Privileged access management (PAM) controls the accounts that can change systems, read sensitive data and disable security controls: domain administrators, root accounts, database administrators, cloud administrators, service accounts and, increasingly, AI agents. This guide compares seven PAM solutions available to organisations in Dubai and across the UAE, sets out the UAE requirements that apply to privileged access, and explains how to choose between them.
The PAM market changed significantly in 2026. Palo Alto Networks completed its acquisition of CyberArk in February and relaunched CyberArk’s identity security products as Idira in May, Delinea completed its acquisition of StrongDM in March, and One Identity announced in June that it is separating from Quest Software. Several vendors now host their cloud services in UAE data centres.
If you want a provider to deploy and run PAM for you, our PAM solutions and services in Dubai page covers what that includes.
Table of Contents
PAM solutions in the UAE compared
The table summarises each solution. Deployment options and UAE hosting are taken from vendor documentation as of October 2026. Hosting applies to specific products. Where a vendor does not publish UAE hosting, iConnect can confirm current options with the vendor as part of your evaluation.
| Solution | Deployment | Main components | UAE hosting | Known for |
|---|---|---|---|---|
| BeyondTrust | SaaS, plus self-hosted Password Safe and Privileged Remote Access | Password Safe, Privileged Remote Access, Endpoint Privilege Management, Entitle, Identity Security Insights | Password Safe in Azure UAE North (Dubai); Privileged Remote Access and Remote Support in the AWS UAE region | PAM, endpoint privilege and identity threat detection on one platform |
| Saviynt | Cloud-native SaaS | Privileged Access Management within Saviynt Identity Cloud | Local hosting announced with its Dubai regional HQ (December 2025) | PAM and identity governance on one platform |
| CyberArk (Idira) | SaaS and self-hosted | Privileged Access Management, Endpoint Privilege Manager, Secrets Management, Vendor Privileged Access | UAE-hosted identity security services launched in 2024 | Privilege controls for human, machine and AI agent identities |
| Delinea | SaaS and on-premises | Secret Server, Privilege Manager, Privileged Remote Access, Delinea Platform | Delinea Platform in Azure UAE North and UAE Central | Vaulting and endpoint privilege, with runtime authorisation from StrongDM |
| ARCON | On-premises, SaaS and cloud | ARCON PAM, Endpoint Privilege Management, Cloud Governance (CIEM) | No UAE SaaS region published (October 2026); on-premises available | Converged PAM, endpoint privilege and non-human identity controls |
| ManageEngine PAM360 | On-premises, cloud edition in beta | PAM360 | No UAE region published for PAM360 (October 2026); on-premises available | PAM with SSH key and certificate management for IT teams |
| One Identity Safeguard | Appliance, virtual, cloud and hybrid | Safeguard for Privileged Passwords, Safeguard for Privileged Sessions, Cloud PAM Essentials | No UAE SaaS region published (October 2026); appliance and virtual options | Password vaulting with session recording and analytics |
Why privileged access needs its own controls
An attacker who obtains a privileged credential can move between systems, create accounts, disable logging and reach the data an organisation most needs to protect. Verizon’s 2026 Data Breach Investigations Report found credential abuse somewhere in the attack in 39% of breaches, even though exploited software vulnerabilities overtook stolen passwords as the most common way in.
The number of privileged identities is also growing. Alongside administrators, organisations now manage service accounts, API keys and secrets used by applications and pipelines, third-party and vendor access for support, cloud entitlements across several platforms, and AI agents that act on systems with their own credentials. Several of the largest PAM vendors, including CyberArk, BeyondTrust, Delinea and Saviynt, added controls for AI agent identities in 2025 and 2026, extending the secrets and service account management they already offered.
UAE requirements for privileged access
UAE Information Assurance Regulation. The UAE IA Regulation v1.1, the basis of what is still called NESA compliance, includes control T5.2.2 Privilege Management as a P1 control: the entity shall restrict and control the allocation and use of privileges. Related controls cover user authentication for external connections (T5.4.2, P1), monitoring system use (T3.6.3, P1) and audit logging (T3.6.2). The UAE Cyber Security Council issued version 2 of the IA Standard in 2025, reorganising the controls into a reported 134 controls across 15 families, so confirm which version your regulator assesses you against. See our guide to NESA compliance and the UAE IA Standard.
Central Bank of the UAE. The Retail Payment Services and Card Schemes Regulation requires payment service providers to exercise due care when controlling the use of and access to privileged and emergency IDs, including limiting the number of privileged users, controlling remote access by privileged users, and logging and monitoring their activity. Where a bank outsources an activity, the CBUAE Outsourcing Standards for Banks require its data protection measures to include access rights management, with a periodic review of user privileges.
