Akku PAM vs ARCON PAM

ARCON PAM's credential model stores passwords in a vault and rotates them on a configurable schedule. The credential persists between sessions and is reused until the next rotation window. For on-premises targets, vault rotation — not per-session ephemerality — is the standard model.

AkkuArka generates a fresh credential at the point of every access request, for every target type. Depending on how the administrator configured the target during onboarding, that means a new password, a new user with scoped permissions, or a new SSH key. The credential is injected silently by AkkuReka, exists only for the duration of the session, and ceases to exist the moment the session closes. There is nothing stored between sessions. Nothing to steal between uses. Nothing to rotate.

ARCON PAM's on-premises deployment model requires inbound connectivity to target systems — typically inbound firewall ports or a VPN tunnel to the PAM server. For organisations managing infrastructure in isolated networks, this creates the familiar choice: open the network or deploy the full PAM stack inside every protected zone.

AkkuReka's worker model dials out. No inbound ports required on workload networks. For isolated networks, air-gapped environments, and private VPCs, a single lightweight agent binary handles credential operations inside the zone — outbound connections only, no product stack, no credentials stored on the agent host between operations. Adding a new isolated environment takes minutes. The firewall stays exactly as it is.

For banks, hospitals, and manufacturers where security teams will not approve inbound firewall rules, this is the difference between a PAM deployment that proceeds and one that stalls.

ARCON PAM does not include native Kubernetes session proxy support as a standard feature. AkkuReka includes Kubernetes as a built-in target — controlled, session-gated, fully recorded access to K8s clusters. For DevOps and cloud-native engineering teams running mixed infrastructure, this matters.

ARCON PAM's full capability requires procurement of multiple separately licensed products: core PAM, Endpoint Privilege Management (EPM), Cloud Infrastructure Entitlements Management (CIEM), Secrets Management, and Global Remote Access (GRA) are all separate modules with separate pricing. For organisations needing the complete picture, this means a complex multi-module procurement and multiple products to deploy, maintain, and administer.

Akku PAM delivers session proxy, credential engine, adaptive IAM, MFA, and audit in one platform. No module fragmentation. No up-selling as requirements grow.

ARCON PAM implementations require professional services engagement for environment assessment, deployment planning, and rollout. This is standard for large enterprise deployments but introduces cost, lead time, and external dependency that mid-market organisations often cannot absorb.

Akku PAM is self-serve. IT teams configure the platform, deploy the AkkuReka worker, and begin managing privileged sessions within days — no specialist implementation required, no mandatory consulting engagement.

ARCON's multi-dimensional pricing model — per-user for PAM, per-node for A2A Password Management, per-application or per-user for Secrets Management — makes TCO difficult to forecast as deployment scope expands. Adding servers, integrating more applications, or enabling DevOps tooling compounds costs in ways that are hard to predict at procurement time.

Akku PAM's per-user and per-asset pricing scales predictably. Costs grow with headcount and assets under management, not with the number of modules needed or the complexity of the infrastructure.