Thycotic Secret Server

Short Summary

Digital transformation is reshaping how IT is delivered and governed: organizations must become more agile and innovative while simultaneously coping with increasing regulation, continuously improving security, and maintaining strong customer service. Smart manufacturing and the Internet of Things further expand organizational attack surfaces, making stronger, more adaptive controls necessary. Privilege Management is positioned as a central countermeasure because attackers frequently target privileged accounts—accounts with elevated rights that provide broad access to sensitive assets such as HR data, financial information, payroll details, and intellectual property. Shared accounts are highlighted as especially risky due to shared credentials.

Privilege Management spans capabilities from shared account password management and session management to Privileged Behavior Analytics. It supports both cybersecurity goals (protecting high-value access paths and detecting anomalous privileged activity) and IAM goals (managing identities, credentials, and runtime access through controls like session monitoring). It is also framed as valuable against long-running, initially undetected attacks often mislabeled as “zero-day,” where signature-based anti-malware is ineffective and anomaly detection becomes important.

Thycotic, founded in 2000 and based in Washington, DC, offers a full-featured Privilege Management platform centered on Secret Server, available on-premises on the Microsoft stack or as SaaS on Microsoft Azure. The product uses AES-256 encryption for secure storage, stores passwords in Microsoft SQL Server (which can be mirrored), and encrypts communications. It provides browser-based administration, mobile access, extensive REST APIs, role-based security, 2FA, approval workflows, SIEM integration, and real-time alerting. It supports many target systems (RDP/SSH, Cisco, Unix/Linux, Windows, VMware ESX, databases, IBM mainframes) and delivers core functions including discovery, rotation, SSO for privileged sessions, monitoring, recording, and auditing with compliance-oriented reporting. Strengths emphasize breadth of support, rapid deployment, usability, APIs, and auditing; challenges include Microsoft-stack dependency, add-on features, and a limited partner ecosystem.

Interesting Facts

• Privilege Management includes technologies for shared account password management, session management, and privileged behavior analytics.
• Privileged accounts provide broad access to sensitive assets such as HR records, financial information, payroll details, and company intellectual property.
• Thycotic is a Washington, DC–based software vendor incorporated in May 2000.
• Thycotic is privately held and has been funded by Insight Venture Partners.
• Thycotic Secret Server is offered as on-premises software leveraging the Microsoft stack and as SaaS delivered from Microsoft Azure.
• Secret Server stores information using AES-256 encryption.
• Passwords are stored in a Microsoft SQL Server database that can be mirrored.
• Secret Server administration is browser-based and includes mobile interfaces.
• The product supports target systems including RDP, SSH, PuTTY, Cisco environments, Unix/Linux, Windows Server, VMware ESX, databases, and IBM mainframes.
• A free 25-user edition of Secret Server exists and is limited to basic password vault and management features.

Notable Quotes

• “Organizations need to reinvent themselves and become agile and more innovative, while meeting ever increasing regulation all in addition to constantly improving security.”
• “Smart manufacturing and the internet of things massively expand the attack surface of organizations.”
• “Privilege Management plays a central role.”
• “Privilege Management describes the domain of technologies that help better manage and control so-called ‘privileged accounts’.”
• “Attackers usually go after the high privilege accounts.”
• “Traditional technologies such as signature-based Anti-Malware don’t help in these scenarios.”
• “New Cybersecurity tools looking for anomalies and outliers can help identify such long-running attacks.”
• “Privilege Management thus is an essential element of both Cybersecurity and IAM infrastructures of organizations.”
• “Thycotic is shedding the ‘underdog’ label and becoming a globally distributed, enterprise ready solution.”
• “Despite the need for various Microsoft infrastructure components, Thycotic Secret Server counts amongst the tools in the market segment that are easiest to deploy.”