Delinea
Delinea — 身份安全尽调报告
Delinea 是已具规模的身份安全平台,ARR 超过 $400M,产品线宽、客户证据扎实;但估值和资本结构仍不透明,在真正的定价或披露事件出现前,只适合继续跟踪。
封面要素
公司概况
Delinea 是一家 PE 资方支持的身份安全平台,源于 2021 年 Thycotic/Centrify 合并,并在 2022 年以 Delinea 品牌重新推出。公开材料显示,公司产品面很宽,覆盖特权访问管理、授权、远程访问、治理和机密工作流,以 Secret Server、Privilege Manager、Fastpath 以及较新的 AI 驱动授权能力等产品为支点。截至 2025 年,公司公开称 ARR 超过 $400 million,收入结构以 SaaS 为主,此前里程碑材料披露服务超过 8,500 家机构,并继续借助渠道投资和收购扩展平台。真正仍未公开的,是最关键的投资判断细节:当前估值、资本结构、留存质量和经审计单位经济。
- 成立时间
- 2021-04-01
- 创立地点
- Sponsor-led Thycotic/Centrify combination
- 总部
- San Francisco, California, USA
- 产品
- 身份安全平台,覆盖特权访问管理、端点和服务器权限、远程访问、身份威胁防护、治理控制、机密管理,以及横跨人类与机器身份的 AI 驱动授权。
- 客户
- 面向有特权访问、审计、合规和混合基础设施需求的企业与高端中型市场机构;公开证据覆盖制造、零售、公用事业、电信、媒体和财务控制环境。
- 商业模式
- 以直销和合作伙伴渠道销售为主的经常性企业软件;公开证据显示收入结构以 SaaS 为主,采用询价驱动包装,并在 PAM、授权、治理及相邻控制模块之间交叉销售。
- 阶段
- Sponsor-backed private company with IPO-registration-style signals but no current public price
- 融资情况
- 历史公开基准:TPG 于 2021 年以 $1.4B 收购。当前估值、债务和优先权堆叠在已审阅公开来源中仍未披露。
执行摘要
主要优势
- ARR 超过 $400M,且收入以 SaaS 为主,说明 Delinea 已在身份安全里跑出真实经常性收入规模。
- 产品面现在覆盖 PAM、授权、治理、密钥管理、远程访问和身份威胁工作流,不再只是单一密码库产品。
- 公开客户证据远好于 logo 墙:有具名案例,也有虽已过时但仍有意义的 8,500+ 家组织覆盖披露。
- 身份 / 安全领域的相关上市可比公司,仍能支撑这一品类成熟资产的可观估值区间。
- 赞助方背书和扩平台收购,为未来 IPO 或赞助方退出流程保留战略选择。
主要风险
- 当前没有公开估值标记、债务情况、优先股堆叠或退出瀑布明细,投资人无法判断今天的价格。
- 2024 年披露争议、公开 CVE,以及可见的安全公告 / 状态更新之后,安全流程风险仍然真实存在。
- NRR、毛利率、现金生成和客户集中度均未披露,无法在上市可比公司中干净校准。
- 公共部门上行空间需谨慎看待,因为 FedRAMP 仍处于评估中,并非已完全授权。
- 第三方市场数据在估值、收入等基础信息上分歧很大,提高了尽调摩擦。
未决问题
- 当前估值标记、股权结构表、债务时间表,以及优先权 / 瀑布经济条款。
- 经审计 ARR、NRR、GRR、毛利率,以及服务收入占比桥接。
- 按产品家族拆分的客户集中度、队列留存和扩张行为。
- IPO 准备度、投行接触或赞助方退出时间的清晰证据。
- 管理层确认的员工数、董事会构成和当前持股比例。
目录
01公司概况
1.1 身份、源流与产品范围
Delinea 当前官方叙事已经超出传统特权访问管理。关于页面、平台页面以及 2025-2026 年发布内容,把公司描述成一个身份安全控制平面,围绕集中式授权、Delinea Iris AI,以及跨人类、机器和 AI 身份的持续治理构建。这个更宽的平台主张重要,因为公司底层仍在变现一套可识别的 PAM 组合:Secret Server、Privilege Manager、Cloud Suite/Server PAM、DevOps Secrets Vault、Identity Threat Protection 和相关控制模块,仍然是现役产品或转型期产品。公司的源流也需要说清楚。官方发布材料称,Delinea 于 2021 年 4 月由 Thycotic/Centrify 合并而成,并在 2022 年 2 月公开推出 Delinea 品牌。第三方数据库里出现的 1999 或 2004 等更早日期,更像是前身公司或法律沿革痕迹,而不是合并后 Delinea 品牌清晰的商业起点。[CO001, CO002, CO003, CO004, CO005, CO006]
| 指标 | 数值 / 状态 | 截至时间 | 置信度 | 缺口 / 尽调备注 |
|---|---|---|---|---|
| 公司形成叙事 | 由 Thycotic/Centrify 合并形成;Delinea 品牌于 2022 年推出 | 2021-2022 | 高 | 数据库里的 1999/2004 年日期更像前身沿革,而不是 Delinea 品牌的清晰起点 |
| 当前品类 | 身份安全控制平面 / 集中授权平台 | 2025-2026 | 高 | 叙事仍建立在底层 PAM 产品和模块之上 |
| 最有证据支撑的总部 | 当前资料显示 San Francisco;早期官方发布的发稿地为 Redwood City 和 Washington, DC | 2025-2026 / 历史 | 中 | 需要管理层确认总部和法律实体图谱 |
| 所有权 / 阶段 | PE 支持,PitchBook 预览显示 IPO 注册信号 | 2025 | 中 | 未披露公开申报文件包,也未披露 2021 年后的新估值 |
| 历史公开交易基准 | Crunchbase 上的 TPG $1.4B 收购基准 | 2021-03 | 中 | 历史控股权事件,不是新一轮成长融资证据 |
| ARR 规模 | FY2024 收官时接近 $400M;到 2025 年 8 月超过 $400M | 2025 | 高 | 公司发布数据;未查阅公开审计财报 |
| 经常性收入占比 | GAAP 收入中 95% 为经常性收入 | 2025-03 | 高 | 由 2025 年 3 月官方年终发布支撑 |
| 客户披露 | 2024 年 Q2 为 8,500+ 家组织;后续页面称全球数千家,且覆盖 >50% 的 Fortune 100 | 2024-2026 | 中 | 未找到精确 2025/2026 客户数,也未找到 17,000+ 的佐证 |
| 员工数披露 | Crunchbase 501-1000;PitchBook 1,136;GetLatka 约 1.2K | 2025-2026 | 中 | 第三方名录估算差异很大 |
| 平台运营信号 | 99.995% 正常运行时间、500+ 个集成、每日保护 1M+ 个身份 | 2025-2026 | 中 | 均为公司自称运营指标 |
本表把官方运营口径与第三方所有权、员工数和所在地资料放在一起;公开指标方向上较强,但客户数、估值和总部数据仍需管理层对齐。
[CO012, CO013, CO001, CO020, CO021, CO025]合并后公司的故事把遗留 PAM 资产连到更广的身份安全平台,再借赞助方支持和企业客户牵引,为 AI 和授权的进一步扩张供血。
[CO005, CO006, CO007, CO008, CO009, CO010]当前公开数据体现出扎实的平台规模和 ARR 动能,但精确客户数和估值披露仍落后于运营成熟度。
[CO032, CO031, CO030, CO004, CO003]1.2 领导层、治理与运营足迹
领导层记录既支持最高层连续性,也显示 GTM 和财务职能发生了实质演进。从合并期到 2025-2026 年增长发布,Art Gilliland 一直是公司最清晰的公开面孔;James Legg 起初担任合并后业务总裁,之后在 2022 年把职责交给 Rick Hanson,2025 年又由 Chris Kelly 负责 GTM 领导。Stephanie Reiter 在 2025 年 ARR 发布中成为公开财务声音;已审阅的公司公告也能看到法务、产品、渠道和区域扩张负责人,构成并购后管理梯队。治理可见度更弱。公开材料在 2021 年提到 Pascal Van Dooren 为董事,但当前董事会名单以及任何观察员或资方控制条款,在已审阅公开来源中均未披露。实体足迹证据也不完美:当前目录式资料指向 San Francisco,早期官方发布则使用 Redwood City 和 Washington, DC 日期线。实际结论是,San Francisco 是目前支持度最高的总部地点,但地点历史应视为动态信息,而不是一个永恒事实。[CO014, CO015, CO016, CO017, CO018, CO019]
| 人员 | 职务 | 公开背景 / 相关性 | 职能覆盖 | 关键人 / 尽调备注 |
|---|---|---|---|---|
| Art Gilliland | CEO | Centrify 时代领导者,合并后公司由其担任 CEO;在 2025-2026 年发布中,他仍是 Delinea 最主要的公开发声者 | 总体战略、平台叙事、控股方接口 | 概览层面对关键人依赖高 |
| Chris Kelly | GTM 总裁 | 2025 年 1 月加入,此前在 CyberArk、Adobe 和 Cisco 担任高级营收领导职务 | 全球销售、渠道、解决方案工程、客户成功 | 显示企业级 GTM 仍在扩张 |
| Rick Hanson | 总裁(2022 年交接) | 2022 年 8 月从 James Legg 手中接过 GTM 领导职责,此前曾任职 Onapsis 和 Brightcove | 历史 GTM 过渡节点 | Chris Kelly 任命后,该角色似乎已成历史 |
| Stephanie Reiter | 首席财务官 | 2025 年 ARR 发布中以 CFO 身份被引用,并谈及增长、利润率和需求 | 财务规划、披露、利润率叙事 | 需要超过新闻稿的审计披露深度 |
| Suzanne Tom | 首席法务官 | 2021 年加入,当时公司在合并后补强管理层 | 法务、合规、治理流程 | 对受监管行业增长和披露纪律很重要 |
| Pascal Van Dooren | 董事会成员(公开点名) | 已审阅的当前时期公开资料中,唯一被明确点名的董事会成员 | 董事会监督 / 外部治理信号 | 当前完整董事会名单仍未公开 |
| Spence Young | EMEA 与 APAC 销售高级副总裁 | 2025 年晋升,并在 2026 年区域扩张发布中被引用 | 国际营收执行和区域规模 | 支撑增长叙事,但不能替代完整组织架构透明度 |
合并后公司的历史很难映射成单一创始人叙事;本表改为覆盖公开可见的领导层梯队,以及已审阅来源中唯一公开出现的董事会姓名。
[CO014, CO015, CO016, CO017, CO018, CO019]1.3 所有权、资本历史与估值可见度
概览层面的所有权证据首先指向 TPG,而不是一个庞大的后期风险投资财团。2021 年合并公告称,TPG 从 Insight Partners 收购 Thycotic,此前已完成 Centrify 收购,并在 Thoma Bravo 和 PSP Investments 少数股权支持下合并两家公司。第三方资料也强化了这个叙事。Crunchbase 记录 2021 年 3 月 TPG 以 $1.4 billion 收购;Mergr 另行记录 2021 年 1 月从 Thoma Bravo 和 Golub Capital 手中收购;PitchBook 预览目前把 Delinea 标记为 PE 支持且处于 IPO 注册中。公开来源没有提供的信息同样重要:已审阅材料不能证实提示词中所称 2024 年 TPG 战略增长投资,也无法验证 Francisco Partners 当前持有 Delinea 股权。市场数据来源在资本历史和估值上也互相冲突,从 PE 所有权叙事到遗留风险轮次痕迹,再到低置信度估值估计都有。最稳妥的投资判断是:Delinea 是一家有资方支持的私人公司,具备强历史控制权交易基准和当前 IPO 信号,但没有新近披露的 2024 年后公开估值标记。[CO022, CO023, CO024, CO025, CO026, CO027]
| 利益相关方 | 角色 / 关系 | 控制权或经济重要性 | 当前公开信号 | 尽调要求 |
|---|---|---|---|---|
| TPG | 控股方 / 所有者 | 2021 年组建交易和当前 PE 支持状态背后的核心所有者 | 2021 年合并公告、Crunchbase 收购记录、PitchBook 所有权状态 | 确认当前持股比例、杠杆和退出时间 |
| Thoma Bravo | 前 Centrify 所有者;2021 年少数股支持方 | 历史卖方,合并后可能仍有剩余经济权益 | 官方合并公告、Mergr 卖方记录、Crunchbase 投资者列表 | 澄清是否仍保留任何剩余持股或治理权 |
| PSP Investments | 2021 年少数股投资者 | 若仍保留股份,可能继续影响治理的机构支持方 | 官方合并公告和 Crunchbase 投资者列表 | 索取当前持股比例和董事会 / 观察员权利 |
| Insight Partners | 将 Thycotic 出售给 TPG 牵头合并的卖方 | 对重构沿革和滚存权益问题很重要 | 官方合并公告和 SiliconANGLE 报道 | 确认交割后是否保留任何滚存经济权益 |
| Fortune 100 客户群 | 标杆客户群 | 企业可信度和经济韧性的关键证据点 | 公司称服务数千家客户,包括超过半数 Fortune 100 | 索取客户标识清单、集中度和续约经济性 |
| StrongDM | 2026 年收购的战略资产 | 为平台加入运行时授权,并增强 AI/DevOps 相关性 | 官方收购公告和 Tracxn 收购摘要 | 跟踪整合里程碑、留存和任何或有对价结构 |
本图聚焦公开可见的控股方、前所有者和少数经济相关方;当前股权结构比例和任何隐藏滚存股权均未公开披露。
[CO022, CO023, CO024, CO025, CO026, CO027]1.4 规模、动能与里程碑轨迹
公开运营曲线很强,尽管并非每个指标都以当前精度披露。Delinea 2022 年以 $250 million ARR 收官并新增 1,300+ 客户;2025 年 1 月领导层发布称,截至 2024 年 Q2,业务 ARR 已超过 $350 million,并服务全球超过 8,500 家机构。之后两份 2025 年发布进一步抬高图景:fiscal 2024 ARR 据称接近 $400 million,经常性收入占 95%;到 2025 年 8 月,ARR 已超过 $400 million,SaaS 仍占收入结构多数。公司把这些财务里程碑与运营信号并列呈现,包括 99.995% 可用性、500+ 集成,以及每天保护 1M+ 身份。2024 年以来的里程碑还显示 Delinea 同时向多个方向扩张:全球合作伙伴计划、Mexico City 扩张、Secret Server 的 FedRAMP High 流程、EMEA/APAC 新区域负责人,以及收购 StrongDM,把运行时授权带入 Delinea Platform。合在一起,这些里程碑支持一个结论:公司正在从传统 PAM 向更宽的身份安全平台故事扩张。[CO029, CO030, CO031, CO032, CO033, CO034]
| 日期 | 事件 | 类型 | 金额 / 估值 / 状态 | 参与方 | 含义 |
|---|---|---|---|---|---|
| 2021-03-02 | TPG 宣布 Thycotic 与 Centrify 合并 | 治理 | 未披露财务条款 | 相关机构:TPG、Thycotic、Centrify、Insight、Thoma Bravo、PSP | 形成后来成为 Delinea 的合并公司 |
| 2021-12-01 | 合并后高管团队扩充,Pascal Van Dooren 加入董事会 | 治理 | 管理层搭建 | Delinea | 运营专业化的早期信号 |
| 2022-02-01 | Delinea 品牌公开亮相 | 治理 | 品牌发布 | Delinea、TPG | 合并后公司获得统一市场身份 |
| 2022-08-10 | Rick Hanson 出任总裁 | 治理 | James Legg 交接 | Delinea | 公司组建后 GTM 领导层调整 |
| 2023-02-28 | FY2022 以 $250M ARR 和 1,300+ 新客户收官 | 规模 | $250M ARR;25%+ 增长 | Delinea | 确认合并后已有可观运营规模 |
| 2024-01-17 | 全球合作伙伴计划启动 | 合作 | 四级渠道框架 | Delinea 与生态合作伙伴 | 扩大间接 GTM 能力 |
| 2024-04-16 | Secret Server SOAP API 披露争议公开 | 不利 | 严重漏洞 / 紧急修补 | Delinea、研究人员、CERT 媒体 | 提升产品安全尽调优先级 |
| 2025-01-13 | Chris Kelly 被任命为 GTM 总裁 | 治理 | 引用的 2024 年里程碑:2024 年 Q2 达到 $350M ARR,8,500+ 家组织 | Delinea | 增加规模证据和 GTM 领导层深度 |
| 2025-03-18 | FY2024 收官时 ARR 接近 $400M,经常性收入占比 95% | 规模 | ~$400M ARR;95% 经常性收入 | Delinea | 改善财务成熟度叙事 |
| 2025-05-13 | Secret Server 启动 FedRAMP High 流程 | 监管 | 授权流程启动 | Delinea、UberEther | 支撑公共部门 / 合规扩张 |
| 2025-08-12 | ARR 超过 $400M,Iris AI 驱动增长叙事得到强化 | 规模 | > $400M ARR | Delinea | 强化企业级和 AI 定位 |
| 2026-02-18 | EMEA 和 APAC 任命三名高级领导者 | 治理 | 区域招聘 | Delinea | 显示公司继续投入国际市场 |
| 2026-03-05 | StrongDM 收购完成 | 产品 | 条款未披露 | Delinea、StrongDM | 平台加入运行时授权,并强化安全 AI 叙事 |
这份时间线是本章关于 2021-2026 年的单一公开里程碑记录;它优先纳入外部可见的公司、所有权、规模、监管和不利事件,而不是每一次产品发布。