National Cloud Security Policy. Version 2.0 of the UAE Cyber Security Council’s policy (September 2025), which applies to federal ministries and authorities and to critical information infrastructure entities, includes identity and access management requirements for organisations using cloud services.
DESC Information Security Regulation. Dubai Government Entities must meet the ISR, which includes an access control domain. The control text is provided by the Dubai Electronic Security Center on request.
UAE PDPL. Article 20 of the UAE Personal Data Protection Law requires security measures suited to the risks of processing personal data. Restricting and monitoring privileged access to systems holding personal data is one of the ways organisations meet it. Where a PAM service stores session recordings or credentials in the cloud, also check UAE data residency requirements for your sector.
What to look for in a PAM solution
Credential vaulting and rotation. Privileged passwords and keys are stored in an encrypted vault, checked out when needed and rotated automatically after use, so they are not shared, reused or left unchanged. Many platforms can also inject credentials into a session so the administrator never sees them.
Session management and recording. Privileged sessions run through the PAM platform, which records them and can block commands or end a session in real time. Recordings are the evidence auditors and incident responders ask for.
Just-in-time access. Privileges are granted for a specific task and time window, then removed, so standing administrator rights are kept to a minimum.
Endpoint privilege management. Removing local administrator rights from laptops and servers, with controlled elevation for approved applications, closes one of the most common routes attackers use after initial access.
Third-party and remote access. Vendors and support partners connect through the PAM platform without VPN access to the wider network, with approval and recording.
Secrets and non-human identities. Applications, scripts, pipelines and AI agents need credentials too. Check how the platform discovers and manages them.
Integration and monitoring. The platform should connect to your directory and identity provider, ITSM for approvals, and SIEM so that your security operations centre sees privileged activity alongside other alerts.
Deployment and data location. Decide between SaaS, self-hosted and hybrid, and confirm where vault data and session recordings are stored. Our guide to selecting a PAM solution covers evaluation in more detail.
The best PAM solutions in the UAE
The solutions are listed in no particular order. Each entry covers what the product includes, recent updates, the organisations the vendor positions it for, and UAE hosting.
1. BeyondTrust
BeyondTrust brings its products together on the Pathfinder platform, covering privileged credentials, remote access, endpoint privilege and identity threat detection for human, non-human and AI agent identities.
- Password Safe for credential and secrets vaulting with session management
- Privileged Remote Access for audited access by employees and vendors without a VPN
- Endpoint Privilege Management for Windows, Mac and Linux, removing local administrator rights
- Entitle for just-in-time access to cloud, infrastructure and SaaS applications
- Identity Security Insights for identity threat detection and analysis of paths to privilege
Recent updates: in April 2026 BeyondTrust released PathfinderAI, for natural-language identity risk queries, and a Pathfinder MCP server in early access. In August it added AI agent security and non-human identity governance to its early access programme on the Pathfinder platform.
Best fit: organisations that want PAM, remote access and endpoint privilege management from one vendor, across hybrid and cloud environments.
UAE hosting: Password Safe is available in Azure UAE North (Dubai), and Privileged Remote Access and Remote Support in the AWS Middle East (UAE) region. BeyondTrust has an office in Dubai. iConnect is a BeyondTrust partner in Dubai.
2. Saviynt
Saviynt delivers privileged access management as part of Saviynt Identity Cloud, a cloud-native platform that also includes identity governance and administration, so privileged access and access governance are managed together.
- Credential vaulting, session recording and remote privileged access from one console
- Just-in-time access and zero standing privilege for human, non-human and AI identities
- Continuous discovery of privileged accounts and excess privileges
- Privileged identity governance with access reviews on the same platform as IGA
- Discovery of secrets and privileged paths across cloud and CI/CD pipelines
Recent updates: Saviynt opened a regional headquarters in Dubai in December 2025, raised USD 700 million in a funding round led by KKR the same month, and launched Zuma, its AI identity security platform, in July 2026.
Best fit: organisations that want PAM and identity governance in one cloud platform, including those consolidating several identity tools.
UAE hosting: with the opening of its Dubai headquarters, Saviynt announced it will host Identity Cloud locally to help customers meet data residency requirements. A go-live date had not been published as of October 2026. iConnect is a Saviynt partner in Dubai.
3. CyberArk (Idira, Palo Alto Networks)
Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026 and relaunched the CyberArk identity security products as Idira in May 2026. When the acquisition closed, Palo Alto Networks said CyberArk’s identity security solutions would remain available as a standalone platform and that existing customers would see no disruption. At the Idira launch, existing CyberArk SaaS customers were given upgrade paths that depend on their licence.
