Why Anchor Is Different
Modern privileged access without the bloat. One licence, the features you expect included, and a product your team can run without a consultant on speed dial.
Less suite, more solution
Section titled “Less suite, more solution”Privileged access management got heavy. Suites grew modules, modules grew licences, and the licences grew a renewal meeting. Anchor goes the other way: a focused product that does the core job well, runs where you choose, and includes the features you would expect to pay extra for elsewhere.
Session recording? That’s the Premium tier. SIEM forwarding is a separate SKU, and SSO is “on the roadmap for your edition.”
No feature gates. Recording, SIEM forwarding, single sign-on, Compass with SOC 2 and NIST scoring, and the API are part of the product, not add-ons.
A catalogue of 500 target types, most of which nobody you know has ever connected to.
We support the most common types, and every one of them rotates, verifies, reconciles and connects.
“Yes, it does that! With the add-on. Which needs the connector pack. And self-hosting is on a different price list.”
Anchor includes most of what other tools charge extra for, and running it on your own servers is the standard setup, not a premium edition.
Subscriptions stacked on subscriptions, add-ons you discover at renewal, and a licensing guide that needs its own licence.
One licence, sized by people, Targets, Accounts, Engines and Connect hosts. You grow it by adding capacity, not by buying features.
Audit season: export six spreadsheets, buy the compliance module, and book a consultant who loves pivot tables.
Compass scores every account and maps it to SOC 2, NIST SP 800-53 and NIST CSF 2.0 controls from Anchor’s own records, with a suggested fix where a check falls short. Evidence for your assessor, not a certificate.
An upgrade is a project, with a statement of work and a weekend.
Upgrades and backups run from the console or the command line, whichever you prefer: one signed release, a preview first, then host by host. You still plan a maintenance window, just not a statement of work.
What you get instead
Section titled “What you get instead”Ten things Anchor does differently, each linked to where you can see it in the product tour.
Better internal alerts
Built-in notices for sign-ins on Anchor’s own hosts, break-glass use, a cut in the audit chain and keys about to expire. You set each one’s level and audience; your own rules add email and a cooldown.
See it in Activity and EvidenceA separate Evidence store
Audit, session records, recordings and component logs live in their own Evidence store, chained and signed so tampering shows. Your SIEM reads it through read-only views or syslog over TLS.
See it in Activity and EvidenceUpgrades and backups, console or CLI
Run them from Control Core or the anchor command line. Signed releases roll out host by host after a preview, and a backup counts once a test restore proves it.
See it in Running AnchorSSH Targets and trust
Anchor keeps track of the SSH hosts you trust: each key approved once, listed with its fingerprint and when it was last seen.
See it in Onboarding and TrustSimple onboarding
A seven-step checklist, an Estate scan that finds hosts and privileged accounts, a three-step Add Account, and CSV for the rest.
See it in Onboarding and TrustScope Admins for team leads
A Scope Admin runs their team’s Scopes and who can use them, without global rights and without seeing passwords.
See it in Scopes, Roles and PoliciesEngine pools
Engines share the verify, rotate and reconcile queue, so adding one adds capacity. Each Scope has its own switch for Engine operations.
See it in Running AnchorNative SSH
Use your own SSH client. Name the account to go straight there, or sign in once and pick from every account you may use. The password never reaches your laptop.
See it in Privileged SessionsMaintenance windows
Change windows and blackout dates for scheduled work, and maintenance access to Anchor’s own hosts that ends at the deadline you set.
See it in Scopes, Roles and PoliciesPersonal locker
Your own credentials and notes, encrypted to you alone. No admin view, and every view is recorded.
See it in Accounts and Passwords
Modern, and built to adapt
Section titled “Modern, and built to adapt”- Runs where you do. One host to start, one per role when you need the separation, on-premises or in your own cloud account.
- Shaped like your organization. Scopes mirror your teams, Platforms are definitions you can adjust, and Policies say in plain language how the work should happen.
- Small enough to understand. Each component has one job, and the Health map shows every one of them and every link between them.
Want the honest version for your estate? Check whether Anchor fits, see what’s in this release, or start a conversation with an Anchor engineer.