[CO012, CO017, CO013, CO016, CO029, CO036]Delinea 的公开轨迹从 2021 年赞助方主导合并,走到 2025 年 ARR 规模和 2026 年平台 / M&A 扩张;2024 年披露争议是概览层面的主要挫折。
[CO012, CO017, CO013, CO016, CO029, CO036]1.5 反向信号与剩余尽调问题
最清晰的概览层面反向信号,是产品安全流程风险。SecurityWeek 和 Dark Reading 均报道称,在 2024 年 4 月一个关键 Secret Server SOAP API 漏洞公开前,Delinea 似乎忽视或处理不充分,未能妥善回应持续数周的负责任披露沟通。NVD 后来把 CVE-2024-33891 记录为认证绕过问题,CNA 严重性为高;Delinea 自己的公告页面也显示,Secret Server 和 Cloud Suite 在 2025 与 2026 年继续累积额外 CVE。上述情况不否定前文的业务动能;公司也公开发布安全公告,并推动 Secret Server 取得 FedRAMP High。但这意味着下行情景不只是理论风险。公开证据仍留下重大概览问题:当前准确客户数、当前董事会构成、2021 年后所有权比例,以及是否发生过任何 2024 年资方再资本化。这些问题重要,因为它们影响估值信心、退出准备度判断,以及在披露不透明下应给运营强度打多大折扣。[CO044, CO045, CO046, CO047, CO048, CO049]
02市场分析
2.1 市场边界、相邻领域与 Delinea 真正销售的东西
首要分析任务不是挑一个 TAM 数字,而是界定正确市场。Delinea 自己的平台叙事已经不再是简单的密码保险库故事。当前产品页面和平台资料把公司定位为身份安全平台,覆盖人类、机器和 AI 身份,并以集中式授权和平台化作为战略楔子。这让公司处在一个分层市场位置。Delinea 仍然参与经典特权访问管理竞争,但也延伸到更宽的身份治理、非人类身份和工作流控制预算。竞品表述支持这一判断:CyberArk 和 Okta 都把身份定位得比保险库更宽,Microsoft Entra 则把混合身份和治理放进同一决策集合。实际含义是,相关市场比完整 IAM 宇宙更窄,但又比传统 PAM 更宽。买方在购买专门的 Delinea 类平台前,也可以用原生身份工具、分散的 MFA 和密码控制,或治理套件来替代。[CM001, CM002, CM013, CM014, CM015, CM016]
| 市场层 | 纳入支出 | 排除支出 | 主要买方或付款方 | 与 Delinea 的相关性 |
|---|---|---|---|---|
| 广义 IAM | 身份认证、治理、访问控制、CIAM、PAM、分析和部分服务 | 不含身份控制内容的无关安全品类 | CISO、CIO、IAM 负责人 | 适合作外层上限,但太宽,不能直接用于承销 |
| 特权访问管理 | 凭据保险库、特权会话、最小权限、凭据轮换、管理员工作流 | 不触及特权或敏感访问的一般员工身份 | 安全、基础设施、审计 | 仍是 Delinea 最清晰的历史核心 |
| 身份安全平台 | PAM 加发现、授权、态势、分析,以及跨身份的工作流控制 | 仅面向消费者的身份,或缺乏控制深度的通用访问 | 安全架构、IAM、平台团队 | 最适合当前 Delinea 叙事的战略框架 |
| 非人类身份和 AI 控制 | 服务账号、机器身份、AI 智能体、运行时授权、验证 | 仅限人类的 SSO 和基础目录管理 | 平台工程、安全工程、云团队 | 快速增长的相邻领域,可把故事从经典 PAM 往上扩 |
| 现状方案和捆绑式替代品 | 原生目录控制、基础 MFA、人工审计、更宽套件的治理 | 买方尚未拥有的专用控制 | 现有 IT 和身份预算 | 对新增支出转化构成真实竞争 |
本表保留分层市场定义,因为 Delinea 跨越不止一条身份控制预算线;只用最宽的 IAM 数字会夸大眼前切口。
[CM001, CM013, CM015, CM016, CM031, CM040]Delinea 处在嵌套市场层级中:最上层是广义 IAM,核心是经典 PAM,非人身份和平台治理则构成当前叙事周围的增长边缘。
[CM001, CM013, CM031, CM040]2.2 规模测算:需求偏多,分母杂乱
公开市场估计在方向上有利,但方法并不一致。MarketsandMarkets 预计 IAM 2025 年约为 $26 billion,到 2030 年达到 $42.6 billion;The Business Research Company 给出的数字是 2025 年 $21.8 billion、2026 年 $25.2 billion,并在 2030 年达到 $45.2 billion。Identity Management Institute 另给出一个 2025 年超过 $24 billion 的口径,ISMG 则引用到 2032 年 $61.7 billion 的更大数字。Research and Markets 又把视角进一步放宽,明确纳入 TAM 工作、供应链分析和特权访问治理。这些数字不一定错误,但不能互换。有些描述宽泛 IAM,有些强调软件加治理,有些大量押注非人类身份和 AI 驱动访问等未来相邻类别。对 Delinea 来说,干净结论是保留区间,抵制虚假精确。公司显然处在增长中的身份控制市场,但公开来源无法拆出一个可辩护的 Delinea 专属 SAM 或 SOM。[CM020, CM021, CM022, CM023, CM024, CM025]
| 发布方或视角 | 年份锚点 | 范围 | 数值 | 增长或趋势 | 重要性 | 主要限制 |
|---|---|---|---|---|---|---|
| MarketsandMarkets IAM | 2025→2030 | 广义 IAM,包括 PAM、IGA、CIAM、非人类 IAM | $25.96B → $42.61B | 10.4% CAGR | 显示企业身份控制的大分母,以及强劲的 PAM/NHI 顺风 | 对 Delinea SAM 来说仍过宽 |
| The Business Research Company 的 IAM 预测 | 2025→2026→2030 | 广义 IAM,PAM 归在「其他组件」内 | $21.81B → $25.23B → $45.22B | 15.7% CAGR | 对当前报告日期而言,是有用的近端 2026 锚点 | 与其他发布方分割和方法不同 |
| Identity Management Institute | 2025 | 广义 IAM 市场评论 | >$24B | ~13% 增长 | 确认需求方向,以及远程办公、监管等经常性驱动因素 | 评论式表层材料,不是深颗粒度模型 |
| ISMG IAM 市场指南 | 2025→2032 | IAM+ 市场和厂商格局 | 2032 年达 $61.7B | 长周期增长叙事 | 适合勾勒未来上行空间和厂商背景宽度 | 时间跨度更长,方法更像指南 |
| Research and Markets 市场概览 | 2026 年报告 | IAM,带 TAM、法律、供应链和特权访问治理框架 | 公开摘要页未清晰披露 | 宽口径 2026 年研究包 | 确认边界复杂度已超出经典 PAM | 可读摘要没有给出简单的一行规模数字 |
| 受证据约束的 Delinea SAM | 2026 | Delinea 在 PAM、平台和 AI 身份上的专属切口 | 无法从公开来源单独拆出 | n/a | 避免估值工作出现虚假精确 | 需要产品线收入组合和附着率披露 |
这些数字被刻意并列保留,而不是压成一个标题式 TAM,因为各发布方测量的范围和年份不同。
[CM020, CM021, CM022, CM024, CM025, CM023]各类市场规模口径指向相同方向,但差异很大,因为它们衡量的范围和预测窗口不同。
[CM020, CM022, CM025, CM027]2.3 买方、用户、付款方与采用路径
该类别的购买动作天然跨职能。安全负责人往往拥有问题定义权,因为特权访问和身份泄露显然是安全问题;但运营负责人常常是 IAM 架构师、基础设施团队、云团队和审计人员。用户包括管理员、开发者、服务账户负责人和治理人员。付款方可能落在安全、IAM、云或合规预算中,取决于触发因素:零信任要求、审计发现、云迁移、AI agent 控制,或无密码现代化。金融服务、医疗、政府和大型 IT 环境等受监管垂直领域,反复出现在市场分层和厂商定位中,因为它们同时面对更高审计压力和更复杂的混合资产。采用通常从一个痛点切入——未管理的特权访问、机器身份蔓延,或控制碎片化——等买方意识到点工具无法在身份和环境之间提供足够可见性、最小权限或一致策略执行后,再转向更宽的平台决策。[CM028, CM029, CM030, CM031, CM038, CM001]
| 细分场景或工作流 | 主要买方 | 实际用户 | 预算所有者 | 采用触发因素 |
|---|---|---|---|---|
| 特权 IT 管理 | CISO 或基础设施安全负责人 | 管理员和 IAM 团队 | 安全或基础设施 | 审计发现、常设权限、会话监控需求 |
| 混合身份现代化 | IAM 架构师或 CIO 代表 | IAM 工程师和服务台负责人 | IAM / IT | 云迁移、无密码、目录整合 |
| 非人类身份治理 | 安全工程或平台安全 | 开发者、服务负责人、机器账号所有者 | 安全工程或平台 | 服务账号蔓延、AI 智能体增长、运行时授权 |
| 受监管垂直行业合规 | 安全与合规负责人 | 审计员、应用负责人、特权操作员 | 安全、风险或合规 | 最小权限、日志和访问认证证据 |
| 平台化或控制平面整合 | 安全架构负责人 | 跨职能身份与云团队 | 转型或安全技术栈精简 | 工具太碎、策略不一致 |
买方地图刻意做成跨职能视角,因为 Delinea 类项目往往既要安全团队出面背书,也要平台团队落地执行,才过得了预算关。
[CM028, CM029, CM030, CM031, CM033, CM034]预算归属和用户工作流会随身份问题不同而变;Delinea 的胜点在于,买方需要一层控制同时满足操作者和治理负责人。
[CM028, CM029, CM030, CM031, CM043]市场通常先从识别风险开始,随后陷入控制工具蔓延,再转向零信任或平台化项目;只有买方相信部署摩擦可控,才会最终合并成统一采购。
[CM031, CM038, CM033, CM035, CM042]2.4 增长驱动与采用约束
市场顺风是真实存在的。NIST 和 CISA 的零信任指引继续把身份与授权推向企业安全架构中心。市场研究页面反复把云采用、混合办公和不断增加的身份驱动攻击,列为 IAM 与特权访问支出持续扩张的原因。AI 和非人类身份又增加一层增长,因为机器和 AI 身份的增速远快于人类账户,且常常可见度差、保留常驻权限。但采用故事并非没有摩擦。Delinea 自己的无密码调查显示,遗留系统和合规义务会拖慢即便被广泛讨论的现代化工作;Identity Management Institute 和 ISMG 的市场评论也指出预算约束、技能缺口和集成复杂度。这意味着仅靠类别扩张不够。Delinea 仍要证明治理、授权和运营简单性足够可信,让买方愿意为又一层控制买单,而不是默认选择捆绑方案或维持现状。[CM011, CM012, CM019, CM032, CM033, CM034]
| 驱动或约束 | 方向 | 时间窗口 | 对 Delinea 的传导 | 尽调问题 |
|---|---|---|---|---|
| 零信任采用 | 正向 | 当前 | 抬高持续授权和以身份为中心控制的价值 | 核实零信任要求有多常直接为 Delinea 类项目拨款 |
| 云与混合环境复杂度 | 正向 | 当前 | 放大跨环境访问治理需求 | 索取混合部署与云原生资产的客户结构 |
| AI 与机器身份增长 | 正向 | 当前 | 带来 NHI 发现、运行时授权和可解释性的新需求 | 验证非人类身份模块的附加购买率 |
| 凭证滥用与入侵风险 | 正向 | 当前 | 支撑特权访问控制这个核心采购理由 | 量化销售管线中有多少来自事件、有多少来自合规 |
| 传统系统依赖 | 负向 | 当前 | 即便需求明确,也会拖慢无密码化和策略现代化 | 按传统系统负担审查部署周期 |
| 技能与运营复杂度 | 负向 | 当前 | 可能拖慢部署,让平台化承诺难兑现 | 索取实施团队配置和合作伙伴使用情况 |
| 预算约束 | 负向 | 当前 | 让买方更偏向打包 IAM 或沿用现有工具,而不是新增专业平台支出 | 测试相对 Microsoft 和 Okta 套件的胜率 |
| 独立基准薄弱 | 负向 | 当前 | 削弱对 Delinea「部署更快」叙事的信心 | 收集第三方实施基准和客户背书 |
同一个市场可以结构性有吸引力,同时也很难在运营上变现;尽调要问的是,哪些约束足以拖慢真正的付费转化。
[CM033, CM032, CM034, CM019, CM035, CM036]2.5 对 Delinea 的含义与剩余市场缺口
尽调层面的市场结论应刻意收窄。Delinea 处在一个好市场,但不是一个能被干净测量的市场。公开证据支持一个巨大且扩张中的身份安全机会、一个耐久的 PAM 核心,以及围绕机器和 AI 身份控制的新相邻空间。缺失的是从这些自上而下叙事通向公司专属收入楔子的桥。公开来源没有显示产品线收入结构、平台模块 attach rate,也没有独立对标 Delinea 的部署速度主张与最强替代方案。这个缺口重要,因为当一家有真实执行动能的公司被套进过于慷慨的 TAM 时,估值工作会被扭曲。因此,投资判断应同时保留多重镜头:用经典 PAM 保住下限现实性,用更宽的 IAM 和治理体现战略上行,并明确标出 Delinea 专属市场捕获的证据缺口。这个框架足以支持继续研究的信心,但不足以支撑精确的公开 SAM 主张。[CM027, CM040, CM041, CM042, CM043, CM026]
03竞争格局
3.1 竞争版图:直接老牌厂商、相邻套件与侧翼进入者
Delinea 的竞争版图比简单的三家 PAM 厂商之争更宽,但仍有清晰重心。CyberArk 和 BeyondTrust 是最明确的直接老牌厂商,因为它们把特权访问深度作为主要企业控制类别来销售。核心之外,是 Microsoft、Okta、SailPoint 和 Saviynt 等更宽套件型竞争者;它们可以借助企业资产中既有的身份、治理和威胁工具,吸收部分购买标准。第三圈是侧翼进入者:CrowdStrike 和 SentinelOne 从端点驱动的身份安全切入,Teleport 和 StrongDM 从基础设施访问与运行时授权切入,Silverfort 以无代理身份安全切入,1Password 则从扩展访问管理式员工访问切入。Delinea 自己收购 StrongDM,证明管理层也认为这些侧翼类别具备战略现实性。因此,竞争问题不是 Delinea 有没有对手,而是每一次购买动作中它面对哪一层对手。[CP001, CP002, CP004, CP005, CP008, CP009]
| 厂商 | 类别 | 主要打法 | 最匹配买方 | 相比 Delinea 的主要短板 |
|---|---|---|---|---|
| CyberArk | PAM 老牌正面竞品 | 以保险库为核心的特权访问平台 | 重视特权深度和历史积累的大型企业 | 相比 Delinea 更新的平台叙事,显得更重、更传统 |
| BeyondTrust | PAM 老牌正面竞品 | 广覆盖 PAM 平台,强调一体化定位 | 想要一站式 PAM 广度的买方 | 和 Delinea 一样要回答「为什么选这个平台而非另一个平台」 |
| Microsoft | 套件竞品 | 既有资产中的身份、混合 IAM 和 Defender 工具 | 已经标准化使用 M365 和 Microsoft 安全产品的账户 | 专门的特权深度可能不如 Delinea 明确 |
| Okta / SailPoint / Saviynt | 套件竞品 | 治理牵引的身份平台 | 偏重治理的买方和转型项目 | 不那么围绕传统 PAM 深度 |
| StrongDM / Teleport / Silverfort / 1Password | 侧翼进入者 | 运行时访问、基础设施访问、无代理身份或 XAM | 工程或架构牵引的切入型交易 | 整体 PAM 深度或平台范围通常窄于 Delinea |
画像表把一些相邻玩家归在一起,因为它们争夺的是不同预算切片,即便并非一对一替代 Delinea。
[CP004, CP005, CP008, CP009, CP010, CP015]按权限深度和套件宽度两个维度,对 Delinea 与直接既有玩家、更宽套件和侧翼新进入者做序位比较。
坐标轴数值是基于公开定位页面和评测界面推导的 1-5 序位分,并非经审计的市场数据。
[CP004, CP005, CP008, CP009, CP016, CP011]3.2 竞品画像:谁赢哪类账户
最有用的竞品拆分,不是只看厂商 logo,而是看账户类型和买方框架。买方想要成熟、以保险库为先、具备企业传承的特权访问栈时,CyberArk 最强。买方想要同样宽的 PAM 平台,并信任其集成式定位时,BeyondTrust 参与竞争。买方现有合同里已经有足够的 Entra 和 Defender 能力时,Microsoft 最危险,尤其项目被定义为身份防护或混合访问,而不是专门 PAM。治理和生命周期控制主导讨论时,Okta、SailPoint 和 Saviynt 更重要。工程团队主导访问决策时,StrongDM 和 Teleport 最有分量;Silverfort 则用无代理架构叙事进攻。Delinea 最适合的买方,是仍然重视 PAM 深度,但越来越想要更宽身份安全平台,同时又不愿完全默认选择重捆绑套件的买方。[CP006, CP007, CP008, CP009, CP010, CP015]
| 购买标准 | Delinea | CyberArk | BeyondTrust | Microsoft | 运行时 / 无代理侧翼 |
|---|---|---|---|---|---|
| 传统 PAM 深度 | 强 | 很强 | 很强 | 中等 | 低至中等 |
| 更广的身份平台叙事 | 强 | 强 | 强 | 很强 | 因厂商而异 |
| 运行时授权 / 基础设施访问 | 借 StrongDM 改善中 | 中等 | 中等 | 低 | 强 |
| 套件优势 | 低 | 低 | 低 | 很强 | 中等 |
| 无代理或新架构角度 | 中等 | 低 | 低 | 低 | 部分侧翼厂商较强 |
| 治理 / 更广 IAM 邻接 | 中等 | 中等 | 中等 | 强 | 低至中等 |
矩阵是方向性判断,不是数值打分。它把 Delinea 介于平台加 PAM 之间的位置,同直接在位厂商、打包套件和更窄的侧翼进入者区分开来。
[CP006, CP007, CP008, CP025, CP026, CP035]热力图按最关乎 Delinea 的采购标准,区分以保管库为先的既有玩家、更宽套件和工程团队主导的侧翼产品。
