• May 20 2026

CyberArk Secure Infrastructure Access (SIA) vs Privileged Session Manager (PSM): Complete 2026 Guide

Modern enterprises are rapidly shifting toward hybrid and cloud-first infrastructure. With this shift, traditional VPN-based privileged access methods are no longer enough to secure distributed environments. CyberArk has introduced multiple access solutions under its Identity Security platform to address this challenge—most notably:

• CyberArk Secure Infrastructure Access (SIA)

• CyberArk Privileged Session Manager (PSM)

Both SIA and PSM are designed to secure privileged access, but they serve different architectural purposes. In this article, we will first deeply understand SIA, then explore PSM, and finally compare both to help architects, engineers, and cybersecurity professionals choose the right solution.

---

What is CyberArk Secure Infrastructure Access (SIA)?

Secure Infrastructure Access (SIA) is a cloud-native, VPN-less privileged access solution that enables secure access to infrastructure such as:

• Windows servers

• Linux servers

• Databases

• Kubernetes clusters

• Cloud workloads

SIA is part of CyberArk’s broader Identity Security SaaS ecosystem and integrates with platforms like CyberArk Privilege Cloud and CyberArk PAM - Self-Hosted.

---

Key Concept: Zero VPN, Vaulted Credentials Access

SIA eliminates the need for traditional VPNs. Instead, it uses:

• Secure connectors deployed inside customer networks

• Cloud-hosted SIA service

• TLS 1.2 encrypted communication

• Session isolation and monitoring

Users connect directly to targets through a secure gateway while credentials remain vaulted in CyberArk.

---

Core Architecture of SIA

SIA architecture includes:

1. Connector Host

A lightweight machine installed inside the customer network.

Responsibilities:

• Connects to SIA cloud service

• Establishes outbound TLS connections (port 443)

• Bridges communication with internal targets

---

2. Client Machine

The end-user device used to initiate sessions.

• Connects to *.ssh.cyberark.cloud

• Uses SSH/RDP/DB protocols

• No VPN required

---

3. Target Machines

These are the systems being accessed:

• Linux → SSH (Port 22)

• Windows → RDP (Ports 135, 445, 3389)

• Databases → native DB ports (e.g., 3306, 5432, 1433)

---

4. HTTPS Relay (Optional)

Used for additional routing scenarios and hybrid environments.

---

Network Requirements Overview

SIA requires strict network configuration:

Outbound from Connector

• Port 443 → SIA cloud

Inbound to Targets

• Linux → 22

• Windows → 3389, 445, 135

• Kerberos → 88 (if enabled)

• WinRM → 5985/5986

Database Ports

• MySQL / MariaDB → 3306

• PostgreSQL → 5432

• SQL Server → 1433

• Oracle → 2484

• MongoDB → 27017

---

SIA Use Cases

SIA is designed for modern infrastructure access:

1. Cloud VM Access

Access AWS, Azure, or GCP VMs without VPN.

2. Hybrid Infrastructure

Works across on-prem + cloud environments.

3. Database Access

Secure access to enterprise databases using vaulted credentials.

4. Kubernetes Access

Secure kubectl or cluster-level administrative access.

---

Zero Standing Privileges (ZSP) Support

SIA enables Just-In-Time (JIT) access:

• No permanent credentials on endpoints

• Temporary session-based authentication

• Automatic credential retrieval from vault

If dual control or ticketing is enabled in CyberArk Privilege Cloud:

• Session may be blocked until approval

• Access reason is logged automatically

---

SIA Key Features

1. VPN-less Access

No need for network tunneling.

2. Built-in High Availability

Multiple connectors provide redundancy.

3. Automatic Scaling

SaaS-managed infrastructure.

4. Session Isolation

User never directly touches credentials.

5. Minimal Infrastructure Footprint

Lightweight connector installation.

---

Installing SIA Connectors

SIA installation is simple:

1. Go to Connector Management

2. Define:

   • Networks

   • Connector pools

3. Deploy connector script on Linux/Windows host

4. Validate connectivity

Important notes:

• Script expires in 15 minutes

• Requires TLS 1.2

• Requires outbound HTTPS (443)

---

SIA vs Traditional Access Model

Feature	Traditional VPN	SIA
Network Access	Full network	Target-level access
Security Model	Perimeter-based	Zero Trust
Credential Exposure	Possible	Fully vaulted
Session Monitoring	Limited	Built-in
Deployment	Heavy	Lightweight

---

What is CyberArk Privileged Session Manager (PSM)?

CyberArk Privileged Session Manager (PSM) is a core component of CyberArk’s PAM architecture used to:

• Initiate privileged sessions

• Record sessions (video + keystroke logs)

• Control and isolate user activity

• Provide audit and compliance visibility

PSM is widely used in traditional PAM deployments such as CyberArk PAM - Self-Hosted.

