Apex Privilege Consulting engineers high-availability IDIRA (previously CyberArk) Self-Hosted PAS data center vaults (sized to official v15.2 specifications), multi-cloud Privilege Cloud SaaS tenants, and minimal-downtime version upgrades (v10.x / v11.x / v12.x / v14.x → Latest LTS) for regulated banking, enterprise data centers, and hybrid estates.
Production-grade architecture, official v15.2 deployment specifications, and lifecycle modernization for customer-managed data center vaults and cloud-native SaaS tenants.
Full-lifecycle architecture and hardening of customer-hosted IDIRA (previously CyberArk) Privileged Access Security (PAS) environments—covering Digital Vault, CPM, PVWA, PSM, PSMP, HTML5 Gateway, and PTA across regulated enterprise data centers, core banking, and high-availability infrastructure.
Turnkey tenant architecture and deployment of IDIRA (previously CyberArk) Privilege Cloud on the Identity Security Platform Shared Services (ISPSS), combined with Secure Cloud Access (SCA) JIT elevation and Dynamic Secrets Hub across AWS, Azure, and GCP.
c6i.2xlarge (80 GB) / Azure Standard_F16s_v2 or D8s_v5. 6–30 sessions: c6i.4xlarge / F16s_v2 or D16s_v5. 31–60 sessions: c6i.8xlarge / F32s_v2 or D32s_v5.
Seamlessly unify customer-managed On-Premises PAS vaults with IDIRA (previously CyberArk) Privilege Cloud or execute a phased, minimal-downtime migration of safes, policies, platforms, and credentials using automated REST API migration factories.
Eliminate local administrator rights across Windows, macOS, and Linux endpoints with IDIRA (previously CyberArk) EPM while deploying Privileged Threat Analytics (PTA) and Identity Threat Detection & Response (ITDR) to block credential theft and Golden Ticket attacks.
Running an aging, unstable, or End-of-Support IDIRA (previously CyberArk) installation? Our Principal Architects specialize in upgrading existing PAM solutions with minimal downtime—executing multi-hop version upgrades (v10.x / v11.x / v12.x / v14.x → Latest LTS), side-by-side Windows Server 2012/2016 → 2022/2025 and Linux (RHEL 7 / CentOS 7 → RHEL 8 / RHEL 9 / Rocky Linux) OS migrations for PTA (Privileged Threat Analytics) & PSM for SSH (PSMP), broken CPM/PSM connector remediation, and physical/virtual hardware vault refreshes.
Compare topology models and inspect verified IDIRA (previously CyberArk) v15.2 hardware, CPU core, RAM, storage, network port, HA/DR, and HSM cryptographic specifications across Small, Mid-Range, and Large / Very Large implementation tiers.
Engineered for organizations requiring complete physical and logical control over their cryptographic keys, hardware security modules (HSM), and session recordings—ideal for regulated banking cores, defense networks, and high-availability enterprise data centers.
| IDIRA (previously CyberArk) Component | Small Implementation | Mid-Range / Medium Implementation | Large & Very Large Implementation | OS, Storage & Engineering Notes |
|---|---|---|---|---|
|
Digital Vault Server Standalone & Cluster (Physical Rec.) |
< 20,000 passwords: 8–12 physical cores (x86-64) 32–64 GB RAM 2 × 80 GB SSD (OS+App / Data) |
20,000–100,000 passwords: 24–48 physical cores (x86-64) 64–128 GB RAM 1 × 80 GB + 2 × 512 GB SSD |
> 100,000 passwords: 60+ physical cores (x86-64) 256+ GB RAM 1 × 80 GB + 2 × 512 GB NVMe SSD |
RAID 10 SAS hot-swappable, 1 Gb NIC, 1 USB port, SCSI-3 shared disk for Cluster Vaults. In-place upgrades on v12.6 hardware remain supported. |
|
PVWA & CPM Servers Web Portal & Password Manager |
< 1,000 passwords: Quad-core (4 cores) 8 GB RAM 2 × 80 GB SATA/SAS |
1,000–20,000 passwords: 2× Quad-core (8 cores) 16 GB RAM 2 × 80 GB SATA/SAS |
Large (20K–100K): 16 cores / 32 GB RAM / 2×80 GB SAS Very Large (>100K): 32 cores (4×8c) / 64 GB RAM / 2×80 GB SAS |
Windows Server 2019 / 2022 / 2025, .NET Framework 4.8, IIS 10.0 / 8.5, RAID Controller, 1 Gb NIC. |
|
PSM Server Privileged Session Manager |
1–10 RDP/SSH sessions: (Max 15 Chrome / 15 Edge) 8 cores, 8 GB RAM 2 × 80 GB SATA/SAS |
11–50 RDP/SSH sessions: (Max 50 Chrome / 45 Edge) 16 cores, 16 GB RAM 2 × 80 GB SATA/SAS |
51–100 RDP/SSH sessions: (Max 100 Chrome / 100 Edge) 32 cores (2.1–2.6 GHz), 32 GB RAM 2 × 250 GB SAS (15K RPM) |
Max 100 concurrent sessions/server. VM concurrency is up to 40% lower. Requires per-device RDS CALs (or domain PSMConnect users for per-user CALs). |
|
Linux Appliances: PSMP, HTML5 GW & PTA RHEL 8 / RHEL 9 / Rocky Linux |
PSMP Small: 4 cores / 8 GB / 2×80 GB HTML5 (1–50 sess): 2 cores / 4 GB RAM |
PSMP Mid: 8 cores / 16 GB / 2×80 GB HTML5 (51–100 sess): 4 cores / 8 GB RAM |
PSMP Large: 16 cores / 32 GB / 2×80 GB SAS HTML5 (101–200 sess): 8 cores / 16 GB RAM |
PTA Server: 8 Core-CPU, 16 GB RAM, 500 GB storage (CIS layout: min 200 GB /var, 100 GB /var/log, VMXNET3 NIC).