[CP006, CP007, CP023, CP025, CP035]3.3 能力、分销与信任姿态
这个类别里,单靠能力不能决定赢家。分销和信任同样重要。Microsoft 拥有最强装机基础优势,因为许多目标客户已经运行 Entra 和 Defender for Identity。CrowdStrike、SentinelOne 等端点玩家也能借助既有平台关系嵌入身份控制,而不需要单独开辟一个全新采购动作。CyberArk 和 BeyondTrust 等直接老牌厂商受益于长期企业信任和分析师可见度。Delinea 仍然在顶层考虑名单中可见,评测和分析师表面材料可以证明这一点,但它的护城河并非不可撼动。买方需要的不只是捆绑套件,也需要比点工具更连贯的方案时,Delinea 会赢;客户能接受“足够好”的相邻能力,或偏好纯工程访问方案时,Delinea 会输。换句话说,Delinea 仍是可信的类别竞争者,但周围战场已经更异质、更受捆绑敏感度影响,也更依赖企业评估中演示、集成、策略迁移、实施节奏和渠道强度的执行质量。[CP020, CP021, CP022, CP023, CP024, CP031]
| 厂商组 | 打包方式 | 买方可能拿到什么 | 竞争含义 |
|---|---|---|---|
| Delinea | 按企业范围定制的平台化打包 | PAM 深度加更广的平台叙事 | 买方重视专用控制和平台一致性时最有效 |
| CyberArk / BeyondTrust | 企业平台合同 | 成熟 PAM 深度、服务和企业信任 | 当买方更看重在位厂商深度而非新平台定位时能赢 |
| Microsoft / Okta / SailPoint | 更广套件或捆绑经济性 | 覆盖既有技术栈的身份和治理能力 | 提高新增专项支出的门槛 |
| StrongDM / Teleport / Silverfort / 1Password | 用例或架构牵引的打包 | 围绕基础设施访问、无代理身份或员工访问的更锋利切入口 | 即便不能完整替代 Delinea,也能赢下入口 |
多数企业定价都靠谈判,公开信息不够干净,因此本表关注合同姿态和买方可能感知,而不是精确标价。
[CP028, CP023, CP027, CP016, CP017]面向承销判断的简版竞争摘要:Delinea 哪些位置明显站得住,哪些位置承压,还有哪些证据仍然缺失。
[CP020, CP034, CP002, CP028, CP036, CP037]3.4 切换成本、多栖部署与护城河耐久度
Delinea 竞争位置的耐久部分,不是单纯品牌,而是策略、特权账户发现、集成和治理流程嵌入后被替换的成本。这会形成有意义但并非牢不可破的切换成本。买方可以、也很可能会把 Delinea 与 Microsoft、端点 ITDR 或工程访问工具多栖部署;这意味着 Delinea 往往是在更大栈内作为一层控制参与竞争,而不是充当整个栈。这种模式利弊并存:它帮助 Delinea 共存,也意味着部分价值可能随着时间被捆绑平台挤压。公开来源尚未显示可靠的 win-rate 或定价证据,所以最稳妥结论是护城河耐久度中等。Delinea 最强防线,是在特权深度上明显强过捆绑方案,在身份安全平台价值上明显宽过点工具。迁移、伙伴赋能和客户扩张上的执行纪律可能也很关键。任一端失守,中间层就更容易被商品化。[CP028, CP029, CP030, CP033, CP034, CP035]
| 护城河或风险 | 重要性 | 威胁来源 | 严重度 | 尽调问题 |
|---|---|---|---|---|
| Delinea 仍是 PAM 顶级入围厂商 | 让它留在企业评估名单里 | 候选名单仍可能向 CyberArk 或套件收缩 | 中 | 衡量当前从入围到赢单的转化率 |
| 超越保险库的平台广度 | 可把 Delinea 和单点工具拉开 | 可能与 BeyondTrust 或套件叙事混在一起 | 中 | 验证买方是否愿意为更广叙事付费 |
| StrongDM 运行时延伸 | 增强工程牵引的访问场景 | 集成执行可能落后于承诺 | 中 | 跟踪产品集成里程碑和附加购买率 |
| Microsoft 的套件竞争 | 能压缩新增支出的必要性 | 既有装机基础的经济性很难对抗 | 高 | 量化因套件决定胜负的输单 |
| 运行时或无代理厂商的侧翼进入 | 能先拿下第一个工作流,压窄 Delinea 的切入口 | Delinea 尚未被充分评估,预算就已花掉 | 中 | 审查客户技术栈中的替代和共存模式 |
风险登记表把可持续的竞争强项,与会随时间压缩这些强项的结构性力量分开。
[CP020, CP026, CP002, CP034, CP035, CP037]04财务情况
4.1 收入模式、包装与变现姿态
Delinea 的公开商业表面,看起来像一个围绕多个可销售控制层构建的经常性企业软件模式,而不是单一的密码保险库产品。公司营销一个平台、打包套件,以及 Server Suite、Privileged Remote Access、Fastpath Access Control 和 AI 驱动授权等独立模块家族。这在财务上重要,因为它创造了几条可信的经常性收入增长路径:从核心 PAM 落地,增加相邻授权或治理模块,并在云、合规和机器身份需求扩张时扩展账户。公开页面不发布可用的标价,这强烈暗示 Delinea 仍主要通过询价驱动的企业合同、演示、试用、合作伙伴和议定范围销售。这对高端中型市场和企业网络安全很常见,但也意味着开放网页不足以推导 ASP 或折扣行为。因此,最好的公开结论是结构性的,而不是精确数字:Delinea 可能具备偏订阅的收入质量和交叉销售潜力,但实际定价仍是尽调事项,不是已经解决的公开事实。[CI001, CI002, CI003, CI004, CI005, CI006]
| 来源 | 机制 | 单位 | 当前状态 | 质量 | 尽调问题 |
|---|---|---|---|---|---|
| 平台订阅 / 捆绑包 | 以 Delinea Platform 或打包控制层出售的经常性订阅 | 签约年度或多年软件订阅 | 产品和捆绑范围已确认;无公开价格 | 若续约占比高则质量高;具体结构未披露 | 索取模块附加购买率和续约拆分 |
| 服务器 PAM 与特权访问模块 | 服务器特权、远程访问及配套控制的经常性订阅 | 按合同确定企业范围 | 已由 Server Suite 和 RPAM 产品页确认 | 经常性质量高;实际成交价格未知 | 索取按产品家族拆分的已签约 ARR |
| 治理 / 业务应用控制 | Fastpath 访问控制订阅和治理增购 | 按应用 / 企业范围 | 2024 年收购后已确认 | 中到高;集成进度很关键 | 索取 Fastpath ARR 和服务附加情况 |
| AI 驱动授权与平台附加模块 | 面向较新授权和分析能力的增购 | 平台附加订阅 | 新兴能力,已公开商品化 | 中;变现成熟度仍在形成 | 索取附加购买率、付费与包含式打包、以及销售管线 |
| 专业服务 / 实施 | 部署、集成、上线和客户赋能 | 项目制或限定范围服务 | 运营上可推断,但未量化 | 质量低于软件 ARR;规模未知 | 索取服务收入和服务毛利率 |
| 渠道来源签约额 | 通过经销商、GSI、MSP 和分销商成交或影响的签约额 | 合作伙伴牵引的企业合同 | 已确认是明确 GTM 路径 | 随折扣和激励而变化 | 索取渠道结构、MDF 支出和毛利影响 |
由于 Delinea 不公布价目表或收入结构,本表强调公开可见的变现机制,并把具体合同经济性留作尽调事项。
[CI001, CI002, CI003, CI004, CI005, CI006]| 产品 / 方案 | 公开价格 / 单位 | 标价与实际成交价 | 销售姿态 | 来源说明 |
|---|---|---|---|---|
| Delinea Platform / 捆绑包 | 无公开标价 | 实际成交价未知 | 以演示 / 联系销售牵引的企业级打包 | 捆绑包页面描述范围,但不披露商务条款 |
| Server Suite | 无公开标价 | 实际成交价未知 | 报价牵引的服务器 PAM 销售 | 产品页强调能力而非价格 |
| Privileged Remote Access | 无公开标价 | 实际成交价未知 | 报价牵引的访问产品 | 页面聚焦基于浏览器的安全访问和审计 |
| Fastpath Access Control | 无公开标价 | 实际成交价未知 | 报价牵引的治理销售 | 页面强调 SoD 和审计用例,但没有商务价目表 |
| 合作伙伴 / 分销商路径 | 利润率经济性未披露 | 折扣情况未知 | 合作伙伴和激励支持的销售 | 合作伙伴计划提到财务激励,但不公布比例 |
公开来源只能支持一个结论:Delinea 通过谈判型企业合同和合作伙伴渠道销售;这些来源不足以支撑实际 ASP 建模。
[CI007, CI008, CI010, CI035]公开证据显示,Delinea 的经常性收入可能从模块化身份安全产品,桥接到更宽平台订阅和扩张。
[CI001, CI002, CI009, CI029]4.2 GTM 动作与增长能力投入
Delinea 的披露指向一个增长引擎:直接企业销售与有分量的渠道和分销层混合。2024 年合作伙伴计划发布明确向经销商、GSI 和托管服务商提供分层奖励、财务激励、营销支持和赋能。2026 年 Climb 扩张又把这套渠道逻辑进一步带入欧洲,说明 Delinea 仍在投资地域扩张,而不是只收割既有客户。领导层变化也强化同一故事:Chris Kelly 被聘来统筹全球销售、渠道、解决方案工程和客户成功;2025 年业绩更新还强调在渠道、服务、客户成功和区域销售上继续招聘。公开披露的牵引力值得注意。Delinea 称 ARR 在 2024 年 Q2 超过 $350 million,在 2025 财年上半年超过 $400 million,且 SaaS 占 ARR 多数。这些是公司主张,而非经审计文件,但方向上强于第三方数据库里互相矛盾的数值。结论是,Delinea 看起来正在作为一家相当规模的经常性收入身份安全厂商扩张;但公开来源仍没有揭示 CAC、回本周期或带配额销售产能。[CI009, CI010, CI011, CI012, CI013, CI014]
| 指标 | 数值 / 状态 | 置信度 | 重要性 | 尽调问题 |
|---|---|---|---|---|
| ARR 里程碑 | 到 Q2 2024 超过 $350M;到 1H 2025 超过 $400M | 中 | 目前可得的最佳公开业务规模信号 | 索取经审计、按季度和产品家族拆分的 ARR 桥 |
| ARR 中 SaaS 占比 | ARR 大部分来自 SaaS(公司说法) | 中 | 指向经常性、偏云的收入质量 | 索取 SaaS 与自托管订阅拆分 |
| 毛利率 | 未披露;只能用上市同业做代理 | 低 | 核心盈利能力和估值驱动 | 索取经审计的毛利率桥,包含服务和托管 |
| CAC / 回本周期 | 未披露 | Unknown | 检验 GTM 扩张是否高效 | 索取全口径 CAC、回本周期和分客群生产率 |
| NRR / GRR | 未披露 | Unknown | 决定订阅基础韧性和扩张质量 | 索取队列留存和续约数据 |
| 服务毛利率 | 未披露 | Unknown | 区分软件经济性和实施负担 | 索取按交付模式拆分的服务收入、利用率和利润率 |
本表刻意把已披露的牵引力和未披露的单位经济分开。ARR 里程碑来自公司公开说法;其余需要管理层材料。
[CI014, CI015, CI016, CI017, CI032, CI038]仅凭公开信息,单位经济模型只能从已披露 ARR 里程碑,桥接到大多未披露的留存、CAC 和利润率机制。
[CI014, CI015, CI016, CI026, CI038]公开证据只能把少数财务相关数字放进可辩护区间。
只有 ARR 里程碑区间是公司特定数据。利润率和经常性收入占比是用于限定尽调边界的代理区间,并非管理层报告的 Delinea 指标。
[CI014, CI015, CI016, CI023, CI027]4.3 成本结构、利润率路径与资本配置
Delinea 不发布经审计成本结构,因此公开视角只能从自身运营足迹和成熟身份软件同业倒推。Delinea 的云交付足迹包括 Secret Server Cloud 的英国数据中心等区域托管,这意味着持续的基础设施、合规和支持开支。公开 GTM 扩建和收购节奏,也意味着销售产能、服务和集成工作仍在消耗资金。SecurityWeek 对 2024 年 4 月 Secret Server 事件的报道同样具有财务相关性:即便最终没有确认租户受损,事件响应、修补、客户沟通和信任修复也都是真实成本中心。CyberArk 的 SEC 文件提供了最清晰的公开基准,说明成熟身份安全 SaaS 经济模型通常长什么样。CyberArk 称超过 90% 收入为经常性收入,订阅收入已成为主要驱动,订阅收入成本由支持人员、云运营、基础设施和摊销驱动。它也提醒,订阅转型可以改善长期耐久性,同时仍会改变现金时点和近期盈利能力。这个基准不能证明 Delinea 的准确毛利率,但支持一个合理区间:经常性软件质量较高,同时云、服务和支持仍然实质影响经济模型。[CI019, CI020, CI021, CI022, CI023, CI024]
| 项目 | 公开状态 | 影响 | 置信度 | 尽调事项 |
|---|---|---|---|---|
| 发起人支持 | 从公开股权历史看得到私募股权发起人背景 | 可能有战略支持,但经济条款不透明 | 中 | 要求提供股权结构、董事会支持和资本配置优先级 |
| 现金余额 | 未公开披露 | 无法直接建模现金跑道 | 低 | 要求提供最新资产负债表和不受限现金 |
| 债务 / 杠杆 | 未公开披露 | 潜在契约或再融资风险未知 | 低 | 要求提供债务明细、到期安排和契约包 |
| 资本用途 | 可见用途包括收购、渠道扩张、云足迹和增长招聘 | 资本同时投向内生和外延扩张 | 中 | 要求按研发、销售与营销、云运营和并购整合拆分年度预算 |
| 下一轮融资触发点 | 未披露公开事件或时间表 | 外部投资者无法判断何时需要新的资本决策 | 低 | 要求提供现金跑道模型和发起人决策框架 |
本章有意不重复公司概况里的完整融资时间线。重点放在当前资本充足性和不透明度,而不是历史轮次。
[CI031, CI019, CI037, CI032]公开证据指向几类可见资金用途,但没有披露支撑这些用途的现金余额。
[CI031, CI019, CI037, CI032]4.4 资本充足性与投资判断阻断点
最难处理的公开限制,不是增长可见度,而是融资可见度。Delinea 的所有权历史清晰指向资方支持;相较一家急着寻找新一轮融资的风投支持公司,这大概率降低了即时外部融资风险。但同一种所有权结构也意味着公开现金、债务、契约和 runway 披露基本缺席。第三方数据库增加的是噪音而非清晰度,因为它们在融资、估值、创立历史和员工足迹上互相冲突。因此,最强公开事实是里程碑事实:2021 年合并期前收入已超过 $100 million,ARR 到 2024 年 Q2 超过 $350 million,到 2025 年上半年超过 $400 million,管理层继续为收购、渠道扩张和云交付投入资金。最可辩护的判断是,Delinea 可能拥有有吸引力的经常性收入质量和有意义规模;但在投资人能干净判断利润率路径或资本强度前,仍需要直接看到留存、CAC、毛利率桥、债务期限表和 runway 规划。单靠公开证据支持动能,不支持精确。[CI031, CI032, CI033, CI034, CI038]
| 缺失指标 | 影响 | 重要性 | 具体尽调路径 |
|---|---|---|---|
| 经审计的 ARR 与收入桥表 | 阻断性 | 需要用它把公司里程碑与外部数据库对齐,并锚定估值工作 | 要求按产品、地区和部署模式提供季度 ARR / 收入桥表 |
| NRR、GRR 和续约率 | 阻断性 | 没有留存质量,仅看 ARR 规模可能高估底层健康度 | 要求提供队列留存表和分客群续约情况 |
| 毛利率桥表 | 重大 | 公开利润率表述只有定性信息 | 要求提供订阅、服务和支持的经审计毛利率明细 |
| 现金、债务和现金跑道 | 阻断性 | 仅凭发起人持股无法建模资本充足性 | 要求提供最新资产负债表、债务明细和经营现金预测 |
| CAC、回本周期和销售效率 | 重大 | 增长投入可能有效,也可能昂贵;公开证据无法判断 | 要求按客群提供管线转化、CAC、回本周期和配额达成情况 |
| 服务收入和利润率 | 重大 | 实施负担可能扭曲软件经济性和部署可扩展性 | 要求按产品线提供服务损益、利用率和附加率 |
仅凭公开信息承销 Delinea 这家非上市身份安全软件公司时,这些是主要阻断项。
[CI008, CI030, CI032, CI033, CI038]05产品与技术
5.1 产品定义与核心模块地图
Delinea 已不再把自己呈现为单一的特权密码保险库厂商。它的公开产品表面已经很明确:平台加模块。身份威胁防护、机密发现与保险库、会话管理、服务器权限、端点权限、治理控制、远程访问和 AI 驱动授权,都被放在同一个商业框架内。产品价值主张围绕发现身份和特权账户、施加最小权限、监控活动,并横跨云和传统基础设施响应威胁。模块层面,页面相当具体。Identity Threat Protection 聚焦持续监控、上下文构建、异常检测和响应。Secret Server 材料强调发现、依赖映射和保险库访问。Privilege Control for Servers 与 Privilege Manager 把控制延伸到操作系统权限和端点应用。结果是,一张可信的模块地图,适合既想要传统 PAM 深度、又需要较新身份安全覆盖的客户。仍不够公开的是这些模块之间的准确商业边界:页面展示了有什么,但没有展示哪些是标准配置、哪些是附加模块,或在控制平面层面整合得有多深。[CE001, CE002, CE003, CE004, CE005, CE006]
| 模块 / 资产 | 主要用户 | 状态 / 成熟度 | 差异化 | 尽调缺口 |
|---|---|---|---|---|
| Identity Threat Protection | 安全运营 / 身份团队 | 公开营销 | 持续身份监控,加上修复指引 | 需要真实部署引用和误报数据 |
| Secret Server Discovery | PAM 管理员 | 公开文档化 | 特权账户和依赖发现,带可脚本化扩展 | 需要扫描规模和性能的架构细节 |
| Secret Server Session Management | PAM 管理员 / 审计员 | 公开文档化 | RDP 和 SSH 代理,支持录制、监控和回放 | 需要大规模场景下的存储、留存和性能细节 |
| Privilege Control for Servers 产品 | 服务器 / 平台管理员 | 公开营销 | 覆盖 Windows、Linux 和 Unix 的最小权限 | 需要混合云环境的部署细节 |
