CyberArk Privilege Cloud, Identity Security Platform & Going Live — The Capstone

The interview question that trips up 70% of candidates

Final-round interview: "In CyberArk Privilege Cloud, what does CyberArk run and what do you run?"
Wrong answers: "CyberArk runs everything", "You install the Vault on AWS yourself". Right answer: CyberArk hosts the Digital Vault, the PVWA web portal, the backend, the encryption keys, the upgrades and the HA/DR on AWS across three availability zones. You run only one thing on-premises: the Connector — a server bundle holding CPM and PSM that reaches your target systems and talks outbound to CyberArk over TCP 443. Knowing that exact line lets you scope a migration, design firewall rules, and explain a 99.95% SLA to a nervous CISO who thinks SaaS means "we lost control".

💡 The piped city gas analogy

Self-hosted PAM is the LPG cylinder in your kitchen. You own it, you check the pressure, you call the dealer when it runs out, and if the regulator leaks at 2am, that is your problem. Privilege Cloud is piped city gas. The supply company (CyberArk) owns the plant, the pipeline and the pressure. You manage only the burner and the pipe inside your home — the Connector running CPM and PSM. No more midnight Vault patching. But you also cannot install a custom valve the company has not certified, and if the pipeline goes down, you depend on them to bring it back. That trade — less daily hassle for less raw control — is the whole story of this blog.

4 things you'll be tested on before we begin

① Privilege Cloud vs Self-Hosted — the responsibility split

In self-hosted PAM you own everything: the Vault servers, the SAN, the cluster, the patching, the DR replication. In Privilege Cloud, CyberArk hosts the Vault, the PVWA portal (at <org>.privilegecloud.cyberark.cloud), the backend on AWS across 3 AZs, the per-customer encryption keys, the upgrades and the HA/DR. You keep only the Connector — and your target-side firewall rules, your network, and your break-glass offline copies.

② The Identity Security Platform — one admin plane

Privilege Cloud does not live alone. It sits inside the Identity Security Platform Shared Services (ISPSS) — a single SaaS layer that gives you unified Identity Administration, SSO/MFA via CyberArk Identity, centralized Audit, Identity Security Intelligence (UBA feed to your SIEM), and Secure Cloud Access. One admin console fronts Privilege Cloud, EPM, Conjur/Secrets Manager and CyberArk Identity together — so you stop logging into five disconnected portals.

SRS — the rotation engine that replaces CPM

In self-hosted PAM, the CPM rotates passwords. It is active-passive and you cannot load-balance it — two CPMs hitting the same account rotate to two different values and the account becomes inaccessible. In Privilege Cloud the default engine is SRS: accounts bind to an SRS connector pool (not a single server), giving active-active HA for rotation with distributed locking, and centralized logging in the CyberArk dashboard instead of scattered per-server log files. Both can coexist during migration.

$pvwa = "https://neofinancebank.privilegecloud.cyberark.cloud/PasswordVault"
$body = @{ username = "svc_api_admin"
           password = (Read-Host -AsSecureString "PAM API pwd" |
                       ConvertFrom-SecureString -AsPlainText) } | ConvertTo-Json

$token = Invoke-RestMethod -Uri "$pvwa/API/auth/Cyberark/Logon" `
           -Method POST -Body $body -ContentType "application/json"
$hdr = @{ Authorization = $token }
Write-Output "Authenticated. Token: $($token.Substring(0,20))..."

Authenticated. Token: eyJhbGciOiJSUzI1NiIs...
PS C:\> $hdr.Authorization.Length
612

③ The go-live playbook — discover, onboard, isolate, detect, optimize

A CyberArk go-live is not "install and switch on". The proven sequence is discover → onboard → isolate → detect → optimize, mapped to CyberArk's own Rapid Risk Reduction order: secure IT-admin credentials first, then stop credential theft (EPM), then protect DevOps secrets (Conjur), then detect threats (PTA). Discovery uses the accounts feed to populate the Pending Accounts list; onboarding rules auto-vault what matches and leave the rest for manual review.

$pvwa = "https://neofinancebank.privilegecloud.cyberark.cloud/PasswordVault"
$acct = @{
  name       = "prod-db01-sa_svc_oracle"
  address    = "10.10.5.25"
  userName   = "sa_svc_oracle"
  platformId = "OracleDatabase"
  safeName   = "PROD-DB-ServiceAccounts"
  secret     = (Read-Host -AsSecureString "Current pwd" |
                ConvertFrom-SecureString -AsPlainText)
  platformAccountProperties = @{ Port = "1521"; Database = "PRODDB" }
} | ConvertTo-Json

$r = Invoke-RestMethod -Uri "$pvwa/API/Accounts" -Method POST `
       -Headers $hdr -Body $acct -ContentType "application/json"
Write-Output "Account onboarded. ID: $($r.id)"

Account onboarded. ID: 453_6
Dependencies found: 3 Scheduled Tasks, 2 IIS App Pools
Rotation held: ChangeNotificationOnlyOnExpiry=Yes (30-day window)

HA, DR and the SLA you can promise

Privilege Cloud carries a 99.95% availability SLA. Within a region, HA spans 3 AWS availability zones, so most failovers are near-zero to ~20 minutes RTO. Cross-Region DR (CRDR) is an add-on license; without it, a full DR backup-restore has a 4–24 hour RTO. In self-hosted, you carry all of this yourself: a two-node Vault cluster on shared SAN (SCSI-3 Persistent Reservations), a Cluster Vault Manager watching health, a virtual IP for failover, and a quorum disk to stop split-brain.

The certification ladder — and the interview round each one is

CyberArk's ladder is three public rungs plus a partner track. Defender (PAM-DEF) tests daily operations and Vault admin. Sentry (PAM-SEN) tests deployment, install, advanced config and troubleshooting. Guardian tests strategic, multi-solution architecture. CDE (Certified Delivery Engineer) is partner-only for implementation consultants. All public exams run via Pearson VUE, roughly $200, 90 minutes, multiple-choice plus scenarios.

④ The capstone — replay a breach, break each stage with CyberArk

Here is the whole series tied into one scenario. This kill chain is the canonical 2022 privileged-credential breach pattern: an attacker phishes an IT admin, drops on the endpoint as local admin, dumps cached credentials, finds hardcoded PAM admin creds in a script, moves laterally, forges a golden ticket, and reaches domain dominance. For each stage, one specific CyberArk control breaks the chain.

The classic go-live pitfalls — and the one-line fix for each

One last security note — patch the CVEs

Even SaaS-adjacent components need patch hygiene. CVE-2024-54840 (CVSS 4.2) is a PVWA Host-header injection enabling open-redirect/phishing in PAM Self-Hosted before 14.4 — upgrade to 14.4+. The July 2025 Conjur/Secrets Manager set is more serious: CVE-2025-49827 and CVE-2025-49831 (both CVSS 9.1) are IAM authenticator bypasses, CVE-2025-49828 (CVSS 8.6) is an RCE, and CVE-2025-49830 (CVSS 7.1) is a path traversal. Patches are on the CyberArk Marketplace — apply within your KEV-aligned window.