata - Custom index patterns - Elastic Cloud and self-hosted support Use cases: - Unified security analytics platform - Machine learning anomaly detection on access - Custom detection rules for policy violations - Long-term audit log retention # Microsoft Sentinel Category: SIEM Forward audit logs to Microsoft Sentinel for cloud-native SIEM and security orchestration. Correlate access events with Microsoft 365 and Azure activity. Features: - Log Analytics workspace integration - CEF/Syslog forwarding support - Azure Event Hub streaming - Custom table ingestion - Built-in detection rules - SOAR playbook triggers - Incident correlation - Azure-native security integration Use cases: - Unify Azure and infrastructure security - Correlate access with Microsoft 365 events - Automated incident response playbooks - Cloud-native SOC operations # Datadog Category: SIEM Send access logs and session metadata to Datadog for observability and security monitoring. Correlate access events with APM traces and security signals. Features: - Datadog Logs API integration - Real-time event forwarding - Custom tags and attributes - Session recording metadata - Access pattern dashboards - Security signal correlation - Log pipeline processing - Cloud and on-premise support Use cases: - Unify access logs with application observability - Correlate access events with APM traces - Security monitoring dashboards - Access pattern analytics # PagerDuty Category: Alerting On-call access provisioning and security alerts through PagerDuty incident management. Grant temporary production access to on-call engineers during incidents. Features: - On-call schedule-based access - Access alerts and incidents - Just-in-time access during incidents - Runbook integration - Event orchestration - Access request escalation - PagerDuty Events API v2 - Schedule sync for access policies Use cases: - Grant production access to on-call engineers - Alert on failed access attempts - Incident-triggered access provisioning - Escalation for access requests # HashiCorp Vault Category: Secrets Management Dynamic credential injection with HashiCorp Vault for just-in-time secrets. Eliminate static database credentials with time-limited session-scoped access. Features: - Dynamic database credentials - certificate authority - Just-in-time credential injection - Lease management and renewal - AppRole and JWT authentication - Namespace support - Transit encryption engine - Vault Enterprise support Use cases: - Eliminate static database credentials - certificates instead of keys - Time-limited credential access - Centralized secrets management # AWS Secrets Manager Category: Secrets Management Retrieve and inject credentials from AWS Secrets Manager for AWS-native deployments. Access RDS, Aurora, and other AWS resources with just-in-time retrieval. Features: - Secret retrieval via IAM roles - Cross-account secret access - Resource-based policies - Secrets versioning - AWS PrivateLink support - KMS encryption integration - CloudTrail audit logging Use cases: - AWS-native secrets management - RDS and Aurora credential injection - Cross-account database access - Just-in-time credential retrieval # Slack Category: Communication Access request notifications and approvals through Slack for instant team communication. Enable one-click just-in-time access approvals and security alerts. Features: - Access request notifications - Interactive approval buttons - Security alert channels - Session recording alerts - Slash commands for access status - Channel-based team routing - Block Kit rich messages - Slack Enterprise Grid support Use cases: - Real-time access request notifications - One-click approvals for just-in-time access - Security alert distribution - Team-based access workflows # Microsoft Teams Category: Communication Access notifications and approvals through Microsoft Teams for Microsoft-centric organizations. Handle access requests with Adaptive Cards directly in Teams. Features: - Incoming webhook notifications - Adaptive Card approvals - Teams channel routing - Security alert cards - Bot-based interactions - Team-based approval workflows - Message actions for quick access - Microsoft 365 integration Use cases: - Microsoft 365-native access workflows - Teams-based approval routing - Real-time security notifications - Cross-team access visibility # Discord Category: Communication Access request notifications, slash commands, and approvals through Discord for developer-centric teams. Features: - Slash