| Privilege Manager | 终端 / EUC 管理员 | 公开文档化 | 终端最小权限、集成、公开 API、HA 模式 | 需要客户证据说明上线阻力和策略调优 |
| FedRAMP High Secret Server 路径 | 公共部门买家 | 进行中,尚未授权 | 释放公共部门野心和控制强化信号 | 需要授权里程碑状态和范围 |
这里的成熟度指“有公开证据并被公开营销”,不是经独立审计的采用深度。
[CE002, CE003, CE006, CE010, CE005, CE027]| 用户任务 | 当前工作流挑战 | Delinea 方案 | 可衡量收益 | 局限 |
|---|---|---|---|---|
| 发现未知特权账户 | 盲区以及未纳管的管理员 / 服务账户 | Secret Server Discovery 和持续发现 | 账户可见性和策略覆盖更好 | 规模和连接器深度未完全公开 |
| 监控高风险特权会话 | 管理员和供应商可在监督有限的情况下操作 | 会话代理、监控、录制和回放 | 问责更强,审计复核更快 | 性能和存储经济性未披露 |
| 在服务器上强制最小权限 | 常驻管理员权限会提高横向移动风险 | Privilege Control for Servers 和 Server PAM 控制 | 减少常驻权限,策略一致性更好 | 各环境的具体部署工作量不清楚 |
| 简化终端审批 | 服务台和安全团队难处理应用提权例外 | Privilege Manager,带工单和目录集成 | 审批更快,手工策略漂移更少 | 各项集成的支持深度未完全公开 |
| 把密钥接入 CI/CD | 密钥泄露进代码库或流水线配置 | Python SDK、Terraform 提供程序、GitHub Action 和 DSV 工具 | 密钥获取和 IaC 工作流更容易自动化 | 核心产品仍为专有;仓库采用细节有限 |
这些收益是方向性、基于工作流的判断,因为公开页面描述能力比描述结果指标更精确。
[CE007, CE011, CE005, CE015, CE037, CE040]Delinea 身份安全平台的公开技术栈,从发现和控制层延伸到信任与自动化界面。
[CE002, CE003, CE018, CE037, CE022, CE025]5.2 工作流、自动化与集成架构
阅读 Delinea 技术时,最有用的方法是把它看作运营工作流,而不是营销功能清单。发现层找到特权账户、服务账户和云身份;策略与最小权限层限制这些身份能做什么;会话控制代理、监控并记录高风险活动;集成把 Delinea 接入目录服务、工单、SIEM、恶意软件扫描和其他企业系统;自动化钩子让从业者在脚本和基础设施流水线中把这些控制落地。技术文档页面在这些工作流结果上很强。Secret Server 文档说明多云发现和可脚本化 PowerShell 扩展。会话管理页面说明 RDP 与 SSH 代理、实时干预和可搜索录制。Privilege Manager 文档说明与 Active Directory、ServiceNow、Secret Server、VirusTotal、SIEM 和 SCCM 的集成;企业就绪材料又加入公开 API、高可用、反向代理和移动管理。不过,架构仍没到真正深潜层级。公开材料足以理解工作流和依赖形态,但不足以精确绘制内部服务、事件总线或数据平面边界。[CE008, CE009, CE010, CE011, CE012, CE013]
| 层 / 组件 | 作用 | 依赖 | 风险 |
|---|---|---|---|
| 发现连接器和脚本 | 发现特权账户和依赖 | AD、云提供商、PowerShell、扫描器 | 连接器深度和扩展细节只有部分公开 |
| 保管库和会话控制层 | 代理访问、录制会话并管理凭据 | Secret Server、网络 / 防火墙规则、录像存储 | 会话存储、代理规模和留存成本缺少深入公开信息 |
| 终端 / 服务器策略层 | 应用最小权限和应用控制 | AD、终端代理、反向代理、高可用 Web 层 | 代理行为和失败模式缺少深入文档 |
| 集成和 API 层 | 连接工单、SIEM、恶意软件分析和工作流自动化 | ServiceNow、VirusTotal、Syslog、SDK、API 集成 | 有命名集成,不等于实施深度已完全摸清 |
| 云平台运营 | 交付多租户 SaaS,并承诺区域可用性 | 区域托管足迹和状态页 | 内部服务拓扑和租户隔离细节公开信息仍薄 |
这是基于公开证据的运营模型,不是内部工程图。
[CE008, CE019, CE018, CE041, CE042]公开文档记录了从发现到执行与审计的操作员工作流。
[CE006, CE007, CE010, CE012, CE003, CE040]公开材料显示,Delinea 对目录、云服务、工单和自动化接口有实质依赖。
[CE014, CE015, CE017, CE033, CE034, CE041]5.3 信任、可靠性与合规姿态
Delinea 的公开信任姿态强于其公开架构深度。平台 SLA 明确把 Delinea Platform 描述为多租户 SaaS 服务,并承诺在提供服务的区域内达到 99.995% 可用性。同一文件列出服务抵免补救,并引用公开状态页面,这与成熟 SaaS 运营模式一致。认证方面,Delinea 称六款产品已通过 SOC 2 Type 2 再认证,Secret Server 已进入面向公共部门的 FedRAMP High 授权流程。这些信号在商业上重要,因为它们往往是企业安全采购的一部分,但仍是摘要级信号,不等于完整审计透明度。对抗性视角也真实存在:SecurityWeek 报道了 2024 年 4 月事件,NVD 则列出针对 Secret Server SOAP API 的 CVE-2024-33891。合在一起,这些来源显示 Delinea 有有意义的信任基础设施和可见披露表面,但并不意味着没有风险。尽调上,Delinea 在合规姿态上看起来可信,同时仍需要更深入审查事件后补救、控制例外和认证范围。[CE022, CE023, CE024, CE025, CE026, CE027]
| 控制 / 认证 | 状态 | 范围 | 缺口 |
|---|---|---|---|
| 平台 SLA | 公开文档化 | 所提供区域承诺 99.995% 可用性 | 需要客户级可用性历史和补救结果 |
| SOC 2 Type 2 重新认证 | 公开声称 | 点名六款 Delinea 产品 | 底层审计报告未公开 |
| FedRAMP High 流程 | 公开宣布 | 与 UberEther 合作推进 Secret Server | 授权进行中,尚未完成 |
| 安全公告界面 | 公开可见 | 信任和漏洞沟通 | 公告流程深度和 SLA 未完全公开 |
| CVE-2024-33891 修复 | 公开证实 | Secret Server SOAP API 认证绕过问题 | 需要完整事后复盘和控制变更历史 |
本表把可见信任信号与仍属私有的审计、修复深度分开。
[CE022, CE025, CE027, CE029, CE030, CE043]在主要公开界面中,Delinea 发布详细功能和操作员工作流文档的地方,能力成熟度最强。
这些评级是基于公开文档深度做出的证据序位判断,不是内部产品遥测。
[CE003, CE008, CE012, CE018, CE042, CE043]5.4 开发者信号、成熟度与技术风险
Delinea 公开证据中较积极的意外之一,是它在 GitHub 暴露了不少面向从业者的工具。那些代码仓库不是核心产品,但确实显示平台周边有真实自动化层:公开平台示例代码仓库、面向 Secret Server 和 Platform API 的 Python SDK、DevOps Secrets Vault 的 Terraform provider、用于 CI/CD 获取的 GitHub Action,以及可导出 Terraform、Ansible 和防火墙格式的 network-requirements CLI。对一家商业产品为专有软件的安全厂商来说,这是有意义的开发者信号,因为它缩小了“我们有 API”和“从业者真的能自动化它”之间的可信度缺口。它也支持一个判断:Delinea 的技术差异化不只在保险库,还在把身份控制运营化到工作流和环境中。权衡点是,代码仓库和功能页面更清楚地呈现平台外部接口,而不是内部架构。公开成熟度看起来扎实;公开内部仍然选择性不透明。[CE032, CE033, CE034, CE035, CE036, CE037]
| 信号 | 日期 / 阶段 | 状态 | 影响 | 来源 |
|---|---|---|---|---|
| 公开 GitHub 平台资源 | 持续维护的公开仓库 | 活跃的公开工具界面 | 显示围绕平台的从业者赋能 | GitHub Delinea 平台仓库 |
| Secret Server / Platform API 的 Python SDK | 公开仓库 | 可安装和测试 | 支持 API 自动化,而非只靠 UI 采用 | GitHub 仓库:python-tss-sdk |
| DSV 的 Terraform 提供程序 | 公开仓库 | 可用 | 支持基础设施即代码工作流 | GitHub 仓库:terraform-provider-dsv |
| DSV 的 GitHub Action | 公开仓库 | 可用 | 支持 CI/CD 密钥获取 | GitHub 仓库:dsv-github-action |
| 网络要求 CLI | 公开仓库 | 可用 | 显示围绕部署和连接性的持续运营工具 | GitHub 仓库:delinea-netconfig |
这些信号更适合解读为开发者信号和运营工具证据,而不是完整正式路线图。
[CE032, CE033, CE034, CE035, CE036, CE037]06客户情况
6.1 客户足迹与细分可见度
Delinea 的公开客户证据远强于一面简单标识墙,但仍受公司选择展示内容影响。最强模式是细分质量,而不是精确队列数学。公开案例研究和客户材料反复把 Delinea 放进特权访问、可审计性和合规是重要运营问题的环境:Robert Weed 的制造业 IT 运营,Boyner 的零售和第三方访问控制,The Trade Desk 的 Oracle Cloud SOX 控制,TEPCO Systems 的 J-SOX 与关键基础设施,以及 SBA Communications 的上市公司 SOX 报告。更宽的案例库还把这幅图延伸到电信、出行、媒体、旅游、渠道和住房。这个组合说明 Delinea 在特权访问控制与业务连续性、审计防御或受监管运营绑定的场景中取胜,而不是只服务于寻找基础密码保险库的买方。因此,开放网页支持一个多元化企业和高端中型市场足迹,但尚不足以支持 SMB、中型市场和企业收入之间的精确结构。Delinea 已过时的公开数量——超过 8,500 家机构——为装机基础规模给出下限;但缺少更新数量意味着客户章节必须更关注证据质量和细分模式,而不是当前原始账户量。[CU008, CU009, CU010, CU011, CU035, CU038]
| 客群 | 买方 / 用户 / 付款方 | 代表性证据 | 规模 / 运营背景 | 战略价值 | 缺口 |
|---|---|---|---|---|---|
| 制造运营 | IT / 安全运营 / 管理员 / 工业业务负责人 | Robert Weed 用 Secret Server 管理系统、工作站和第三方访问 | 家族所有的分销商 / 制造商,接近 200 个系统和 100+ 台工作站 | 显示 Delinea 适配中端市场运营环境,特权访问与业务连续性绑定 | 未披露合同规模、续约期限或模块附加销售 |
| 零售和消费运营 | CISO / 安全团队 / 企业运营预算 | Boyner 使用 Secret Server 加 Privileged Remote Access | 6 个品牌、250+ 家门店、8,000+ 名员工,存在第三方访问和合规要求 | 验证受监管零售和第三方远程访问工作流 | 未披露 ACV、上线周期或续约历史 |
| 技术和财务控制团队 | SOX / 合规负责人 / 财务用户 / 企业 IT 预算 | The Trade Desk 围绕 Oracle Cloud ERP 使用 Fastpath | 三个地区共有 1,200 名全球用户和 100+ 名财务用户 | 显示 Delinea 可从 PAM 交叉销售到财务合规控制 | 公开证据强在审计工作流,商业条款偏薄 |
| 关键基础设施和公用事业 | 安全领导 / 运营管理员 / 企业安全预算 | TEPCO Systems 用 Secret Server 支撑 J-SOX 和零信任 | 支持关键基础设施的电力集团系统集成商 | 支持可追溯性重要的任务关键、受监管用例 | 未披露长期扩张经济性 |
| 上市公司电信 / 基础设施 | CIO / 审计员 / IT 管理员 / 上市公司合规预算 | SBA Communications 使用 Fastpath 做 SOX 报告 | 公开运营商,拥有多个法律实体和 Dynamics GP 复杂性 | 对需要持续控制报告、审计负担重的买家有证明价值 | 没有证据说明客户集中度或类似账户复制率 |
| 更广泛的企业案例库 | 跨行业的安全、审计和运营买家 | Graebel、Hearst、Norwegian Cruise Line Holdings、Softcat、Clayton Homes 等出现在公开案例库中 | 官方资源里可见搬迁、媒体、旅游、渠道和住房等垂直行业 | 暗示 Delinea 的客户引用集合覆盖多个垂直行业,而非单一细分 | 案例库广度可见,但许多条目若不看完整 PDF,结果深度不足 |
客群映射锚定具名案例研究和公开客户项目材料,而不是公司披露的分层表。公开证据偏向可引用的企业和合规密集型样本;真实 SMB / 中端市场组合仍未披露。
[CU010, CU011, CU012, CU016, CU020, CU022]| 信号 | 数值 / 状态 | 截至 | 置信度 | 影响 | 缺失分母 |
|---|---|---|---|---|---|
| 官方披露的客户下限 | 全球 8,500+ 家组织 | 2025-01-13(披露引用 Q2 2024) | 中 | 显示有意义的装机基础规模,但只是带日期的下限,不是当前实时客户数 | 没有更新的当前客户数或活跃租户数 |
| 大企业渗透信号 | Fortune 100 超过半数 | 2022-02-01 | 中 | 支持其企业触达真实存在,不只是 SMB 定位 | 没有当前具名名单或客群收入组合 |
| 客户旅程流程 | 购买前、上线、使用、扩展、续约各阶段有公开文档 | 2026-05-20 | 高 | 暗示 Delinea 有刻意设计的生命周期管理,不是临时拼凑的售后支持 | 没有按阶段拆分的转化率或续约率 |
| 续约触达时间 | 续约前最多 120 天 | 2026-05-20 | 高 | 可见正式续约动作的证据 | 没有公开续约率指标 |
| 社区和赋能界面 | Secret Society、答疑时段、通讯、路线图更新 | 2026-05-20 | 高 | 支持持续客户互动和扩张脚手架 | 参与率和队列效果未披露 |
| 旗舰客户活动 | Delinea Edge 宣布将于 March 2027 举办 | 2026-04-14 | 高 | 释放继续投资客户教育和从业者社区的信号 | 未披露参会目标和客户组合 |
| 客户成功领导层投入 | 新增客户成功与全球服务 VP | 2025-08-12 | 中 | 说明 Delinea 扩张时,客户留存和赋能仍是持续投入重点 | 没有披露与这些招聘绑定的留存 KPI |
Delinea 没有发布干净的客户新增、流失或部署增长时间序列,因此本表把带日期的数量披露和流程信号放在一起。最精确的公开客户数证据仍是历史披露。
[CU001, CU004, CU005, CU006, CU007, CU008]公开文档记录了客户从评估到续约和同行互动的路径。
[CU001, CU002, CU003, CU004, CU005]6.2 具名生产证明与可衡量客户结果
Delinea 公开客户记录中最好的部分,是若干参考案例超出泛泛推荐语,描述了带可衡量结果的真实工作流。Robert Weed 在近 200 个系统和超过 100 台工作站上使用 Secret Server,客户估计现在查找和管理凭据所需工作量约为过去的十分之一。Boyner 展示了更宽的平台故事:在 Delinea Platform 上使用 Secret Server 加 Privileged Remote Access,并声称特权账户管理时间和成本降低超过 40%,合规支持工作量减少 60%。The Trade Desk 证明了完全不同的买方动作:Fastpath 作为 Oracle Cloud ERP 内 SOX、职责分离和变更追踪的控制层。TEPCO Systems 和 SBA Communications 从另一个角度强化同一模式。在这两种情况下,Delinea 的价值主张都不是抽象网络安全品牌,而是让任务关键环境中的审计、可追踪性和特权控制更可管理。这是强采用证据,因为它显示 Delinea 已部署在与财务、公用事业、远程访问和治理绑定的生产工作流中,而不仅是实验室演示或愿景式路线图语言。[CU012, CU013, CU014, CU015, CU016, CU017]
| 客户 | 细分市场 | 部署 / 用例 | 生产环境 / 试点 | 成效 / 证据 | 局限 |
|---|---|---|---|---|---|
| Robert Weed | 制造业 | 用 Secret Server 管理跨系统、工作站和第三方访问的特权凭据 | 生产环境 | 近 200 个系统、100+ 台工作站,密码管理工作量估计减少 90% | 未披露商业条款、续约状态或更广模块使用情况 |
| Boyner | 零售 | 在 Delinea Platform 上使用 Secret Server 和 Privileged Remote Access,覆盖账户安全和第三方访问 | 生产环境 | 特权账户管理时间 / 成本减少 40%+,合规支持工作量降低 60% | 公司发布的案例研究;未披露 ACV 或部署时间线 |
| The Trade Desk | 科技 / 财务控制 | Fastpath 用于 Oracle Cloud ERP 中的 SoD 和变更跟踪 | 生产环境 | 覆盖全球 1,200+ 名用户,并为审计师报告提供价值 | 未披露合同规模、续约数据或多产品范围 |
| TEPCO Systems | 公用事业 / 关键基础设施 | Secret Server 用于零信任特权控制和 J-SOX 合规 | 生产环境 | 特权 ID 管理工作量降低 40%,每次审计节省 48 小时 | 运营深度强,但对 Delinea 的收入意义未披露 |
| SBA Communications | 无线基础设施 / 上市公司 | Fastpath 用于 SOX 报告、SoD 分析和 Dynamics GP 变更跟踪 | 生产环境 | 报告从以天 / 周计缩短到以小时计,并嵌入日常流程 | 未披露席位数、支出或续约质量 |
