Not yet. CyberArk has not publicly announced post-quantum cryptography support for its Privileged Access Management (PAM) platform. The vault, session management, and credential rotation all use classical cryptography.
Key Takeaway: CyberArk is NOT quantum safe. Scan your CyberArk infrastructure with QScout immediately — PAM is the #1 PQC migration priority. Audit vault communication channels, PSM configurations, and all credential retrieval APIs. Monitor CyberArk security advisories for PQC announcements.
CyberArk is NOT quantum safe today, and PAM systems are among the highest-value quantum attack targets. **Current State:** CyberArk's Digital Vault uses classical cryptography: - **Vault encryption**: AES-256 for data at rest (quantum-resistant), but vault-to-component TLS uses classical key exchange. - **PSM (Privileged Session Manager)**: Uses classical TLS for session recording and proxying. - **CCP/Conjur**: Credential retrieval APIs use classical TLS. - **SSH key management**: Manages classical RSA/ECDSA SSH keys. **PQC Priority:** PAM systems are the highest-value target in any enterprise: - **Credential vault**: Contains passwords, SSH keys, API keys, and certificates for the most privileged accounts. - **Domain admin credentials**: Breaking vault encryption exposes domain administrator access. - **Infrastructure root access**: Cloud provider root/IAM keys stored in CyberArk. **HNDL Risk:** CyberArk vault communications intercepted today could reveal the most privileged credentials in the enterprise if quantum-decrypted. This is arguably the single highest-impact HNDL target in any organization. **What Organizations Should Do:** Classify CyberArk as the #1 priority for PQC migration. Audit all vault connections, PSM sessions, and CCP/Conjur API calls. Use QScout to discover all privileged access cryptographic dependencies.
| Full Name | CyberArk Privileged Access Management |
| Category | identity |
| Quantum Vulnerability | CyberArk vault TLS and SSH key management use classical algorithms vulnerable to quantum attack. PAM systems contain the most privileged credentials in the enterprise — the highest-value HNDL target. |
| NIST Status | CyberArk has not publicly announced alignment with NIST PQC standards. |
| Deprecation Timeline | CyberArk has not published PQC migration timelines. PAM should be prioritized ahead of NIST deadlines due to the extreme sensitivity of stored credentials. |
| Replaced By | CyberArk vault communications and SSH key management will need to migrate to ML-KEM and ML-DSA |
Scan your CyberArk infrastructure with QScout immediately — PAM is the #1 PQC migration priority. Audit vault communication channels, PSM configurations, and all credential retrieval APIs. Monitor CyberArk security advisories for PQC announcements.
QScout discovers every instance of CyberArk across your infrastructure in 7 days — with zero operational disruption. 72-hour time to first findings.