commands for access management - Rich embed notifications - Interactive access approvals - Security alert channels - Session recording alerts - Server-based team routing - Ed25519 signature verification - Discord App Directory listing Use cases: - Real-time access request notifications - Slash command approvals for just-in-time access - Security alert distribution - Developer-centric access workflows # AWS Category: Cloud Platform Secure access to AWS EC2, RDS, and EKS without exposing resources to the internet. Eliminate public IPs and bastion hosts with identity-aware Zero Trust access. Features: - EC2 instance access via SSM-less connections - RDS and Aurora database access - EKS cluster access - VPC-native deployment options - IAM role-based authentication - AWS PrivateLink support - Cross-account access - CloudTrail integration Use cases: - Secure EC2 access without public IPs - RDS access without VPN or bastion - Multi-account AWS access management - EKS cluster administration # Google Cloud Category: Cloud Platform Secure access to GCE, Cloud SQL, and GKE without exposing resources publicly. Use Google Cloud private networking with Zero Trust identity-aware access. Features: - GCE instance access - Cloud SQL database connections - GKE cluster access - VPC-native deployment - Service account authentication - Private Google Access support - Multi-project access - Cloud Audit Logs integration Use cases: - Secure GCE access in private VPCs - Cloud SQL without public IP - GKE administration access - Cross-project resource access # Microsoft Azure Category: Cloud Platform Secure access to Azure VMs, Azure SQL, and AKS with Entra ID integration. Unify identity across Azure resources with browser-based Zero Trust sessions. Features: - Azure VM access (SSH and RDP) - Azure SQL database connections - AKS cluster access - VNet-native deployment - Entra ID authentication - Private Endpoint support - Cross-subscription access - Azure Activity Log integration Use cases: - Windows VM access via Linux proxy (no direct RDP exposure) - Azure SQL without public endpoint - AKS administration access - Hybrid cloud access management # Ping Identity Category: Identity Provider Enterprise SSO and adaptive authentication with Ping Identity for secure Zero Trust access to infrastructure. Features: - PingFederate SAML 2.0 and OIDC federation - PingOne Cloud SSO support - Adaptive MFA with PingID - SCIM user and group provisioning - Risk-based authentication policies - Directory integration with PingDirectory Use cases: - Federate enterprise identity for infrastructure access - Enforce adaptive MFA on privileged sessions - Automate user provisioning and deprovisioning via SCIM - Apply context-aware access policies based on risk score # Keycloak Category: Identity Provider Open-source SSO and identity federation with Keycloak for self-hosted Zero Trust authentication. Supports LDAP, AD federation, and custom authentication flows. Features: - SAML 2.0 and OIDC SSO integration - User federation from LDAP and Active Directory - Realm-based multi-tenancy support - Group and role synchronization - Custom authentication flows - Self-hosted identity with full data sovereignty Use cases: - Self-hosted SSO for restricted or regulated environments - Federate LDAP and Active Directory identities for infrastructure access - Enforce custom authentication flows for privileged sessions - Map Keycloak realm roles to OnePAM RBAC policies - Maintain full data sovereignty with on-premise identity # CyberArk Vault Category: Secrets Management Privileged credential retrieval from CyberArk Vault for enterprise-grade secrets injection. Eliminate static credentials with just-in-time access provisioning. Features: - Central Credential Provider (CCP) integration - Conjur secrets retrieval support - Just-in-time privileged credential injection - Credential rotation policy compliance - Safe-based access control mapping - Dual-control approval workflows Use cases: - Inject vaulted credentials into database sessions without exposing passwords - Enforce credential rotation policies across all managed resources - Integrate privileged access workflows with CyberArk safe policies - Eliminate standing privileged accounts on infrastructure - Satisfy audit requirements with end-to-end credential tracking # Sumo Logic Category: SIEM Cloud-native log analytics and SIEM with Sumo Logic for real-time access event intelligence. Correlate access patterns with application and cloud activity. Features: - HTTP Hosted Collector integration - Structured JSON event forwarding - Real-time access dashboards - Cloud SIEM correlation rules - Field extraction for access events - Scheduled compliance report generation Use cases: - Correlate infrastructure access events with application logs - Detect anomalous access patterns with Cloud SIEM analytics - Generate compliance reports for SOC 2 and ISO 27001 audits - Build real-time dashboards for security operations teams # IBM QRadar Category: SIEM Enterprise SIEM integration with IBM QRadar for advanced threat detection on infrastructure access. Correlate events with network activity for SOC workflows. Features: - Syslog and LEEF event forwarding - QRadar REST API integration - Custom DSM log source support - Offense correlation with access events - Compliance reporting for PCI DSS and HIPAA - Network activity baseline integration Use cases: - Correlate access events with network-level threat intelligence - Trigger QRadar offenses on unauthorized access attempts - Generate regulatory compliance reports from access audit data - Integrate infrastructure access into existing SOC workflows - Detect lateral movement through access pattern analysis # ServiceNow Category: ITSM IT service management integration with ServiceNow for automated access request ticketing and approval workflows. Features: - Automated access request ticket creation - Multi-level approval workflows - CMDB integration for resource inventory - Change management integration - SLA tracking for access provisioning - ServiceNow REST API and MID Server support Use cases: - Route access requests through ServiceNow approval workflows - Track access provisioning SLAs in ServiceNow dashboards - Sync infrastructure resources with ServiceNow CMDB - Integrate access changes with change management processes - Audit access requests with ServiceNow ticket history # Opsgenie Category: Incident Management Incident-driven access management with Opsgenie for on-call alerting and escalation workflows. Grant temporary production access to responders during incidents. Features: - Alert creation via Opsgenie REST API - On-call schedule-based access provisioning - Escalation policy triggers on access violations - Incident-scoped temporary access grants - Team-based alert routing - Opsgenie integration with Jira Service Management Use cases: - Alert on-call teams on failed access attempts or policy violations - Grant temporary production access during active incidents - Escalate unacknowledged access requests through Opsgenie policies - Route access alerts to the correct team based on resource ownership # New Relic Category: Observability Full-stack observability with New Relic for monitoring infrastructure access performance and security events. Features: - Event API and Log API integration - Custom dashboards for access metrics - NRQL queries on access event data - Alert conditions for access anomalies - Infrastructure agent correlation - Service level objective tracking for access latency Use cases: - Monitor access session latency and connection health - Correlate infrastructure access with application performance metrics - Set alert conditions on unusual access patterns or failures - Build unified dashboards spanning application and access telemetry - Track access SLOs alongside application SLOs # CrowdStrike Category: Endpoint Security Device trust and endpoint posture verification with CrowdStrike Falcon for context-aware access control. Features: - Falcon Zero Trust Assessment (ZTA) score integration - Device posture verification before access - Endpoint compliance checks for managed devices - Real-time threat intelligence from Falcon sensors - Conditional access based on device risk score - CrowdStrike Falcon API integration Use cases: - Block access from endpoints with active threats detected by Falcon - Enforce minimum ZTA scores for privileged resource access - Verify endpoint compliance before granting database connections - Correlate endpoint risk with infrastructure access policies - Restrict access from unmanaged or non-compliant devices # SailPoint Category: Identity Governance Identity governance and access certification with SailPoint for lifecycle management and compliance. Features: - Access certification campaign integration - Entitlement synchronization with IdentityNow - Separation of duties policy enforcement - Automated joiner-mover-leaver workflows - Role mining and access recommendations - Compliance reporting for SOX