各行来自本章审阅过、公开可见性最强的案例研究。覆盖面有限,因为 Delinea 未披露总安装客户基数,只有部分参考客户公布了可用细节。
[CU010, CU012, CU013, CU015, CU017, CU018]公开客户案例如何从一个控制问题,推进到可衡量的运营价值。
[CU013, CU017, CU021, CU023, CU025, CU036]Delinea 发布详细案例研究,同时给出部署背景和具体结果时,公开证据质量最强。
这些判断看的是公开记录的证据质量,不是客户健康度指标本身。Delinea 不披露具名客户的 cohort 或续约数据,留存可见度仍然偏低。
[CU012, CU015, CU019, CU022, CU024, CU033]6.3 耐久度、扩张与公开评测信号
Delinea 的公开耐久性证据真实但不完整。正面看,公司不像一个初次销售后就消失的厂商:客户页面描述了入职资源、专属技术和客户成功角色、社区计划、路线图沟通,以及可在合同结束前 120 天启动的续约互动。新宣布的 Delinea Edge 大会,把同一模式延伸到客户教育和同伴学习表面。公开评论也在较窄意义上支持耐久性。PeerSpot 和 TrustRadius 反复提到 Secret Server 在安全保险库、密码轮换、访问审批、审计轨迹和运营控制上有价值。这些核心工作流收益,一旦部署,往往会深嵌进 IT 和安全运营。但同一批评论也解释了为什么留存和扩张不能盲目假设。设置、报告、集成、API 灵活性、定价和 UX 问题出现得足够频繁,值得重视。结果是一幅图景:厂商在核心 PAM 工作流中具备可信粘性,但仍暴露于部署摩擦,可能拖慢更广推出,或在复杂环境中制造买方挫败。没有公开 NRR、GRR 或流失数据时,这些定性信号在方向上有帮助,但不能盖棺定论。[CU001, CU002, CU003, CU004, CU005, CU006]
| 指标 / 信号 | 数值 | 细分 / 范围 | 置信度 | 解读 | 尽调待核查项 |
|---|---|---|---|---|---|
| 净留存率(NRR) | 全公司 | 低 | 未公开披露 | 索取 2024、2025 和 2026 年初至今按产品与细分市场拆分的 NRR | |
| 总留存率(GRR)/ logo 流失 | 全公司 | 低 | 未公开披露 | 索取按队列拆分的总留存率和 logo 流失 | |
| 续约管理流程 | 可见;续约前 120 天可开始触达 | 现有客户 | 高 | 说明续约动作有规划,但结果未披露 | 索取续约率转化和挽留率指标 |
| 客户成功和赋能触点 | 可见;支持岗位、社区、答疑时段、新闻简报、路线图更新、客户大会 | 售后生命周期 | 高 | 正面的流程性留存信号 | 索取与续约和扩张挂钩的使用及参与数据 |
| 评价平台满意度 | 偏正面但不均衡;凭据保管 / 可审计性强,部署、报告和集成较弱 | Secret Server 用户评价 | 中 | 说明核心粘性存在,但部署摩擦不小 | 索取顺利和困难部署场景的客户访谈 |
| 合同期限 / 队列耐久性 | 按细分市场 | 低 | 没有公开合同期限或队列数据 | 索取平均期限、续约节奏和早期流失模式 |
公开记录给出流程和评价信号,但没有实际留存经济性。空值单元格是有意保留,应在管理层尽调中补齐,而不是用 SaaS 均值猜测。
[CU004, CU005, CU006, CU032, CU033, CU030]公开客户证据在生命周期流程和具名证明上最强,但在可持续性的量化披露上最弱。
1-5 的序数可见度评分基于公开披露质量;5 代表公开证据扎实,1 代表几乎没有量化披露。这衡量的是披露质量,不是健康度评分。
[CU032, CU033, CU034, CU036]6.4 客户风险与剩余投资判断缺口
客户章节仍留下三个未解决的投资判断缺口。第一,集中度不透明。公开具名参考证明 Delinea 能赢下并留住严肃客户,但没有揭示收入是广泛分散,还是集中在少数大型企业账户。第二,可见客户基础很可能比公司总账户数更偏企业和合规密集,这意味着公开证明可能过度代表高价值参考客户。第三,客户信任风险不再只是理论风险。2024 年 Secret Server 披露争议和 CVE 不能证明广泛流失,但正是安全买方、审计人员和采购团队会在续约时审视的厂商响应问题。合在一起,公开记录支持 Delinea 确有生产采用和有意义的客户成功基础设施;但在留存质量、集中度风险,以及扩张收入与替换收入的准确组合上,还不能给出干净结论。投资人应把客户故事视为使用证明上实质正面,但耐久经济性上仍不完整。[CU034, CU035, CU037]
| 驱动因素 / 风险 | 公开信号 | 影响 | 当前判断 | 尽调路径 |
|---|---|---|---|---|
| 凭相邻模块先落地再扩张 | 案例研究显示,客户可从 Secret Server 扩展到 PRA 和 Fastpath 用例 | ACV 更高,工作流锁定更深 | 正面但未量化 | 索取按队列拆分的模块附加率和扩张 ARR |
| 客户成功运营投入 | 客户成功、全球服务、社区、新闻简报和客户大会等触点可见 | 可支撑续约和更广部署 | 正面的流程信号 | 索取这些项目对应的留存影响和增购转化 |
| 企业 / 受监管客户偏重 | 具名公开证据明显偏向企业和合规要求重的买家 | 可抬高 ACV,但可能高估更广客户基数的质量 | 有意义的解读风险 | 索取按 ACV、员工规模和垂直行业拆分的客户结构 |
| 头部客户集中度 | 没有公开集中度披露 | 可能放大续约或采购冲击 | 未知 / 未解决 | 索取前 10 大客户 ARR 占比和续约日历 |
| 客户信任 / 安全响应风险 | 2024 年 Secret Server 披露争议和 CVE 仍在公开网络可见 | 可能拖慢采购,或压制风险敏感型买家的续约 | 真实存在但未量化 | 索取流失分析、续约异议和事件复盘后的客户沟通 |
| 价格和实施敏感性 | 评论网站提到定价、集成、部署和 UX 摩擦 | 可能限制铺开速度,或压缩预算敏感账户的交易规模 | 中等风险 | 索取竞争丢单原因和价值兑现时间分布 |
公开案例研究让扩张故事可信,但集中度和留存经济性仍未解决。本表把可见的正面驱动和明确尽调缺口放在一起,而不是强行给出没有支撑的精确度。
[CU036, CU007, CU035, CU034, CU037, CU031]07风险
7.1 监管、隐私与合同风险
Delinea 的公开法律和隐私表面显示的是真实合规负担,而不是泛泛网络安全套话。隐私政策称,公司在营销、活动、客户支持、社区论坛、计费和云服务交付中处理个人信息,并明确引用 GDPR、CCPA、国际传输以及受 DPA 约束的处理者角色。California 和 EU 指引进一步抬高风险:CCPA 创设删除、更正、选择退出和某些数据泄露责任权利,EU 数据保护指引则强调有约束力的 GDPR 义务和跨境传输保障。Delinea 的公开合同同样与风险实质相关。使用条款选择 California 作为管辖地,并对网站相关材料广泛排除保证和间接损害。MSLA 在运营上更重要:年度预付、自动续约、用量报告、审计权和渠道伙伴采购机制,都可能在续约、计费和争议中制造摩擦。这些并不证明 Delinea 遭遇过重大执法或诉讼,但证明公司处在有意义的隐私与合同风险包络内。正确的投资判断结论不是 Delinea 有已知法律问题;而是法律和监管义务可见,实际执法历史披露仍不完整。[CR001, CR002, CR003, CR004, CR005, CR006]
| 规则 / 框架 / 义务 | 管辖区 | 当前状态 | 发生可能性 | 严重性 | 缓释措施 | 剩余风险 | 尽调路径 |
|---|---|---|---|---|---|---|---|
| GDPR 和国际传输义务 | EU / EEA | 在 Delinea 处理 EU 个人数据或进行跨境传输时适用 | 中 | 高 | 隐私政策、DPA、SCC/BCR 指引背景、处理者角色 | 中 | 索取传输影响评估、子处理方清单和 EU 投诉历史 |
| CCPA / CPRA 消费者隐私义务 | 加利福尼亚 | 在 Delinea 达到业务门槛并处理加州个人信息时适用 | 中 | 高 | 隐私通知、消费者权利处理、处理者定位 | 中 | 索取 DSAR 指标、消费者投诉和泄露响应预案 |
| FedRAMP High 授权缺口 | 美国联邦 | 处于 Under Assessment,公开信息未显示已完全授权 | 中 | 中-高 | 与 UberEther 合作,并持续接受 3PAO 评估 | 中 | 索取完整授权时间线、阻碍因素和联邦销售管线依赖 |
| 客户合同、续约和使用审计义务 | 合同 / 全球 | MSLA 要求年度预付、使用报告和审计权 | 中 | 中 | 标准化合同框架和订单文件覆盖条款 | 中 | 审查谈判偏离、争议历史和按细分市场拆分的续约摩擦 |
| 保证与责任限制立场 | 合同 / 加州管辖地 | 条款和网站材料在法律允许范围内排除广泛保证和损害赔偿 | 低-中 | 中 | 标准供应商风险分配语言 | 中 | 审查企业 MSA 例外条款、赔偿义务和网络责任上限 |
| 隐私执法 / 诉讼历史 | 未知 / 多管辖区 | 审阅来源未发现明确公开行动 | Unknown | 如存在则中-高 | 审阅的公开记录中没有可见证据 | Unknown | 索取诉讼、执法和投诉清单 |
覆盖面有限,因为公开记录没有显示诉讼历史、监管机构往来或所有客户专属合同承诺。
[CR003, CR004, CR005, CR006, CR007, CR008]最高的剩余风险集中在安全流程质量、云可用性依赖,以及信息不透明下的执行。
序数评级反映本章审阅的公开证据;拿到事件、续约和整合进展的内部尽调数据后,应重新校准。
[CR021, CR025, CR003, CR027, CR034, CR037]7.2 运营、安全与可用性风险
从运营上看,Delinea 自己的表面展示出比营销姿态更细腻的图景。DPA、信任中心和状态中心合在一起显示成熟控制栈,也显示业务暴露于现代身份安全 SaaS 的标准失效模式。DPA 列明多租户、年度评估、第三方渗透测试、共同责任,以及大量使用 AWS 和 Azure。这些都是真实缓释项。但信任中心也列出多个近期 Cloud Suite 和 Privileged Access Service 漏洞,包括一个 2026 年 CVSS 9.3 的 SQL 注入问题,并提醒本地部署客户,主机级入侵可能暴露应用数据和加密密钥。独立报道和 NVD 保留了 2024 年 Secret Server 披露争议的记忆;这很重要,因为在安全软件中,厂商响应质量本就是产品承诺的一部分。状态中心证明可用性侧也真实存在:紧急证书轮换、与云服务商故障相关的 EU 区域密钥启动失败,以及与上游网络服务商中断相关的 US 登录超时,都发生在 2026 年 5 月。Delinea 有有意义的缓释措施——区域托管、可用性承诺、信任中心通知和正式维护沟通——但开放网页记录仍支持把安全流程和可用性风险列为顶层剩余敞口。[CR011, CR012, CR013, CR014, CR016, CR017]
| 失效模式 | 发生可能性 | 严重性 | 缓释成熟度 | 剩余风险 | 未解决缺口 |
|---|---|---|---|---|---|
| Cloud Suite / PAS / Secret Server 持续披露产品漏洞 | 中 | 高 | 中 — 信任中心、补丁、年度测试、SOC 2 / ISO 说明 | 高 | 需要完整漏洞趋势、MTTR 和可利用性历史 |
| 事件响应或披露流程失误损害信任 | 中 | 高 | 中 — 有公开公告和信任中心 | 高 | 需要正式复盘、披露政策指标和客户沟通历史 |
| 云或网络提供商故障影响 Secret Server Cloud 或 Platform 登录 | 中 | 高 | 中 — 区域托管、状态更新、备用基础设施、SLA | 中-高 | 需要提供商集中度、故障切换测试和事件成本历史 |
| 紧急维护打断 AD 认证、MFA 或连接器工作流 | 中 | 中-高 | 中 — 有维护窗口和支持指引 | 中 | 需要连接器依赖图和恢复统计 |
| 本地部署客户配置错误或主机失陷导致密钥暴露 | 中 | 高 | 低-中 — 有加固指引和共享责任表述 | 高 | 需要按部署模式拆分的本地部署与云端安装基数,以及支持负担 |
| 地缘政治网络威胁升级,间接影响第三方基础设施 | 低-中 | 中 | 中 — 信任中心监控和提供商韧性 | 中 | 需要区域云依赖地图和按地域拆分的客户暴露 |
剩余评级基于公开漏洞披露、官方状态历史和共享责任表述的组合。还应结合内部事件和 SLA 赔付数据进一步校准。
[CR012, CR014, CR016, CR017, CR018, CR021]关键风险不会只留在工程或法务团队内部,而会传导到客户信任、支持成本、增长节奏和估值信心。
[CR021, CR025, CR005, CR027, CR047]Delinea 的主要依赖分布在云提供商、渠道合作伙伴、公共部门执行伙伴和被收购平台之间。
[CR012, CR031, CR028, CR032, CR033]7.3 合作伙伴、平台与公共部门依赖
Delinea 的风险不只在技术,也在架构和商业。公司 DPA 称 AWS 和 Azure 托管云服务,status center 则显示上游服务商问题会传导成客户可见中断。合作伙伴和公共部门动作又加一层。Delinea 的合作伙伴计划不是装饰:它覆盖经销商、GSI 和 MSP,配有激励、赋能和分层;Climb 扩张把这套模式更深带入欧洲。这给 Delinea 带来杠杆,也让执行部分依赖分销商吞吐量和伙伴质量。FedRAMP 路径凸显更尖锐依赖。两份公开公告都把 UberEther 放在部署模式中心,这意味着 Delinea 的政府业务不只取决于自家产品准备度。产品侧,Fastpath 和 StrongDM 各自扩大 Delinea 的表面积和机会,但也在公司扩张渠道、服务和区域存在的同时,增加集成和路线图复杂度。这些风险对 PE 支持的增长平台来说可以管理,但也正是那类相互依赖的执行风险:一旦领导层注意力滑坡,就会变成发布延迟、定位混乱或集成拖累。[CR027, CR028, CR029, CR030, CR031, CR032]
| 依赖 | 交易对手 / 层级 | 角色 | 集中度 | 失效场景 | 严重性 | 缓释措施 | 剩余风险 |
|---|---|---|---|---|---|---|---|
| 云基础设施托管 | AWS 和 Azure | 核心云服务托管和韧性 | 高 | 提供商故障、价格压力或控制失效影响服务可用性或利润率 | 高 | 多区域运营、共享责任、提供商合规项目 | 中-高 |
| 上游网络提供商 | 区域数据中心 / 路由供应商 | 流量路由和服务可用性 | 中 | 区域网络中断导致登录或密钥启动失败 | 中-高 | 状态响应流程和提供商补救 | 中 |
| 欧洲分销扩张 | Climb Channel Solutions | 分销商主导进入英国、爱尔兰和 DACH 的 GTM | 中 | 分销商执行弱,拖慢销售管线、入驻或合作伙伴质量 | 中 | 更广合作伙伴计划和多合作伙伴模式 | 中 |
| 联邦部署执行 | UberEther | FedRAMP High 就绪部署伙伴 | 中 | 合作伙伴进度滑坡,推迟授权或公共部门交易 | 高 | 共同激励和明确联合推进 | 中-高 |
| 收购来的治理平台 | Fastpath | IGA / SoD / 访问审查扩展层 | 中 | 集成延迟或产品蔓延拖慢交付和叙事 | 中-高 | 统一平台叙事和既有产品化控制 | 中 |
| 收购来的运行时访问平台 | StrongDM | 面向现代基础设施和 AI 用例的 JIT 运行时授权 | 中 | 集成失误拖慢路线图或让客户困惑 | 高 | 战略逻辑强,但外部证据还没证明执行跑通 | 高 |
依赖严重性不只看集中度,也看故障多快会传导到客户信任、联邦合规姿态或增长执行。
[CR012, CR013, CR028, CR030, CR031, CR032]| 角色 / 职能 | 依赖或缺口 | 发生可能性 | 严重性 | 缓释措施 | 尽调路径 |
|---|---|---|---|---|---|
| GTM 领导层 | 公司持续扩张期间,领导层从 James Legg 交接到 Rick Hanson,再到 Chris Kelly | 中 | 中-高 | 引入有经验的外部高管,并持续补强执行团队 | 索取继任计划、配额生产率,以及按 GTM 层级拆分的流失 |
| 服务和客户成功 | 持续招聘说明公司在规模化投入,也增加组织负荷 | 中 | 中 | 新增专门的全球服务和客户成功领导层 | 索取服务毛利率、积压量和支持人员配置趋势 |
| 产品集成领导层 | Fastpath 和 StrongDM 集成需要产品、工程和 GTM 协同 | 中 | 高 | 已有战略叙事和按产品划分的团队 | 要求提供整合评分卡、发布里程碑和被收购团队留任情况 |
| 渠道运营 | 合作伙伴生态扩张和欧洲分销会提高赋能与治理负担 | 中 | 中 | 设有正式合作伙伴计划,包含分级和激励 | 要求提供伙伴贡献管线质量和流失情况 |
| 梯队深度 / 继任 | 公开可见度集中在少数高管身上 | 中 | 中 | 没有重大公开不稳定信号,但继任细节有限 | 要求提供组织架构图、继任人选和关键人才流失数据 |
这些是执行风险,不是对组织失灵的指控。公开证据显示公司在推进并增长,但细节还不足以完整承销梯队深度和整合节奏。
[CR034, CR035, CR036]7.4 人员、执行与财务模型风险
最后一类风险,是不透明下的执行。Delinea 的公开发布显示强动能——ARR 超过 $400 million,继续投资服务和客户成功,推进收购、渠道增长和公共部门野心——但这些都没有配套上市同业所需的披露深度。CyberArk 的 SEC 文件是有用基准,因为它显示一家上市身份安全厂商会如何更透明地讨论经常性收入、支持和云成本驱动,以及风险因素。Delinea 没有公开提供这一层细节。公司也经历了有意义的 GTM 领导层更替:James Legg 到 Rick Hanson,后来又到 Chris Kelly,同时继续在渠道、服务和客户成功上招聘。这可能是健康扩张,但仍是运营变化。因此,关键风险不太像某一个单独破损指标,更像累计执行负荷:整合收购、扩张伙伴、管理可用性、满足隐私义务,并在披露仍然部分缺失的情况下守住客户信任。如果这组任务推进顺利,同样的变化会加深 Delinea 护城河;如果推进不顺,下行大概率先出现在支持负担、续约放慢,或公共部门和交叉销售执行延迟,而不是某个戏剧性头条事件。[CR035, CR036, CR037, CR038, CR039, CR040]
| 风险 | 可监控触发项 | 阈值 / 事件 | 行动含义 |
|---|---|---|---|