---

How PSM Works

PSM acts as a bastion host (jump server):

1. User connects to PSM via PVWA

2. PSM retrieves credentials from Vault

3. PSM launches session to target system

4. Session is recorded and monitored

5. Credentials are never exposed to user

---

PSM Key Capabilities

1. Session Recording

• Full video recording of user activity

• Text logging of commands

2. Protocol Support

• RDP (Windows)

• SSH (Linux/Unix)

• Web applications

• Databases

• VMware tools

3. Privileged Isolation

Users never access credentials directly.

4. Compliance Monitoring

Supports audit and regulatory requirements.

---

PSM Architecture Components

1. PSM Server

Windows-based session broker.

2. Vault Integration

Stores credentials securely.

3. PVWA Interface

User entry point for access requests.

---

System Requirements (PSM)

• Windows Server 2019 / 2022

• .NET Framework 4.8

• RDS Session Host role

• 8 CPU cores minimum

• 8 GB RAM minimum

---

PSM Session Flow

1. User logs into PVWA

2. Selects target system

3. PSM launches session

4. Vault credentials injected

5. Session recorded in Vault storage

---

SIA vs PSM: Key Differences

Now that we understand both, let’s compare them directly.

1. Architecture

Factor	SIA	PSM
Model	Cloud-native SaaS	On-prem / hybrid
Connection	Connector-based	Jump server
VPN Required	❌ No	❌ No (but network needed)

---

2. Deployment Model

• SIA → Lightweight connector, SaaS-managed

• PSM → Dedicated Windows servers required

---

3. Session Handling

Feature	SIA	PSM
Session Isolation	Yes	Yes
Session Recording	Limited (cloud-based)	Full DVR-style recording
Real-time Monitoring	Yes	Yes

---

4. Use Case Coverage

Use Case	SIA	PSM
Linux servers	✔	✔
Windows servers	✔	✔
Databases	✔	✔
VMware / ESX	Limited	✔
Legacy apps	Limited	✔

---

5. Security Model

Both follow Zero Trust principles but differ in execution:

• SIA → Connector-based trust model

• PSM → Session broker with credential injection

---

6. Scalability

Aspect	SIA	PSM
Scaling	Automatic	Manual (server-based)
Maintenance	Low	High

---

7. Operations Complexity

• SIA → Minimal operational overhead

• PSM → Requires patching, upgrades, RDS management

---

Can SIA and PSM Co-exist?

Yes — and in most enterprises, they must co-exist.

CyberArk recommends hybrid deployment:

SIA handles:

• Cloud VMs

• Linux servers

• Databases

• Kubernetes

PSM handles:

• VMware

• ESX / vCenter

• Legacy desktop tools

• Fat client applications

---

Example Enterprise Architecture

A typical 350-user organization:

• SIA connectors → Linux + Windows + DB access

• PSM servers → VMware + legacy apps

• SWS → Web applications

• SCA → Cloud consoles

---

Network Security Differences

SIA Network Model

• Outbound only (port 443)

• No inbound exposure required

• TLS 1.2 enforced

PSM Network Model

• Requires inbound RDP/SSH connectivity

• Requires RDS configuration

• Internal jump server exposure

---

Advantages of SIA over PSM

• No jump servers required

• Faster deployment

• Cloud-managed updates

• Better for hybrid/cloud environments

• Lower infrastructure cost

---

Advantages of PSM over SIA

• Full session recording fidelity

• Broad protocol support

• Mature enterprise adoption

• Deep integration with vault workflows

---

When to Use SIA

Use SIA when:

• You are cloud-first or hybrid

• You want zero VPN access

• You want lightweight infrastructure

• You manage cloud VMs and databases

---

When to Use PSM

Use PSM when:

• You need full session recording

• You work with legacy applications

• You require VMware or ESX access

• You need strict compliance auditing

---

CyberArk Ecosystem Integration

SIA and PSM integrate with:

• Vault / Privilege Cloud

• PAM Self-Hosted

• Identity Security SSO

• Endpoint Privilege Security

• Secrets Management

---

Learning Resources (CyberArk Architecture)

To deepen your understanding:

• CyberArk PSM for SSH Installation Guide
• CyberArk Primary-DR Architecture Guide
• CyberArk Beginner to Advanced Tutorial
• CyberArk Vault Architecture Explained
• PSM Session Management Guide

---

Final Thoughts

CyberArk’s Secure Infrastructure Access (SIA) and Privileged Session Manager (PSM) are not competing technologies—they are complementary access layers in a modern Identity Security architecture.

• SIA represents the future of cloud-native privileged access

• PSM represents the mature, compliance-heavy session control model

Together, they form a powerful hybrid access strategy for enterprises moving toward Zero Trust.

---

🚀Learn CyberArk Professionally

If you want to master CyberArk from installation to advanced architecture:

👉 Enroll in CyberArk Privilege Cloud Training – SecApps Learning