and GDPR Use cases: - Automate periodic access certification reviews for infrastructure - Enforce separation of duties across database and server access - Synchronize role-based entitlements from SailPoint to OnePAM - Streamline joiner-mover-leaver processes for infrastructure access - Generate governance reports for regulatory compliance audits ## Comparisons # OnePAM vs Teleport Teleport — Infrastructure access platform Compare browser-based Zero Trust access with certificate-based infrastructure access. # OnePAM vs StrongDM StrongDM — Infrastructure access platform Compare browser-based access and visual session recordings with client-based access. # OnePAM vs Tailscale Tailscale — WireGuard-based VPN mesh Compare Unified PAM access with VPN mesh for infrastructure security. # OnePAM vs HashiCorp Boundary HashiCorp Boundary — Identity-based access management Compare managed Zero Trust access with self-hosted identity-based access. # OnePAM vs Cloudflare Access Cloudflare Access — Zero Trust network access Compare purpose-built infrastructure access with broad Zero Trust network access. # OnePAM vs CyberArk CyberArk — Privileged access management Compare modern cloud-native access with traditional enterprise PAM. # OnePAM vs Fortinet VPN (FortiClient) Fortinet VPN (FortiClient) — Traditional VPN & endpoint security Compare true Zero Trust per-resource access with traditional VPN — plus how OnePAM differs from Fortinet's own ZTNA. # OnePAM vs Forcepoint VPN Client Forcepoint VPN Client — Traditional VPN client with network-level access Compare OnePAM's Unified PAM Solution with Forcepoint's VPN client — and see how both differ from Forcepoint's own Zero Trust solution. # OnePAM vs Zscaler Private Access (ZPA) Zscaler Private Access (ZPA) — Cloud-based Zero Trust network access (ZTNA) Compare OnePAM's session-level Zero Trust with Zscaler ZPA's connection-level access — and see why session recording changes everything. # OnePAM vs Cisco VPN (AnyConnect / Secure Client) Cisco VPN (AnyConnect / Secure Client) — Traditional VPN client with network-level access Compare OnePAM's Unified PAM Solution with Cisco AnyConnect — the world's most deployed VPN client — and see why Zero Trust is fundamentally safer. # OnePAM vs Sophos Connect Sophos Connect — Traditional VPN client for Sophos Firewall Compare OnePAM's architecture-level Zero Trust — browser-based, agentless, per-resource access — with Sophos Connect's VPN approach and Sophos ZTNA. # OnePAM vs Ubiquiti Teleport Ubiquiti Teleport — Hardware-based remote access VPN Compare OnePAM's Unified PAM Solution with Ubiquiti Teleport's hardware-dependent network VPN — and see why Zero Trust is fundamentally safer. # OnePAM vs Palo Alto GlobalProtect VPN Palo Alto GlobalProtect VPN — Enterprise VPN tied to next-gen firewalls Compare OnePAM's browser-based Zero Trust per-resource access with session recording against Palo Alto's GlobalProtect VPN and Prisma Access ZTNA. # OnePAM vs BeyondTrust BeyondTrust — Privileged access management platform Compare OnePAM's lightweight Unified PAM Solution with BeyondTrust's enterprise PAM suite — and see how modern access differs from legacy PAM. # OnePAM vs Delinea (Thycotic) Delinea (Thycotic) — Privileged access management and secrets Compare OnePAM's Unified PAM Solution with Delinea's Secret Server and Connection Manager — modern access vs traditional PAM. # OnePAM vs Twingate Twingate — Software-defined Zero Trust network access Compare OnePAM's browser-based, session-recorded access with Twingate's client-based network access — and see why session-level control matters. # OnePAM vs Netskope Private Access Netskope Private Access — SASE platform with private access Compare OnePAM's Unified PAM Solution with Netskope's SASE-embedded private access — purpose-built vs part of a larger platform. # OnePAM vs NordLayer NordLayer — Business VPN and Zero Trust access Compare OnePAM's session-level Zero Trust with NordLayer's VPN-first approach — and see how per-resource access with audit trails changes security. # OnePAM vs Keeper Security Keeper Security — Password management and PAM Compare OnePAM's Unified PAM Solution with Keeper's connection manager — and see how integrated SSO, recording, and Zero Trust differ from vault-based access. # OnePAM vs Pritunl Pritunl — Open-source VPN server Compare OnePAM's Zero Trust per-resource access with Pritunl's network-level VPN — and see why session recording and identity-based access change security