| 安全流程风险 | 高危漏洞发生频率 | 再次出现外部报告的披露流程失灵,或出现可利用的高危 CVE 集群且事后复盘不可信 | 升级尽调;在看到流程修复证据前下调信心 |
| 云可用性风险 | 客户可见故障频率 | 短期内反复出现区域性宕机或连接器中断 | 重新评估可用性主张和支持成本假设 |
| FedRAMP / 公共部门执行风险 | 授权里程碑延期 | FedRAMP 卡住且没有清晰下一里程碑,或 UberEther 暴露执行问题 | 下调公共部门上行空间,只把政府业务视为期权价值 |
| 收购整合风险 | 产品整合里程碑落空 | Fastpath 或 StrongDM 整合明显延期,或交叉销售依然乏力 | 下调平台逻辑信心,并按产品摊子过大调整估值 |
| 渠道依赖风险 | 伙伴贡献管线质量 | 分销商扩张带来低转化销售管线,或合作伙伴流失 | 在计入渠道增长前,要求直销生产率证明 |
| 模型不透明风险 | 尽调披露仍然稀薄 | 管理层拿不出经审计的留存、利润率、债务和事件成本数据 | 激进承销时,把不透明本身视为投资逻辑破裂点 |
这些终止标准按尽调用途设计:每个触发项都能由管理层用数据满足,或因持续不透明而失败。
[CR021, CR025, CR027, CR034, CR031, CR037]08估值
8.1 估值背景与价格可见度
Delinea 的公开估值问题,不是缺少业务质量证据,而是缺少当下价格证据。最干净的交易基准仍然是历史交易。Crunchbase 记录 TPG 在 2021 年以 $1.4 billion 收购,Mergr 则把该交易描述成二级收购,而不是常规增长轮。此后,Delinea 披露了运营动能——最突出的是 ARR 超过 $400 million,且收入结构以 SaaS 为主——但它没有发布新的估值标记、新轮融资或 IPO 区间。这个缺口重要,因为 PE 支持的软件公司可以创造价值,却不给外部观察者任何关于债务、优先权堆叠或再资本化动态的可见度。第三方数据库没有解决问题,反而恶化问题。GetLatka 发布的估值和收入估计低得多,与 Delinea 自己的 ARR 主张和 PE 支持所有权历史都冲突。最稳妥的公开结论很直接:Delinea 可能比 2021 年基准更有价值,但市场仍不知道当前价格,无法有信心判断它有吸引力还是昂贵。[CV002, CV003, CV001, CV004, CV005, CV015]
| 维度 | 评估 | 理由 |
|---|---|---|
| 建议 | 观察 | 公司质量看起来可信,但公开来源还不足以揭示价格或资本结构,无法给出买入判断。 |
| 信心 | 中 | ARR 规模和可比公司有方向性参考价值,但当前估值、杠杆和留存质量仍未公开。 |
| 风险评级 | 高 | 核心风险是围绕估值、债务、优先权和收入质量指标的信息不对称。 |
| 估值立场 | Unknown | 2021 年之后没有公开可见的新价格,因此无法精确判断便宜、合理还是偏高。 |
| 决策含义 | 只有出现披露事件才重新接触 | 合适触发点是 IPO 申报、融资、老股交易流程,或管理层数据室披露估值和单位经济模型输入。 |
Delinea 目前没有公开估值标记,因此建议明确取决于证据,而不是判断公司质量不足。
[CV016, CV020, CV022]从 Delinea 可见规模和同业框架,推导到最终“观察”建议的逻辑链。
[CV001, CV010, CV016, CV020]8.2 上市可比公司框架
可比上市公司能给出可用框架,但给不出精确答案。最相关的公开锚点不在泛横向 SaaS,而在身份与安全软件里。按 2026 年 5 月公开市场数据,CyberArk 位于相关区间高端,Okta 低得多,SailPoint 介于两者之间。Multiples.vc 的行业视角补上了中间地带:网络安全和 GRC 软件倍数仍显著高于通用软件类别。这给 Delinea 留下一个合理解读。不能自动按披露最充分、质量最好的上市标杆给它估值,但也不应把它当成疲弱的通用 SaaS 资产定价。因此,这组可比公司支持的是一个宽但真实的合理区间,而不是单点估值。落到实操上,Delinea 更像一家应放进身份安全同业框架的公司,同时仍要承受私有公司和披露折价。[CV006, CV007, CV008, CV009, CV010, CV013]
| 可比公司 / 参考 | 收入或 ARR 基础 | 估值 / 倍数 | 参考价值 | 局限 |
|---|---|---|---|---|
| CyberArk | $1.30B TTM 收入;公开市场身份安全龙头 | ~15.9x 收入 | 身份 / 安全稀缺性和高溢价安全倍数的高端公开市场基准。 | 一流披露和战略位置;对 Delinea 来说可能是偏慷慨的锚。 |
| Okta | $2.91B TTM 收入;公开身份平台 | ~5.2x 收入 | 更成熟公开审视下,规模化身份平台的低端基准。 | 更宽的身份类别和不同增长 / 利润率画像;不是纯 PAM 可比。 |
| SailPoint | $1.07B TTM 收入;身份治理专家 | ~7.7x 收入 | 身份治理敞口和更接近合规工作流的上市同业中间参考。 | 在产品组合、所有权历史或利润率上仍不是干净的 Delinea 对照。 |
| 行业中位数(Multiples.vc) | 公开市场网络安全 ~13.8x;GRC ~9.3x | 品类收入倍数 | 帮助把 Delinea 放在网络安全溢价和治理 / 合规软件区间之间。 | 行业中位数不是公司特定数据,不能替代直接可比公司。 |
| Delinea 2021 年 TPG 交易基准 | 历史交易价值 | $1.4B(历史) | 作为里程碑式下限参考,有助于判断赞助方整合以来价值可能移动了多远。 | 过时的赞助方交易;不是当前市场出清价格,也不能直接类比 2026 年流动性事件。 |
公开数据没有足够透明地覆盖所有涉及的私募赞助方或身份安全 M&A 基准,因此覆盖并不完整。
[CV002, CV006, CV007, CV008, CV009, CV010]以公开的 >$400M ARR 里程碑为基准,观察 Delinea 隐含企业价值对不同收入倍数的敏感性。
[CV001, CV010, CV011, CV012]8.3 情景分析和估值区间
如果把 Delinea 公开披露的年经常性收入(ARR)超过 $400 million 这一里程碑作为基准输入,同业倍数区间能给出方向有用、但刻意保持较宽的估值范围。悲观情景假设市场最终按较低倍数的身份平台给 Delinea 定价,或隐藏杠杆和较弱留存把有效倍数压到 4x–5.5x 区间。对应估值大约为 $1.6 billion 至 $2.2 billion,也意味着自 2021 年控股方交易以来,价值创造少得意外。基准情景采用 7x–10x 区间,对应约 $2.8 billion 至 $4.0 billion;这大致匹配一家已有真实规模、品类相关性强、但透明度仍明显不足的公司。乐观情景假设如果 Delinea 的 ARR 质量、利润率画像和退出准备度经验证较强,它可以拿到更接近优质网络安全公司的倍数,指向约 $5.0 billion 至 $6.4 billion。公开证据足以支撑三情景结构,但不足以精确赋权。因此,这个模型应被视为价格纪律的筛选工具,而不是数据室的替代品。[CV001, CV010, CV011, CV012, CV019]
| 情景 | ARR 假设 | 倍数区间 | 隐含估值区间 | 关键假设 | 概率信号 |
|---|---|---|---|---|---|
| 悲观 | ≈$400M ARR,被视为质量低于同业或负担更重 | 4.0x–5.5x | $1.6B–$2.2B | NRR 疲弱、毛利率不及预期、杠杆或优先权较重,市场给出较低的身份平台倍数。 | 如果披露显示质量明显弱于公开叙事,这就是现实的下行情景。 |
| 基准 | ≈$400M ARR,质量大致符合中端身份 / 安全同业 | 7.0x–10.0x | $2.8B–$4.0B | 经常性收入占比稳、利润率画像可接受、退出准备存在,但仍有私营公司折价。 | 仅看公开信息最合理的区间,但没有数据室时信心仍低。 |
| 乐观 | >$400M ARR,加上优质留存、强利润率和可信 IPO 准备 | 12.5x–16.0x | $5.0B–$6.4B | Delinea 证明自己更接近高溢价网络安全可比公司,市场也奖励身份安全的稀缺性和规模。 | 有可能,但前提是未来披露显著提升对质量和退出准备的信心。 |
区间是说明性的企业价值情景,不是股权价值。资本结构调整可能实质改变最终股权结果。
[CV011, CV012, CV019]基于纯公开估值框架,为 Delinea 给出历史基准和未来情景区间。
[CV002, CV011, CV012]8.4 投资逻辑、反向逻辑和决策
正向投资逻辑不难讲清。Delinea 似乎已有可观的身份安全规模,收入基底以经常性 SaaS 为主,所在品类的上市可比公司仍能支撑中高个位数、甚至更高的收入倍数。反向逻辑也异常清楚:估值可见度差,第三方数据库相互矛盾,上市同业披露远多于 Delinea,控股方结构又遮住了外部投资者最在意的经济性。这组因素挡住了买入建议。纪律严明的投资者可以合理地把 Delinea 放进观察名单,并在融资、IPO 申报或老股交易带来真实价格可见度时准备介入。但在那之前,正确姿态是观察,而不是买入。下一步不是发挥模型想象力,而是收集估值标记、杠杆、留存、利润率和退出准备度证据。[CV017, CV018, CV016, CV020, CV021, CV022]
| 论点 | 证据基础 | 什么会改变判断 |
|---|---|---|
| 投资逻辑:Delinea 已经达到真实的身份安全规模 | 官方 ARR 超过 $400M,且收入以 SaaS 为主,说明公司已有实质性经常性收入和战略重要性。 | 如果经审计的 ARR、NRR 和利润率数据证明扩张具有持续性,而不是一次性里程碑包装,判断会增强。 |
| 投资逻辑:公开市场身份安全可比公司可支持较 2021 年基准显著上行的估值 | CyberArk、SailPoint、Okta 和行业中位数数据支持,对可信的身份 / 安全资产给出中高个位数或更高的收入倍数。 | 如果 Delinea 证明自己更接近高溢价网络安全经济性,而不是较低倍数的平台同业,判断会增强。 |
| 反向逻辑:当前价格实际上未知 | 没有新的估值标记、融资轮或 IPO 区间公开;第三方数据库之间差异很大。 | 只有真实价格和资本结构包披露后,判断才会改善。 |
| 反向逻辑:即使业务不错,赞助方结构也可能隐藏下行 | 公开来源看不到债务、优先权、资本重组条款和分配瀑布经济性。 | 如果杠杆温和,且退出收益没有被赞助方经济安排结构性削弱,判断会改善。 |
每一行说明什么会实质改变判断,而不是把投资逻辑当成静态结论。
[CV017, CV018, CV015, CV020]| 触发项 | 阈值 | 对投资逻辑的传导 | 行动含义 |
|---|---|---|---|
| 净收入留存 | 低于 100% | 说明存量客户扩张不足,撑不起高溢价身份安全倍数。 | 除非入场价格低得多,否则从观察下调到回避。 |
| 毛利率质量 | 按服务调整后,明显低于公开身份同业 | 说明软件经济性更弱,长期估值支撑更低。 | 把估值重切到悲观情景或更低。 |
| 债务 / 优先权包袱 | 吸走退出收益的实质性杠杆或分配瀑布条款 | 即使企业价值看起来合理,也会削弱新投资者可获得的股权价值。 | 要求大幅折价,或回避该流程。 |
| 新定价事件 | 超过 ~12x ARR,且披露没有明显改善 | 相当于要求投资者在盲承销下支付溢价倍数。 | 除非披露包实质改善,否则放弃。 |
| 披露行为 | 严肃流程中不共享经审计指标 | 确认价格不透明是结构性问题,而非暂时现象。 | 不要推进到观察名单以外。 |
阈值参考公开可比公司得出,属于启发式规则,用来在任何未来流程前强制纪律。
[CV021, CV020]| 主题 | 缺失证据 | 重要性 | 尽调路径 |
|---|---|---|---|
| 当前估值标记 | 最新董事会批准估值、融资备忘录或赞助方出售区间 | 没有当前价格,就无法把机会归为有吸引力、合理或偏高。 | 在 NDA 下要求最新融资或估值材料。 |
| 股权结构表、债务和优先股堆叠 | 持股比例、杠杆、到期日、契约和分配瀑布条款 | 赞助方结构复杂时,企业价值情景不等于股权价值。 | 要求股权结构表、债务明细和分配瀑布摘要。 |
| ARR / NRR / GRR / 毛利率桥 | 经审计的经常性收入质量指标和成本结构 | 这些是判断 Delinea 应该落在 5x–16x 同业区间何处的主要驱动。 | 要求按年份、产品或部署组合拆分的经审计历史指标。 |
| 客户集中度和队列留存 | 细分市场组合、头部客户集中度、续约历史和扩张行为 | 验证客户证明能否转化为持久价值,而不是孤立参考客户 Logo。 | 要求客户队列文件和集中度分析。 |
| 退出准备 | IPO 工作流、投行接触、上市公司准备或赞助方退出时间 | 流动性路径会影响估值倍数和时点假设。 | 要求董事会材料或战略选项正式流程更新。 |
这些要求刻意保持实用,聚焦决定价值的缺失输入,而不是泛泛的好奇问题。
[CV022, CV015, CV020]仅基于公开信息,对 Delinea 的可投资性做 IC 风格评分。
[CV017, CV018, CV020, CV022]免责声明
本报告是基于公开证据的尽调快照,不构成投资建议。重要的财务、法律、技术和合同事实仍未公开;做出任何投资决定前,应直接向管理层和一手文件核验。
证据索引
| 编号 | 陈述 | 可信度 | 来源 |
|---|---|---|---|
| CO001 | Delinea now presents itself as an identity security control plane built around centralized authorization for human, machine, and AI identities. | 高 | SO001, SO015 |
| CO002 | Delinea publicly claims a 99.995% uptime commitment for its platform. | 高 | SO001, SO008 |
| CO003 | Delinea’s about page says the company has 500+ integrations. | 中 | SO001 |
| CO004 | Delinea’s about page says the platform secures more than 1 million identities daily. | 中 | SO001 |
| CO005 | Delinea’s current product catalog includes Secret Server, DevOps Secrets Vault, Privilege Manager, Cloud Suite/Server PAM, Identity Threat Protection, Privilege Control products, and Fastpath governance modules. | 高 | SO002, SO001 |
| CO006 | Secret Server is Delinea’s flagship enterprise-grade PAM vault with discovery, password rotation, session monitoring, and audit capabilities. | 中 | SO003 |
| CO007 | Privilege Manager focuses on least-privilege endpoint controls, just-in-time access, application control, and reporting for workstations. | 中 | SO004 |
| CO008 | Cloud Suite is positioned as a multi-cloud/server PAM offering that centralizes identities, enforces just-in-time privilege, MFA, and session auditing. | 中 | SO005 |
| CO009 | Identity Threat Protection is Delinea’s current analytics-led product for continuous identity monitoring, anomaly detection, and remediation guidance. | 中 | SO006 |
| CO010 | Delinea Authorization, powered by Iris AI, is marketed as a real-time, risk-based authorization layer inside the cloud-native platform. | 高 | SO007, SO016 |
| CO011 | The Thycotic transition page still routes visitors to legacy Delinea offerings such as DevOps Secrets Vault, Privileged Behavior Analytics, Privilege Manager, and Secret Server. | 高 | SO030, SO002 |
| CO012 | Official launch materials say Delinea was formed in April 2021 through the merger of Thycotic and Centrify. | 高 | SO009, SO010, SO019, SO020 |
| CO013 | Delinea publicly debuted the Delinea brand on February 1, 2022. | 高 | SO009, SO019, SO020 |
| CO014 | The 2021 combination announcement made Art Gilliland CEO of the merged business and James Legg president. | 高 | SO010, SO020, SO012 |
| CO015 | Art Gilliland remained Delinea’s CEO in the 2025 and 2026 official releases reviewed for this chapter. | 高 | SO015, SO016, SO017 |
