Mode
All Competitors
View
Key Competitive Excalibur (Modern) CyberArk (Legacy)
☁️ Platform ✅ Unified & Simple Platform ⚠️ Complexity & Resource Intensity
⚡ Deployment ✅ Fast & Simple Deployment ❌ Complexity & Resource Intensity
🏷️ Pricing ✅ Low, Transparent, Per-User Pricing ❌ High, Infrastructure-Heavy, Per-Device Pricing
💰 Total Cost (TCO) ✅ Significant Cost Savings, More Accessible ❌ Very High Cost, Premium Pricing
🏛️ NIS2 Readiness ✅ NIS2-Ready Out of the Box ❌ Non-Compliant with EU Sovereignty Direction
🇪🇺 Data Sovereignty ✅ 100% EU Owned & Operated, No US CLOUD Act ❌ US CLOUD Act Exposure
🛡️ Architecture ✅ Isolation by Design, resilient to Zero-Day Threats ⚠️ Limited, Signature-Based, Vulnerable to Zero-Day Threats
📋 AI & Governance Model ✅ Pre-Execution (Pre-Emptive) ⚠️ Post-Execution (Reactive)
🌐 Web Access & RBI ✅ VITRO Technology with Native DOM-Streaming RBI & WAF ⚠️ Limited Isolation, Basic Web Access
🔐 MFA Integration ✅ Truly Passwordless and Built-in MFA ⚠️ Vault-centric, Traditional Credential Checkout
💻 Endpoint Agents ✅ Agentless ⚠️ Often Required (Agents/Add-Ons)

Why Excalibur SAM Wins

Unified platform — MFA + PAM + Remote Access in one (Simplicity)
Fast Deployment — no lengthy professional services (Speed)
Transparent per-user pricing — no hidden fees (Value)
NIS2-ready out of the box in one platform (Compliance)
100% EU sovereignty — no US CLOUD Act exposure (Trust)
Pre-emptive model — stops threats before execution (Pre-emptive)
Isolation by design — resilient to zero-day threats (Architecture)
VITRO RBI-WAF — bi-directional browser isolation (Protection)
Passwordless MFA — eliminates credential theft (Security)
Fully agentless — zero endpoint software needed (Simplicity)
🏛️

What is NIS2?

  • EU cybersecurity law (effective October 2024) covering 18 sectors
  • Mandates access control, MFA, session management, monitoring & incident response
  • Requires supply-chain security — you must vet your vendors
  • Personal liability for executives; fines up to €10M / 2% global turnover
⚖️

What is the US CLOUD Act?

  • US law (2018) that lets the government demand any data from any company with US presence — regardless of where data is stored — without EU court approval
  • Can compel backdoors and impose gag orders — disclosure means imprisonment / extradition
  • Applies to any US nexus — offices, subsidiaries, or even employees in the US is enough
📋

Upcoming EU Regulation

The EU is advancing digital sovereignty rules that will prefer — or require — EU-owned vendors for critical infrastructure. The proposed regulation means choosing a non-EU vendor today risks a costly forced migration tomorrow.

Excalibur

100% EU-owned and EU-operated.
No US parent, no US subsidiary, no US office, no US employees.
✓ Not subject to the US CLOUD Act
✓ Forced backdoors legally impossible
✓ Qualifies for upcoming EU vendor-preference regulations

CyberArk

Major HQ: Newton, Massachusetts, USA.
✗ Fully subject to the US CLOUD Act
✗ Compellable backdoors + gag orders
✗ Cannot qualify as EU vendor
EU customers face regulatory risk and potential forced migration.

Handling Objections

"CyberArk is the market leader"

• Recognized in large, complex enterprises
• Excalibur prioritizes simplicity, lower cost, better UX
• Modern approach vs. legacy complexity

"Is Excalibur proven?"

• Deployed in finance and government sectors
• Validated by EU grants and third-party pen tests
• Trusted for critical privileged access security

"CyberArk has more features"

• Excalibur focuses on core risk — securing human access
• Passwordless PAM, MFA, and isolation address fundamental risks
• Simplifies overall security posture

"We need EPM/Secrets management"

• CyberArk does have dedicated EPM and secrets solutions
• Excalibur focuses on critical human access security first
• Most customers prioritize this fundamental risk area

"CyberArk hosts data in the EU"

• Data location is irrelevant under the US CLOUD Act
• As a US company, CyberArk must comply with US government demands for data regardless of where it's stored
• They can also be forced to install backdoors under gag orders — you'd never know
• Only a 100% EU-owned vendor with zero US presence is truly immune

"We're buying for NIS2 compliance"

• Perfect — that's exactly what Excalibur was built for
• Single platform covers MFA, PAM, session monitoring, and access control
• Cloud-native with tunnels — deploys in hours, not months
• When all vendors cover the requirements, it comes down to price and sovereignty — we win both

Key Discovery Questions

How are you currently handling MFA and PAM? Is managing passwords still a headache?
What's your team's biggest frustration with managing your current PAM solution?
Do users complain about slow or complex secure remote access?
Is your team ready to simplify and lower the cost of PAM and MFA?
What regulation is driving this purchase — NIS2, DORA, or internal policy?
Does your organisation have requirements around EU data sovereignty or vendor nationality?
Are you aware that US-headquartered vendors are subject to the CLOUD Act regardless of data location?
How quickly do you need to be compliant? What's the deployment timeline expectation?
Competitive Edge Cost Efficiency EU Compliance Security Simplicity Excalibur SAM CyberArk

Key Advantages

Cost Efficiency

  • Single-Platform Pricing — One license covers PAM + MFA + RBI-WAF + session recording. CyberArk charges separately for Vault, PTA, Identity, and Alero.

Simplicity

  • Cloud-Native (K8s) — Deploy via Helm in hours with auto-scaling; CyberArk requires on-prem Vault servers + weeks of professional services.

EU Compliance

  • 100 % EU Sovereignty — EU-owned, EU-hosted, zero US footprint. Immune to the US CLOUD Act — a structural gap CyberArk (NASDAQ: CYBR, Newton MA) can never close.

Security

  • Zero-Trust Isolation — Air-gap architecture physically separates endpoints from resources; CyberArk's proxy model leaves the attack path open.
  • Built-in RBI + WAF — Bi-directional web protection (browser-to-app and app-to-browser) out of the box; CyberArk has no equivalent.
  • Passwordless MFA — Native FIDO2 / biometric auth ships in the platform; CyberArk relies on third-party MFA add-ons.