fundamentally. ## Alternatives # Best Teleport Alternatives Teleport — Infrastructure access platform Find the best alternatives to Teleport for privileged access management and secure infrastructure access. # Best StrongDM Alternatives StrongDM — Infrastructure access platform Find the best alternatives to StrongDM for privileged access management and secure infrastructure access. # Best Tailscale Alternatives Tailscale — WireGuard-based VPN mesh Find the best alternatives to Tailscale for privileged access management and secure infrastructure access. # Best HashiCorp Boundary Alternatives HashiCorp Boundary — Identity-based access management Find the best alternatives to HashiCorp Boundary for privileged access management and secure infrastructure access. # Best Cloudflare Access Alternatives Cloudflare Access — Zero Trust network access Find the best alternatives to Cloudflare Access for privileged access management and secure infrastructure access. # Best CyberArk Alternatives CyberArk — Privileged access management Find the best alternatives to CyberArk for privileged access management and secure infrastructure access. # Best Fortinet VPN (FortiClient) Alternatives Fortinet VPN (FortiClient) — Traditional VPN & endpoint security Find the best alternatives to Fortinet VPN (FortiClient) for privileged access management and secure infrastructure access. # Best Forcepoint VPN Client Alternatives Forcepoint VPN Client — Traditional VPN client with network-level access Find the best alternatives to Forcepoint VPN Client for privileged access management and secure infrastructure access. # Best Zscaler Private Access (ZPA) Alternatives Zscaler Private Access (ZPA) — Cloud-based Zero Trust network access (ZTNA) Find the best alternatives to Zscaler Private Access (ZPA) for privileged access management and secure infrastructure access. # Best Cisco VPN (AnyConnect / Secure Client) Alternatives Cisco VPN (AnyConnect / Secure Client) — Traditional VPN client with network-level access Find the best alternatives to Cisco VPN (AnyConnect / Secure Client) for privileged access management and secure infrastructure access. # Best Sophos Connect Alternatives Sophos Connect — Traditional VPN client for Sophos Firewall Find the best alternatives to Sophos Connect for privileged access management and secure infrastructure access. # Best Ubiquiti Teleport Alternatives Ubiquiti Teleport — Hardware-based remote access VPN Find the best alternatives to Ubiquiti Teleport for privileged access management and secure infrastructure access. # Best Palo Alto GlobalProtect VPN Alternatives Palo Alto GlobalProtect VPN — Enterprise VPN tied to next-gen firewalls Find the best alternatives to Palo Alto GlobalProtect VPN for privileged access management and secure infrastructure access. # Best BeyondTrust Alternatives BeyondTrust — Privileged access management platform Find the best alternatives to BeyondTrust for privileged access management and secure infrastructure access. # Best Delinea (Thycotic) Alternatives Delinea (Thycotic) — Privileged access management and secrets Find the best alternatives to Delinea (Thycotic) for privileged access management and secure infrastructure access. # Best Twingate Alternatives Twingate — Software-defined Zero Trust network access Find the best alternatives to Twingate for privileged access management and secure infrastructure access. # Best Netskope Private Access Alternatives Netskope Private Access — SASE platform with private access Find the best alternatives to Netskope Private Access for privileged access management and secure infrastructure access. # Best NordLayer Alternatives NordLayer — Business VPN and Zero Trust access Find the best alternatives to NordLayer for privileged access management and secure infrastructure access. # Best Keeper Security Alternatives Keeper Security — Password management and PAM Find the best alternatives to Keeper Security for privileged access management and secure infrastructure access. # Best Pritunl Alternatives Pritunl — Open-source VPN server Find the best alternatives to Pritunl for privileged access management and secure infrastructure access. ## Tools # SSH Config Builder Visual SSH config generator with ProxyJump chains, wildcard patterns, and hardening best practices # OpenSSH Hardening Generator sshd_config generator with security profiles for different OS and OpenSSH versions # SSH Key Inventory Auditor Analyze SSH public keys for algorithm strength, duplicates, and security recommendations # SSH Login Banner Generator Create legal warning banners for /etc/issue, /etc/motd, and sshd_config with compliance templates # RDP Hardening Generator Configure NLA, encryption levels, session timeouts, and GPO settings for secure Remote Desktop access # Password Policy Generator Create enterprise password policies with complexity rules, rotation schedules, and compliance mappings # Credential Rotation Planner Plan rotation schedules for SSH keys, database passwords, API tokens, and service account credentials # Privileged Account Discovery Checklist Interactive checklist to discover and catalog privileged accounts across infrastructure with risk scoring # RBAC Policy Generator Define roles, permissions, and resource access rules. Export as JSON, YAML, or policy documents # JIT Access Policy Generator Build just-in-time access policies with time windows, approval requirements, and auto-revocation rules # Linux User Provisioning Generator Generate idempotent Linux user setup scripts with SSH keys, sudo policies, and group membership # Access Review Report Builder Generate quarterly audit reports with automated findings for SOC 2, HIPAA, and PCI-DSS # Kubernetes RBAC Generator Build least-privilege ClusterRoles, Roles, and RoleBindings with production-ready YAML export # Service Account Auditor Catalog non-human and machine identities with risk scoring by privilege level and credential age # Compliance Access Control Mapper Cross-reference access control requirements across SOC 2, HIPAA, PCI-DSS, ISO 27001, and NIST 800-53 # Zero Trust Readiness Assessment Evaluate your organization's Zero Trust readiness with scored assessment and recommendations # MFA Readiness Assessment Evaluate MFA deployment readiness with recommendations for methods, rollout, and user communication # PAM Maturity Assessment Score your organization across identity, access governance, session management, credential vaulting, and compliance # Incident Response Playbook Generator Step-by-step response procedures for access-related security incidents # Session Recording Policy Builder Define recording rules per protocol for SSH, RDP, databases, Kubernetes, and web apps # LDAP Authentication with OpenSSH Guide Complete guide to LDAP authentication for OpenSSH using SSSD, PAM, and public key lookup # AD Hardening Audit PowerShell Generator Comprehensive Active Directory security assessment aligned with CIS Benchmarks and NIST 800-53 ## Pricing ### Solo — $9/per month Annual: $9/per month For a single user. 1 user users, 15 resources resources, 14-day retention retention. - SSH access with session recording - VPN Access (1 peer) - Basic SSO & MFA enforcement - Audit logs & native CLI - Basic alerting & email notifications - 15 resources, 14-day retention ### Team — $19/per user / month Annual: $15/per user / month, billed annually For teams of any size. Multi-user users, 200 resources resources, 30-day retention retention. - Everything in Solo, plus: - Multi-user organisation - RDP, Database & Web App access - SAML/OIDC SSO & Teams RBAC - VPN Access (5 peers) - Audit log export, API & Terraform - Network & resource discovery - Basic alerting & notifications (Email, Slack, Discord, Teams) - 200 resources, 30-day retention ### Professional — $29/per user / month Annual: $22/per user / month, billed annually For growing teams. Multi-user users, 500 resources resources, 60-day retention retention. - Everything in Team, plus: - Just-in-Time access & approval workflows - SOC 2 compliance reports & log forwarding - Real-time compliance posture dashboard - Advanced alerting & all notification channels - Security policies (reauth, idle timeout, MFA) - Session risk analysis & endpoint posture - VPN split tunnel & custom DNS (10 peers) - 500 resources, 60-day retention ### Business — $49/per user / month Annual: $39/per user / month, billed annually For security-first organizations. Multi-user users, Unlimited resources resources, 180-day retention retention. - Everything in Professional, plus: - Kubernetes, gRPC, Telnet & container access - Cloud entitlement management (CIEM) - Dedicated gateways & gateway failover - SIEM integration & data masking - Machine identity (service accounts) - Live session monitoring (four-eyes) - ITSM integration (ServiceNow, Jira) - Access review campaigns - Command filtering & blocking (SSH/DB) - VPN mesh network & exit nodes - Custom recording & customer storage (BYOS S3) - Unlimited resources, 180-day retention - Dedicated support channel