- Privileged Access Management with discovery of identities, entitlements and access paths
- Zero standing privilege with just-in-time, dynamic privileges
- Endpoint Privilege Manager
- Secrets management for applications and machine identities
- Vendor Privileged Access for third parties
- Controls for AI agents, including discovery and privilege management
Recent updates: the Idira launch added AI-driven least-privilege recommendations and privileged access through Prisma Browser, with integration into Palo Alto Networks’ Prisma AIRS.
Best fit: large organisations with complex privileged access requirements across human, machine and AI identities, and those standardising on Palo Alto Networks.
UAE hosting: CyberArk launched identity security platform services hosted in a UAE data centre in April 2024. The UAE-hosted scope under the Idira name had not been published as of October 2026. iConnect is a Palo Alto Networks partner in Dubai.
4. Delinea
Delinea, formed from Thycotic and Centrify, offers its PAM products through the Delinea Platform, with Secret Server and Privilege Manager also available on-premises.
- Secret Server for vaulting, discovery and password rotation, with session recording
- Privilege Manager for endpoint privilege management on Windows and macOS, with Linux and Unix servers covered by Privilege Control for Servers
- Privileged Remote Access for vendors and remote administrators
- Server privilege control and cloud entitlement controls
- Identity Threat Protection and DevOps secrets management
Recent updates: Delinea completed its acquisition of StrongDM on 5 March 2026, adding continuous runtime authorisation, and in July 2026 made runtime authorisation for AI agents available on the Delinea Platform.
Best fit: organisations that want a choice between SaaS and on-premises vaulting, with endpoint privilege management in the same product family.
UAE hosting: the Delinea Platform is available in the Azure UAE North (Dubai) and UAE Central (Abu Dhabi) regions.
5. ARCON
ARCON offers ARCON PAM for on-premises, SaaS and cloud deployment, alongside endpoint privilege management and cloud entitlement controls, presented as a converged identity platform.
- Password vaulting and session monitoring and recording
- Just-in-time privileges with approval workflows
- Multi-factor authentication and role-based access
- Endpoint Privilege Management
- Cloud Governance for cloud infrastructure entitlement management, and non-human identity security
Recent updates: in March 2026 ARCON announced a partnership with DNV Cyber to expand in the Nordics. It continues to position PAM, endpoint privilege and non-human identity security as one converged identity platform.
Best fit: organisations that need on-premises PAM with endpoint privilege and cloud entitlement controls from one vendor.
UAE hosting: no UAE-hosted SaaS region is published as of October 2026. On-premises deployment keeps data in your own UAE environment.
6. ManageEngine PAM360
ManageEngine PAM360, from Zoho’s ManageEngine division, is a self-hosted PAM product that combines privileged credential management with SSH key and SSL/TLS certificate management.
- Privileged credential vaulting and session recording
- Privilege elevation and delegation with just-in-time elevation
- Endpoint privilege management and remote access for third parties
- SSH key and certificate lifecycle management
- Cloud infrastructure entitlement management and non-human identity governance
Recent updates: 2026 releases added AI summaries of Windows RDP sessions, ephemeral account provisioning, integration with cloud and self-hosted language models, discovery for Azure and Amazon RDS, and just-in-time elevation for LDAP.
Best fit: IT teams that want self-hosted PAM with certificate and key management in one product.
UAE hosting: PAM360 is primarily deployed on-premises, and ManageEngine’s site shows a cloud option marked beta. Zoho opened data centres in Dubai and Abu Dhabi in January 2026, but PAM360 is not listed among the products hosted there.
7. One Identity Safeguard
One Identity Safeguard combines Safeguard for Privileged Passwords and Safeguard for Privileged Sessions, with One Identity Cloud PAM Essentials as a SaaS option.
- Privileged password vaulting and request workflows
- Privileged session recording and analytics
- Privilege elevation and delegation for UNIX, Linux and macOS
- AI-assisted search and configuration
- Deployment as hardware or virtual appliances, in the cloud or hybrid
Recent updates: in June 2026 One Identity announced that it will become an independent company, separate from Quest Software, with its global headquarters moving to Cork, Ireland. The company said the transition will continue through 2026.
Best fit: organisations that want strong session recording and analytics, and those already using One Identity for identity governance.
UAE hosting: no UAE-hosted SaaS region is published as of October 2026. Appliance and virtual deployments keep data in your own UAE environment.
Which solution fits your environment
You want PAM and identity governance together. Saviynt runs PAM on the same platform as identity governance, and One Identity offers governance alongside Safeguard.
