Warpgate vs CyberArk

Warpgate is a self-hosted bastion and privileged access gateway that proxies SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC connections to internal targets. Users connect with their normal clients or through a browser-based terminal and desktop client, so no agent or SSH wrapper is installed on the client side. It ships as a single binary or a Docker image, keeps state in a database, and provides an admin web UI for managing targets, users, roles and session replay. RDP and VNC target support arrived in v0.27.0, published on 1 August 2026.

Pros

• Apache-2.0 licensed with no paid tier; the GitHub repository records 7,446 stars, 323 forks and releases through v0.27.2 on 3 August 2026, which indicates ongoing maintenance
• No client-side software is required: an independent setup guide states it forwards connections straight to the target rather than acting as a jump host
• One gateway covers interactive shells, Kubernetes, databases and, since v0.27.0, recorded RDP and VNC desktop sessions
• Deploys as a single binary or Docker image, with clustering and S3 recording storage documented for multi-node setups

Things to check

Pricing:

CyberArk is widely regarded as a leader in privileged access management (PAM), providing comprehensive identity security solutions for protecting privileged credentials, controlling access to critical infrastructure, and meeting compliance requirements. Its platform includes privileged session management, credential vaulting, and just-in-time access across on-premises and cloud environments.

Pros

• Strong PAM solution
• Comprehensive privilege management
• Strong compliance and audit capabilities
• Deep enterprise integration ecosystem
• Proven in highly regulated industries

Things to check

• Complex deployment and configuration
• Expensive licensing model
• Steep learning curve for administrators
• Legacy architecture in some components
• Long implementation timelines

Pricing: See the vendor site for current pricing.