| CO016 | Rick Hanson joined Delinea as president in August 2022 and took over global go-to-market responsibilities from James Legg. | 中 | SO012 |
| CO017 | Delinea’s December 2021 post-merger leadership buildout added Suzanne Tom, Jon Kuhn, Ram Venkatachalam, Josh DeLong, and publicly named Pascal Van Dooren as a board member. | 中 | SO011 |
| CO018 | By 2025-2026 Delinea’s public leadership bench included CFO Stephanie Reiter, President GTM Chris Kelly, SVP Spence Young, and new regional leaders across EMEA and APAC. | 高 | SO035, SO016, SO031, SO034 |
| CO019 | Governance disclosure remains partial because reviewed public sources named only one current-era board member and did not provide a full current board roster or control-rights breakdown. | 中 | SO011, SO024, SO025 |
| CO020 | The best-supported current headquarters location is San Francisco, with PitchBook, GetLatka, and IncFact all pointing to San Francisco addresses. | 高 | SO025, SO028, SO029 |
| CO021 | Earlier official Delinea releases used Redwood City and Washington, DC datelines, so headquarters history should be treated as an evolution rather than a single static location across all years. | 中 | SO009, SO011, SO012, SO013 |
| CO022 | The 2021 combination release says TPG acquired Thycotic from Insight Partners, had already closed the Centrify acquisition, and received minority support from Thoma Bravo and PSP Investments for the merged company. | 中 | SO010 |
| CO023 | Crunchbase lists Delinea as acquired by TPG for $1.4 billion on March 2, 2021. | 中 | SO024 |
| CO024 | Mergr separately records TPG’s January 2021 acquisition of Delinea/Centrify from Thoma Bravo and Golub Capital. | 中 | SO026 |
| CO025 | Current profile sources characterize Delinea as private, private-equity-backed, and in IPO registration rather than publicly listed. | 高 | SO024, SO025 |
| CO026 | Reviewed public sources did not corroborate a separate 2024 TPG strategic growth investment in Delinea, instead showing continuing TPG control and IPO-registration style exit signals. | 中 | SO024, SO025, SO026 |
| CO027 | Reviewed public sources did not corroborate an active Francisco Partners stake in Delinea’s current cap table. | 中 | SO024, SO025, SO026, SO027 |
| CO028 | Third-party market-data sources conflict on Delinea’s capital history, with GetLatka showing no outside funding, Tracxn showing legacy venture rounds, and Crunchbase/PitchBook emphasizing private-equity ownership. | 中 | SO024, SO025, SO027, SO028 |
| CO029 | Delinea closed 2022 with $250 million in ARR, more than 25% ARR growth, 85% recurring revenue, and 1,300+ new customers added during the year. | 中 | SO013 |
| CO030 | A January 2025 Delinea release said 2024 milestones included ARR above $350 million as of Q2 2024 and a customer base of over 8,500 organizations worldwide. | 中 | SO035 |
| CO031 | Delinea’s March 2025 year-end release said fiscal 2024 ARR was approaching $400 million and 95% of total GAAP revenue was recurring. | 高 | SO015, SO032 |
| CO032 | Delinea’s August 2025 update said ARR had surpassed $400 million and that SaaS remained the majority of ARR. | 高 | SO016, SO031 |
| CO033 | Delinea described its 2025 operating profile as durable, profitable, and margin-healthy, but the company still did not publish audited public financial statements or a new public valuation. | 中 | SO016, SO031 |
| CO034 | By 2025-2026 Delinea was publicly positioning itself as a cloud-native identity security platform for human, machine, and AI identities, not just a classic PAM vendor. | 高 | SO001, SO015, SO016, SO033, SO034 |
| CO035 | Delinea Iris AI is presented as the engine behind authorization, auditing, and secure-AI controls in the Delinea Platform. | 高 | SO007, SO015, SO016, SO033, SO034 |
| CO036 | The 2024 partner-program launch showed Delinea investing in a four-tier global ecosystem across resellers, GSIs, and MSP/MSSPs. | 中 | SO014 |
| CO037 | The March 2025 release tied Delinea’s Mexico City expansion to scaling centralized teams and sustaining growth after fiscal 2024 performance. | 高 | SO015, SO032 |
| CO038 | In May 2025 Delinea began the FedRAMP High authorization process for Secret Server in partnership with UberEther. | 中 | SO017 |
| CO039 | In February 2026 Delinea added three leaders across EMEA and APAC and tied the move to expanding customer adoption and channel scale. | 中 | SO034 |
| CO040 | In March 2026 Delinea completed the StrongDM acquisition to bring just-in-time runtime authorization into the Delinea Platform for AI-driven environments; financial terms were not disclosed. | 中 | SO033 |
| CO041 | The latest exact customer-scale figure found in reviewed public materials was over 8,500 organizations worldwide, while later sources reverted to the less precise claim of thousands of customers and over half of the Fortune 100. | 中 | SO035, SO009, SO019, SO024 |
| CO042 | Public headcount signals cluster in the low-thousands but remain inconsistent: Crunchbase shows 501-1000 employees, PitchBook 1,136, and GetLatka about 1.2K. | 中 | SO024, SO025, SO028 |
| CO043 | IncFact places Delinea in a broad $100 million to $500 million revenue band as of May 2026, which is directionally consistent with the company’s 2025 ARR disclosures but too wide for exact modeling. | 中 | SO029, SO015, SO016 |
| CO044 | In April 2024 Delinea rushed to patch a critical Secret Server SOAP API flaw after the issue became public. | 高 | SO021, SO022, SO023 |
| CO045 | SecurityWeek and Dark Reading both reported that Delinea appeared to ignore or mishandle weeks of responsible-disclosure attempts before patching the flaw. | 高 | SO021, SO022 |
| CO046 | NVD CVE-2024-33891 says Secret Server before version 11.7.000001 allowed authentication bypass via a hardcoded key and related SOAP API weaknesses, with a CNA severity of 8.8 high. | 高 | SO023, SO021, SO022 |
| CO047 | Delinea’s security advisories page lists additional 2025-2026 CVEs affecting Secret Server and Cloud Suite, showing that vulnerability-management remains an active workload. | 中 | SO018 |
| CO048 | Delineia’s public advisory practice and FedRAMP effort show remediation and compliance progress, but recurring advisories keep product security squarely in diligence scope. | 中 | SO018, SO017, SO021, SO022 |
| CO049 | Exact current board composition, post-2021 ownership percentages, and any post-2021 valuation changes remain publicly underdisclosed despite IPO-registration signals. | 中 | SO024, SO025, SO026 |
| CO050 | Current Delinea materials claim the platform deploys in weeks rather than months and needs 90% fewer resources than the nearest competitor. | 高 | SO001, SO008, SO015 |
| CO051 | Taken together, the reviewed 2025-2026 sources support a PE-backed company with strong operating momentum but no newly disclosed post-2024 valuation benchmark. | 中 | SO015, SO016, SO025, SO028 |
| CM001 | Delinea’s current product surface presents the company as an identity-security platform for human, machine, and AI identities rather than a vault-only PAM vendor. | 高 | SM001, SM005, SM002 |
| CM002 | Delinea publicly claims 99.995% uptime, deployment in weeks rather than months, and 90% fewer resources to manage than the nearest competitor. | 高 | SM001, SM002 |
| CM003 | Delinea’s March 2026 AI-risk survey says 90% of organizations pressure security teams to loosen identity controls to enable AI initiatives. | 高 | SM003, SM006 |
| CM004 | The same Delinea survey says nearly 90% of organizations report at least one identity visibility gap, with the largest gaps around machine and other non-human identities. | 中 | SM003, SM006 |
| CM005 | Forty-two percent of surveyed organizations said AI expansion was a top factor increasing non-human identity risk in the prior 12 months. | 中 | SM003 |
| CM006 | Fifty-nine percent of respondents in Delinea’s AI-risk survey reported lacking viable alternatives to standing privileged access for non-human identities and AI agents. | 中 | SM003 |
| CM007 | Eighty percent of organizations in Delinea’s AI-risk survey said they cannot always explain why a non-human identity performed a privileged action. | 中 | SM003 |
| CM008 | Delinea’s 2023 workplace-authentication survey found that 68% of respondents do not think passwords are dead, with only 30% having started a passwordless transition and 36% still one to two years away. | 中 | SM004 |
