The BeyondTrust Universe: — Password Safe, PRA, EPM, PMUL & the Pathfinder Platform

① The heritage map — Bomgar, Avecto, PowerBroker, PBIS

Walk into any PAM team in Bengaluru and you will hear product names that do not exist on beyondtrust.com any more: "the Bomgar box", "Avecto policies", "PowerBroker on the Linux estate". None of these people are out of date — the old names are baked into service names, registry paths, binaries and even job descriptions. BeyondTrust today is one badge over four bloodlines, and you need to speak both generations fluently.

The strangest story first. In 2018, Bomgar — a remote-support appliance company — acquired BeyondTrust and then kept the BeyondTrust name. The buyer took the target’s name, because BeyondTrust was the better-known PAM brand. Bomgar’s technology became today’s Remote Support (helpdesk) and Privileged Remote Access (PRA). The lineage is still visible in production: the appliance’s vendor-support tunnel and update domains live on bomgar.com to this day.

Three more bloodlines. Avecto Defendpoint became Endpoint Privilege Management (EPM) for Windows and Mac — and the Windows agent service is literally still named "Avecto Defendpoint Service", with its config under HKLM\SOFTWARE\Avecto\Privilege Guard Client. PowerBroker became Privilege Management for Unix & Linux (PMUL) — every binary keeps the pb prefix (pbrun, pbmasterd), and even Password Safe’s session-proxy registry path says PBPS (PowerBroker Password Safe). PBIS / Likewise became AD Bridge, and the agent still installs to /opt/pbis.

The four bloodlines

Tap each card — old name on the front, what it became (and where it still leaks) on the back.

② The product family by problem solved

Stop asking "what is BeyondTrust?" and start asking "which pain is this box for?" Five pains cover the whole family: shared unrotated privileged passwords · vendors needing access without VPN · helpdesk remote-controlling employees · everyone-is-local-admin laptops · Linux root chaos with a separate local account on every box. Five pains, five products — and picking the wrong one is the most common rookie mistake in PAM projects.

Pain 1: shared passwords → Password Safe. The vault that stores, rotates and brokers privileged credentials. Think of an SBI bank locker: your key plus the bank officer’s key (request + approval), the counter register (audit trail), and the lock re-keyed after every visit (rotation on check-in). Crucially it also has a session proxy: admins RDP/SSH to the proxy, never to the target, and the password never reaches their screen. Password Safe runs on the BeyondInsight platform — more on that in section ③.

Pain 2 and 3: remote access — two products, one bloodline. PRA walks vendors and admins to privileged infrastructure: it is the escorted-plumber model. A VPN hands the plumber a duplicate key to your whole house; PRA walks him to the one leaking bathroom, on CCTV, and out — per-system sessions, every client dialing outbound on TCP 443, no inbound firewall holes, everything recorded. Remote Support is the same Bomgar lineage pointed at a different audience: helpdesk technicians supporting employees’ machines, licensed by concurrent technicians (PRA is typically named-user). Same appliance family, different job — confusing them is a classic interview trap.

Pain 4: local admin everywhere → EPM. The wedding-hall rule: the guest stays a normal guest, but one task gets a temporary VIP band. EPM removes admin rights from users and instead elevates individual applications by policy — the user account never becomes administrator. Pain 5: Linux chaos → PMUL + AD Bridge. pbrun is like a gram-panchayat approval system: the request goes to pbmasterd (the sarpanch with the central rulebook), which stamps ACCEPT or REJECT, pblocald does the work and pblogd writes every keystroke in the register. Unlike sudo, the decision is made centrally, not from a local file an admin can edit. AD Bridge is Aadhaar for Linux: one central AD identity accepted by every server, instead of a separate local account per box.

# run a privileged task — pbmasterd decides centrally per /etc/pb.conf policy
pbrun id

# request execution on a remote run host
pbrun -h db-prod-01 uname -a

$ pbrun id
uid=0(root) gid=0(root) groups=0(root)
$ pbrun -h db-prod-01 uname -a
Linux db-prod-01 5.14.0-427.el9.x86_64 #1 SMP x86_64 GNU/Linux

③ The platform layer — BeyondInsight, Insights, Entitle, Pathfinder One

Above the five products sits a layer most beginners never get straight. Start with BeyondInsight: it is the management platform and web console that Password Safe runs on — one login, two layers. BeyondInsight owns the plumbing every vault needs: the Assets grid, Discovery scans that walk your IP ranges like a census enumerator, Smart Rules that auto-onboard what discovery finds, and Analytics & Reporting. Password Safe adds the vault verbs on top: requests, approvals, sessions, rotation. When a candidate says "BeyondInsight and Password Safe are two separate consoles", the interview is usually over.