You need to keep PAM on-premises. Delinea Secret Server, BeyondTrust Password Safe and Privileged Remote Access, Idira Privileged Access Manager Self-Hosted, ARCON, ManageEngine PAM360 and One Identity Safeguard all support self-hosted deployment.
You need UAE-hosted SaaS. BeyondTrust (Password Safe and Privileged Remote Access) and Delinea publish UAE regions, CyberArk launched UAE-hosted services in 2024, and Saviynt has announced local hosting. iConnect can confirm which components are hosted in-country for your requirements.
Third-party access is the main concern. BeyondTrust Privileged Remote Access, Idira Vendor Privileged Access and Delinea Privileged Remote Access are built for vendor and support access without a VPN.
You manage many service accounts, keys and certificates. ManageEngine PAM360 includes SSH key and certificate management, and Idira and Delinea include secrets management for applications.
PAM works alongside identity and access management. If you are also reviewing single sign-on, multi-factor authentication and access governance, see our IAM solutions in Dubai.
Implementing PAM: a practical sequence
1. Discover privileged accounts. Find administrator, service and shared accounts across servers, network devices, databases, cloud platforms and applications. Most PAM tools include discovery.
2. Vault and rotate the most critical credentials. Start with domain administrator, root and cloud administrator accounts, then extend to the rest.
3. Route privileged sessions through the platform. Enable recording for administrative and third-party sessions.
4. Remove standing privileges. Move to just-in-time access and remove local administrator rights from endpoints.
5. Bring in non-human identities. Manage secrets used by applications, scripts and AI agents.
6. Monitor and review. Send privileged activity to the SOC, review access regularly and keep evidence for the UAE IA Standard, Central Bank or DESC reviews that apply to you.
Frequently asked questions
What is privileged access management?
Privileged access management (PAM) is the set of controls that secure accounts with elevated rights, such as administrators, service accounts and AI agents. A PAM solution vaults and rotates privileged credentials, records privileged sessions, grants elevated access only when needed and removes unnecessary administrator rights.
What is the best PAM solution in the UAE?
It depends on your environment. BeyondTrust and Delinea combine PAM with endpoint privilege management, and both host some cloud services in the UAE, Saviynt combines PAM with identity governance, CyberArk (now Idira from Palo Alto Networks) covers large and complex environments, and ARCON, ManageEngine PAM360 and One Identity offer self-hosted options.
Is CyberArk still available after the Palo Alto Networks acquisition?
Yes. Palo Alto Networks completed the acquisition on 11 February 2026 and relaunched the CyberArk identity security products as Idira in May 2026. Palo Alto Networks said CyberArk's solutions would remain available as a standalone platform with no disruption for existing customers, and existing SaaS customers have upgrade paths to Idira.
Which PAM solutions can be hosted in the UAE?
BeyondTrust hosts Password Safe in Azure UAE North and Privileged Remote Access in the AWS UAE region, and the Delinea Platform runs in Azure UAE North and UAE Central. CyberArk launched UAE-hosted services in 2024 and Saviynt has announced local hosting. Self-hosted products, such as Delinea Secret Server, BeyondTrust Password Safe, Idira Privileged Access Manager Self-Hosted, ARCON, ManageEngine PAM360 and One Identity Safeguard, can run in your own UAE environment.
Does the UAE IA Standard (NESA) require PAM?
The UAE IA Regulation includes Privilege Management (T5.2.2) as a P1 control, requiring entities to restrict and control the allocation and use of privileges, along with controls for remote access authentication and monitoring. It does not name a specific product, but a PAM solution is the usual way to meet these controls.
What is the difference between PAM and IAM?
Identity and access management (IAM) covers all users, with single sign-on, multi-factor authentication and access governance. PAM focuses on accounts with elevated rights, adding credential vaulting, session recording and just-in-time privilege. Most organisations need both.
What is just-in-time privileged access?
Just-in-time access grants elevated rights for a specific task and time window, then removes them automatically. It reduces the number of accounts with standing administrator rights that an attacker could use.
What is PAM as a service?
PAM as a service usually means a provider deploys, operates and monitors the PAM platform for you, including onboarding accounts, managing policies and reviewing privileged activity. Some vendors also use the term for their SaaS PAM products, so check which one is on offer. iConnect offers PAM as a service for organisations in the UAE.
Product names, features and hosting options in this guide are based on each vendor’s published information as of October 2026. Features vary by edition and region. Confirm current details with the vendor or with iConnect before purchase. iConnect is a partner of BeyondTrust, Saviynt and Palo Alto Networks.
