BeyondTrust Password Safe takes a different approach to privileged access than CyberArk. Instead of structuring governance around Safes and platform policies, Password Safe organizes the world into managed systems, the privileged accounts that live on them, and an automation engine called Smart Rules that decides how everything should be classified, onboarded, and assigned. The platform is designed for speed: if your identity data is clean, BeyondTrust can onboard and govern an entire fleet of privileged accounts with almost no manual work.

A Different Architecture and Mindset

Password Safe is built around a tightly integrated appliance model. The same cluster provides the web UI, APIs, job engine, credential storage, and session brokering. On top of that, the platform models your environment in terms of managed systems, managed accounts, Smart Rules, Access Profiles, Quick Rules, and Secret Safe.

Managed systems are the logical representations of servers, domains, databases, network devices, and cloud workloads. When Password Safe identifies a system, it interrogates it to retrieve accounts: local and domain admins, service accounts, functional identities, and other privileged users. Those accounts become managed accounts, which are the raw material Smart Rules operate on.

Smart Rules: The Heart of BeyondTrust Automation

Smart Rules determine how each newly discovered account should be handled. They evaluate patterns in account names, attributes retrieved from Active Directory, directory metadata, platform type, and system characteristics. Based on those conditions, a Smart Rule can onboard an account into Password Safe, assign an owner, apply the right rotation policy, attach the appropriate Access Profile, and generate the Quick Rule that ties the entitlement together.

When identity hygiene is strong, Smart Rules can turn privilege management into an almost completely autonomous process. A new server appears, Password Safe discovers its accounts, Smart Rules onboard them, map them to the right owner, and assign the correct access rights without an engineer manually wiring anything up.

The flip side is that Smart Rules depend heavily on ownership mapping. If the platform cannot determine who a privileged account belongs to, the automation stops, and you lose much of what makes BeyondTrust so compelling.

How Ownership Mapping Actually Works

Password Safe relies on two main mechanisms to determine ownership: attribute matching and name matching. Attribute matching is the preferred method. If the privileged account and the human account share a common AD attribute such as an employee ID, email address, or a custom extension attribute, Smart Rules can reliably link the two without depending on naming conventions. In well-governed environments, this alone is enough to automate the majority of assignments.

When attribute matching is not available, BeyondTrust falls back to naming patterns. In most deployments, this requires the privileged account to share the same base username as the human account. For example, if your elevated identity is jason.pratt2-domainadmin, your human account should be jason.pratt2. BeyondTrust does not automatically normalize or reconcile different numeric suffixes such as mapping jason.pratt2 to jason.pratt3; the names must match. If they do not, Smart Rules simply cannot determine ownership.

Once the base identity matches, Password Safe can attach the correct owner, apply rotation settings, assign an Access Profile, and generate the necessary Quick Rule automatically. When both attributes and naming conventions are clean, this process scales very efficiently. When they are not, administrators quickly find themselves fighting the automation instead of benefiting from it.

Access Profiles: How Users Interact With Accounts

Access Profiles define what a user is actually allowed to do with a privileged account. They control whether someone may retrieve a password, launch an RDP session, initiate an SSH session, request approval, work under just-in-time elevation, or be subject to session recording. In other words, they describe the behavior of access rather than just who is allowed through the door.

Behind the scenes, Password Safe generates a Quick Rule to bind everything together. The Quick Rule links the user or group, the managed account, and the Access Profile. Smart Rules create and update these Quick Rules dynamically as systems and accounts are discovered, which keeps the entitlement model clean even as the underlying environment changes day by day.

Secret Safe and Workforce Uses

BeyondTrust also includes Secret Safe, a built-in credential vault for workforce passwords, application secrets, API keys, and other sensitive items that do not necessarily need to participate in automated rotation. It is integrated directly into the Password Safe experience and is designed to be easy for end users to adopt.

Secret Safe does not try to be a full replacement for CyberArk’s Safe-level governance. Instead, it fills a similar role to Workforce Password Management in CyberArk: a secure, user-friendly location for everyday credentials and secrets. For teams that want PAM for infrastructure but still need a secure store for general credentials, Secret Safe covers that gap without requiring a separate product.

Session Access in Password Safe

Out of the box, Password Safe provides native RDP and SSH session brokering. When an admin launches a session, the appliance injects the credential directly into the RDP or SSH connection, so the user never sees the underlying password. Sessions can be recorded, audited, and wrapped in approval workflows in much the same way CyberArk wraps human access with PSM.

However, the native session model stops at RDP and SSH. If you need browser-based logins for admin portals, database client integrations, or thick-client applications, you have to extend the platform. Most organizations either license BeyondTrust Privileged Remote Access (PRA), which adds web and application session control, or they build their own launchers using AutoIT scripts and an RDP farm. This is a key difference from CyberArk, where a large library of native PSM connectors covers many of these scenarios without additional components.

Password Rotation and the Job Engine

Password Safe handles password management through its internal job engine. The same appliance that hosts the UI and APIs verifies stored credentials, rotates them on schedule, reconciles mismatches, and updates dependencies such as Windows services, scheduled tasks, and application pools when those are configured. For standard technologies, configuration is straightforward, and the operational overhead is relatively low compared to more modular architectures.

Because the job engine runs inside the appliance, network design tends to be simpler: you are not managing multiple distinct components scattered across different subnets. The trade-off is that you have less fine-grained control than you might with a dedicated CPM tier, but the overall deployment footprint is smaller and often easier to maintain.

A Typical BeyondTrust Reference Architecture

A standard Password Safe deployment uses one or more appliances in a cluster. Those appliances provide the UI, API endpoints, vaulting, the job engine, and session brokering. They establish outbound connectivity to managed systems over WinRM for Windows, SSH for Unix and network devices, and database protocols for data platforms. Active Directory or Azure AD integration supplies the identity attributes Smart Rules use to determine ownership and entitlements.

From an admin’s perspective, the workflow is simple. They authenticate via SSO, open the Password Safe interface, and immediately see the systems and accounts that Smart Rules have onboarded and mapped to them. From there, they can launch RDP or SSH sessions, request passwords where policy allows it, and review rotation status, while all the auditing, approvals, and recordings remain centralized on the appliances.

A Hidden Capability Most People Never Talk About

There is also a lesser-known side to Password Safe. Under the hood, the platform runs on a SQL database, and the discovery and inventory processes store far more data than the UI exposes. Every scan, system attribute, managed account, dependency, and relationship ends up in structured tables. With direct SQL access, teams can build custom reports, correlate asset and account data in ways the product does not offer out of the box, and even drive internal automation based on queries.

BeyondTrust does not advertise or officially recommend using SQL as an automation layer, and it is something that must be approached carefully from a support and upgrade perspective. But the reality is that the dataset is extremely rich, and experienced teams often leverage those tables to extend Password Safe far beyond what is visible through the standard interface.

Strengths and Trade-Offs

BeyondTrust excels at automation. When identity attributes and naming conventions are clean, Smart Rules can scale faster than almost any other PAM platform, onboarding new systems and accounts with minimal operational effort. The appliance model keeps architecture simple, the onboarding flow is fast, and Access Profiles give a clear way to define how privileged accounts should be used.

At the same time, the platform’s efficiency is tightly coupled to data quality. If ownership mapping is unreliable, Smart Rules break down, and you lose the benefit of automatic onboarding and entitlement assignment. Native session capabilities are limited to RDP and SSH unless you extend with PRA or custom launchers, and the session ecosystem is not as broad as CyberArk’s. Password Safe works best in environments where identity, attributes, and naming are already under control, and where a highly automated, appliance-centric model is more valuable than a deeply modular one.