Now the deployment shapes — the question every architect round asks. On-prem, BeyondInsight/Password Safe ships as a U-Series appliance (hardened Windows-based, deployable as an HA pair with heartbeat failover) or a software install on your own servers. Remote Support and PRA ship on the B-Series appliance (physical or virtual, usually parked in the DMZ). And everything has a SaaS shape: Password Safe Cloud lives at <yoursite>.ps.beyondtrustcloud.com and reaches back into your network through Resource Brokers — worker VMs that dial outbound on 443 only, like a Delhivery hub inside your society: the warehouse never enters the gate; the hub dials out to fetch jobs.

Two newer pieces complete the layer. Identity Security Insights is the cloud ITDR product: its True Privilege Graph ingests AD, Entra ID, Okta, AWS, GCP, even GitHub, and maps Paths to Privilege — every back-lane of group nesting and role chaining an attacker could walk from a helpdesk account to domain admin, like a Google Maps route view for privilege escalation. Entitle (acquired April 2024) brings JIT cloud entitlements with IGA and CIEM: think Tatkal ticket versus lifetime first-class pass — AWS/Azure roles granted for today’s journey, then gone. And Pathfinder One (launched February 2025) is the umbrella platform pulling all of it together — a direction, not an installer. Its most visible side effect: the docs renamed Jump terminology (Jumpoint→Gateway, Jump Item→Asset) — lesson ⑤ onwards teaches both.

POST /BeyondTrust/api/public/v3/Auth/SignAppIn HTTP/1.1
Host: beyondinsight.suryabank.in
Authorization: PS-Auth key=<128-char-api-key>; runas=suryabank\svc-api-read;

GET /BeyondTrust/api/public/v3/ManagedAccounts HTTP/1.1
Host: beyondinsight.suryabank.in

HTTP/1.1 200 OK
[
  {"AccountName":"administrator","SystemName":"DC-MUM-01","DomainName":"suryabank.in"},
  {"AccountName":"root","SystemName":"swift-app-03"}
]

Note two real-world catches in that API call: session state is kept between calls (sign in once, then work), and GET ManagedAccounts only returns accounts that have Enable for API Access set and that the runas user holds a Requestor/ISA role on — an empty list usually means a permissions gap, not an empty vault.

④ How they combine — one Indian bank, full stack

Now assemble everything inside one estate. Meet SuryaBank — a mid-size private bank headquartered in Mumbai: two data centres, about 400 Windows servers (10.20.0.0/16), 220 RHEL servers running core-banking and SWIFT middleware (10.30.0.0/16), 10,000 branch laptops (192.168.x.x per branch), and 35 OEM vendors — the ATM-switch vendor, the CBS vendor, the HSM vendor — who all used to come in over VPN. RBI’s cyber-security framework expects privileged access to be controlled, recorded and reviewable. Here is the reference deployment.

Who logs into what console? Aditya and the DC admins use the Password Safe portal on BeyondInsight to request, get approved, and land in proxied sessions. Priya’s vendor-management team administers PRA’s /login console — Gateways (Jumpoints), Asset Groups, approval policies — while vendors themselves only ever see the access console. Karthik’s desktop team lives in the PM Cloud (EPM) console shipping Workstyle policies to 10,000 laptops. Meera’s Unix team maintains the PMUL policy on the policy server (pb.conf on pbmaster01) and joins new servers to AD with domainjoin-cli. The SOC gets Identity Security Insights dashboards. Five teams, five consoles, one badge.

sudo /opt/pbis/bin/domainjoin-cli join suryabank.in pam-join@suryabank.in

# verify the join (reboot once before first AD logon)
/opt/pbis/bin/domainjoin-cli query

Password:
SUCCESS

Name = lnx-swift-03
Domain = SURYABANK.IN
Distinguished Name = CN=LNX-SWIFT-03,OU=Linux,DC=suryabank,DC=in

Licensing shape at a glance. Password Safe’s most-quoted commercial edge is asset-based licensing: pay per managed asset, with unlimited users — the unlimited-thali model, versus CyberArk’s per-plate (per-user) billing. PRA is sold per named user (a per-asset SKU also exists), Remote Support by concurrent technicians, and EPM/PMUL typically per endpoint/host. For your CV: BeyondTrust was a Leader in the 2025 Gartner Magic Quadrant for PAM with the highest Ability to Execute — and Indian JDs (Wipro, UST and friends) routinely ask for two PAM tools, so the concepts you learn here transfer straight onto CyberArk vocabulary.