|
|
Privilege Cloud Connector Cloud PAM & Hybrid Connector |
Small (1–10 sessions): 8 cores, 8 GB RAM, 80 GB disk Cloud VM (1–5 sess): AWS c6i.2xlarge (80 GB) / Azure Standard_F16s_v2 or D8s_v5
|
Mid-Range (11–50 sessions): 16 cores, 16 GB RAM, 80 GB disk Cloud VM (6–30 sess): AWS c6i.4xlarge (80 GB) / Azure Standard_F16s_v2 or D16s_v5
|
Large (51–100 sessions): 32 cores (2.1–2.6 GHz), 32 GB RAM, 250 GB disk Cloud VM (31–60 sess): AWS c6i.8xlarge (80 GB) / Azure Standard_F32s_v2 or D32s_v5
|
Windows Server 2022/2025 (English OS required for Secure Tunnel), .NET 4.8, NLA disabled, IPv4 only, outbound TCP 443 to ISPSS, TCP 3389/22 to targets. |
Select your current IDIRA (previously CyberArk) operational challenge to inspect our component compatibility matrix and 3-step minimal-downtime execution blueprint.
Eliminate End-of-Support security risks and unlock modern REST APIs, HTML5 PSM gateways, and OIDC/SAML authentication by executing a validated upgrade path from v10.x / v11.x / v12.x / v14.x utilizing DR Vault swing servers for minimal downtime.
Certified delivery across the complete IDIRA (previously CyberArk) ecosystem, enterprise directories, cloud control planes, and SIEM/SOAR platforms.
Benchmark your On-Premises, Cloud, or Hybrid PAM posture across 6 core controls—including version currency—and export your diagnostic directly to an Apex Privilege Principal Architect.
Every On-Premises PAS deployment, Privilege Cloud onboarding, and multi-hop version upgrade follows our battle-tested four-phase engineering lifecycle.
Automated discovery of privileged accounts across Active Directory, mainframes, databases, and cloud IAM, plus comprehensive health and version audits of existing IDIRA (previously CyberArk) vaults.
Low-level deployment specifications aligned to official v15.2 sizing—covering physical/VM Vault cores, Windows Server 2019/2022/2025 & RHEL 8/9 CIS baselines, TCP 1858 / TLS 443 zoning, PKCS#11 HSM / Cloud CMK keys, and HA/DR failover.
Minimal-downtime deployment of Self-Hosted PAS clusters, Privilege Cloud connectors, or side-by-side swing-vault version upgrades using automated safe onboarding and pre-validated rollback plans.
Continuous CPM rotation tuning, custom PSM universal connectors, SIEM/SOAR integration, operational runbook transfer, and ongoing health monitoring.
Apex Privilege Consulting was founded by senior IDIRA (previously CyberArk) architects to solve the hardest challenges in enterprise identity security: hardening mission-critical On-Premises Self-Hosted PAS vaults, scaling Privilege Cloud SaaS architectures, and rescuing aging PAM deployments with minimal downtime.
Connect directly with a Principal PAM Architect at advisory@apexprivilege.co.za or submit your technical scope below.
Thank you, . An Apex Privilege Consulting Principal Architect has been assigned to review your scope and will respond within 4 business hours.