CyberArk User Access Review Compliance
LeaderCyberArk is the global leader in identity security.
Est 1999|Valuation $20.6B|Raised $1.5B
CyberArk is the global leader in identity security.
Published May 16, 2026
Marketing materials focus on capabilities; the most concrete public limitation signal is community feedback about reporting quality in PAM entitlement reporting. That specific complaint appears to reference PAM reporting rather than the Comply IGA product line.
No explicit public scale limits (identities, applications, entitlements, campaign size) were identified in the reviewed sources. Organizations should request reference architectures and any documented scale boundaries during evaluation.
Vendor claims such as “cut access review effort by 80%” and “reduce permissions needing review by up to 75%” are presented in marketing and press materials. Procurement teams should request:
Inferred reasons include:
From community themes and comments:
Most aligned with:
Strong fit where audits are frequent and access evidence is scrutinized:
Get a comprehensive analysis of CyberArk User Access Review Compliance including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →Basic Microsoft-only access reviews are sufficient If entitlements are primarily Entra groups and Microsoft-native access reviews meet requirements, Microsoft Entra ID Governance may be a simpler option.
Need a long track record of large-scale IGA with abundant third-party reviews Established enterprise IGA vendors such as SailPoint or Saviynt have longer market histories and larger public review footprints for certain IGA capabilities.
Require transparent, self-serve pricing and minimal services CyberArk Comply/IGA appears to be primarily quote-based; organizations seeking clear, published enterprise pricing for all modules may need alternatives.
Desire a point-solution access review tool with minimal platform coupling Newer modern IGA vendors (ConductorOne, Lumos, SecurEnds) may offer faster onboarding and lower perceived vendor coupling for organizations that do not already use CyberArk products.
There are limited directly accessible, product-specific reviews for CyberArk Comply / User Access Review Compliance on mainstream review platforms in the sources captured. Available third-party reviews tend to focus on CyberArk PAM rather than the IGA module. Where possible, this section references:
A CyberArk customer story (Sprout Social) includes positive feedback about the Universal Sync capability:
The same case study reports a vendor-published result of a substantial reduction in project duration of access reviews. These outcomes are presented in a vendor-published case study; the methodology, baseline, and measurement approach are not independently verified in this report.
Because CyberArk has a large installed base in PAM, many community threads discuss CyberArk generally rather than the IGA module. These threads provide signals about operational realities such as deployment complexity, support experience, and perceived cost.
Selected community comments (critical):
Selected community comments (neutral/positive):
Claimed outcomes:
What’s credible/valuable:
Methodology gaps / critical notes:
CyberArk User Access Review Compliance is CyberArk’s user access review / access certification capability within its Identity Governance & Administration (IGA) portfolio (originating from Zilla Security’s “Zilla Comply” product, now branded under CyberArk Comply / CyberArk IGA). It is designed to automate periodic user access reviews across SaaS, cloud and on-prem applications, produce audit evidence packages, and in some cases drive closed-loop remediation (revocations via integrations or ticketing workflows).
The product is intended to replace spreadsheet-driven access review processes; it provides visibility into entitlements, supports campaign automation, and generates reports intended to support audits. Product materials describe integrations via APIs, flat-file import, and CyberArk Universal Sync (formerly Zilla Universal Sync) for applications that do not provide APIs.
Primary buyers: Security, GRC, IAM/IGA teams; internal audit; compliance program owners.
Typical environments: Mid-market to enterprise organizations with:
CyberArk describes the product as a modern IGA solution, contrasted with legacy on-premises IGA approaches that can be slower to deploy. CyberArk links access reviews to least-privilege and privilege controls in its messaging.