| CM009 | Delinea’s passwordless survey said 43% of organizations were blocked by legacy platforms and apps that still require passwords or MFA, while 95% had to satisfy at least one compliance regime. | 中 | SM004 |
| CM010 | Nearly 60% of organizations in Delinea’s passwordless survey said they already use a PAM solution to manage workplace passwords and privileged workflows. | 中 | SM004 |
| CM011 | NIST SP 800-207 defines zero trust as removing implicit trust based on network location and requiring authentication and authorization before access to enterprise resources is established. | 高 | SM008, SM007 |
| CM012 | CISA’s Zero Trust Maturity Model organizes adoption around five pillars and three cross-cutting capabilities, making identity one of several interlocking budget and architecture domains. | 高 | SM007, SM008 |
| CM013 | CyberArk’s current positioning also frames identity security as protecting both human and machine identities, showing that the buyer conversation is broader than classic vaulting alone. | 中 | SM009, SM010 |
| CM014 | BeyondTrust’s PAM positioning emphasizes centralized control, session monitoring, privileged workflows, and hybrid or cloud integration, reinforcing that Delinea competes in a mature enterprise-control category. | 中 | SM011 |
| CM015 | Microsoft Entra ID is positioned as a hybrid-cloud identity and access management suite with built-in security, showing that some Delinea budgets overlap with broader IAM rather than pure PAM. | 中 | SM012 |
| CM016 | Okta positions workforce identity and identity governance around least-standing privilege, threat response, and lifecycle control, which confirms that Delinea buyers also evaluate adjacent governance platforms. | 中 | SM013, SM014 |
| CM017 | IBM’s PAM materials highlight centralized privileged access, session monitoring, and detailed audit logs, reinforcing that compliance and control — not only credential vaulting — drive PAM demand. | 中 | SM015 |
| CM018 | IBM’s machine-verification documentation shows that machine identity verification is now a distinct technical control area adjacent to workforce IAM and privileged access. | 中 | SM016 |
| CM019 | Verizon’s 2026 DBIR summary says the human element, stolen credentials, and exploited vulnerabilities remain common breach drivers, supporting continued identity-control spending. | 中 | SM017 |
| CM020 | MarketsandMarkets projects the global IAM market to grow from $25.96 billion in 2025 to $42.61 billion by 2030, a 10.4% CAGR. | 中 | SM018 |
| CM021 | MarketsandMarkets says privileged access management is the fastest-growing IAM technology segment and non-human IAM identities are growing faster than human identity segments. | 中 | SM018 |
| CM022 | The Business Research Company pegs IAM at $21.81 billion in 2025 and $25.23 billion in 2026, then $45.22 billion by 2030. | 中 | SM019 |
| CM023 | Research and Markets’ 2026 IAM report outline includes TAM analysis, supply-chain analysis, privileged access governance, and legal or regulatory factors, indicating a denominator broader than software-only PAM. | 中 | SM020 |
| CM024 | Identity Management Institute describes the IAM market as reaching more than $24 billion in 2025 with roughly 13% growth, while also highlighting remote work, cloud adoption, and regulation as core demand drivers. | 中 | SM022 |
| CM025 | ISMG’s 2025 IAM market guide cites a projected $61.7 billion IAM market by 2032 and highlights zero trust, passwordless, identity sprawl, and skills gaps as defining themes. | 中 | SM023 |
| CM026 | Grand View Research offers an IAM market page, but the fetched summary surface is mostly promotional and does not provide clean headline numbers in readable text, limiting its usefulness for precise modeling. | 低 | SM021 |
| CM027 | Public IAM and identity-security estimates are directionally bullish but numerically inconsistent because publishers use different category boundaries, forecast years, and TAM methodologies. | 中 | SM018, SM019, SM022, SM023, SM020 |
| CM028 | The buyer set for Delinea-like projects typically spans security leadership, IAM architects, infrastructure or cloud teams, and compliance owners rather than a single end-user budget. | 中 | SM007, SM012, SM013, SM015 |
| CM029 | Operational users of the category include IT administrators, identity teams, developers, machine-identity owners, and auditors reviewing privileged activity. | 中 | SM001, SM009, SM014, SM016 |
| CM030 | BFSI, healthcare, government, manufacturing, and large IT environments appear repeatedly in IAM market segmentations and vendor positioning as priority verticals for privileged-access and governance spend. | 中 | SM019, SM018, SM015 |
| CM031 | Before buyers purchase a dedicated platform, they can rely on native directory controls, scattered password and MFA tools, manual audit processes, or broader IAM suites from Microsoft and Okta. | 中 | SM012, SM014, SM004, SM015 |
| CM032 | Across market and vendor sources, cloud adoption, hybrid environments, and remote access consistently expand IAM and PAM demand. | 中 | SM018, SM019, SM022, SM012 |
| CM033 | Zero trust is now a common demand driver across market summaries and official guidance, which favors vendors able to combine identity, authorization, and continuous control rather than static trust rules. | 高 | SM008, SM007, SM018, SM023 |
| CM034 | AI agents and machine identities are becoming meaningful growth adjacencies because both vendor materials and market research emphasize non-human identity governance, machine verification, and privileged AI actions. | 中 | SM003, SM010, SM018, SM016 |
| CM035 | Legacy systems and integration complexity remain live adoption constraints for IAM and passwordless programs, not just a historical issue. | 中 | SM004, SM022, SM023 |
| CM036 | Skills gaps and operational complexity still slow identity-modernization efforts, according to ISMG and Identity Management Institute market commentary. | 中 | SM022, SM023 |
| CM037 | Budget constraints remain a real IAM adoption brake even in a growing market, especially when organizations need to integrate new controls with legacy environments. | 中 | SM022, SM004 |
| CM038 | Gartner Peer Insights and PeerSpot both show that buyers still compare Delinea, CyberArk, and BeyondTrust directly in PAM procurement decisions. | 中 | SM024, SM025 |
| CM039 | Delinea’s and BeyondTrust’s Gartner-related pages reinforce that privileged access management remains a recognized, mature category with a concentrated peer set. | 中 | SM026, SM027 |
| CM040 | The cleanest market framing for Delinea is a layered identity-security wedge: narrower than total IAM, broader than classic vault-only PAM, and increasingly exposed to non-human identity and AI-governance budgets. | 中 | SM001, SM009, SM018, SM003 |
| CM041 | Public evidence is still too coarse to isolate a Delinea-specific SAM or SOM with high confidence because open sources do not break out paid mix across PAM, platform governance, AI identity, and adjacent workflows. | 中 | SM020, SM018, SM001, SM021 |
| CM042 | Delinea’s deployment-speed and resource-efficiency claims are useful go-to-market signals, but the reviewed public record did not produce a strong independent benchmark validating them. | 中 | SM002, SM024, SM025 |
| CM043 | The overall market setup is attractive for Delinea because demand drivers are real and the category is expanding, but adoption still depends on integration tolerance, governance maturity, and buyer willingness to fund one more control layer. | 中 | SM018, SM022, SM023, SM004 |
| CP001 | Delinea now presents itself as a platform for human, machine, and AI identity security rather than as a standalone secret vault product. | 高 | SP001, SP002 |
| CP002 | Delinea’s 2026 StrongDM acquisition shows that management sees runtime authorization and infrastructure access as strategically important adjacent territory. | 中 | SP003 |
| CP003 | Delinea’s Gartner resource shows the company still frames itself inside the recognized PAM leadership set rather than outside the category. | 中 | SP004 |
| CP004 | CyberArk remains a direct Delinea incumbent because it sells privileged-access management as a core enterprise control plane rather than as an adjacent feature. | 中 | SP008 |
| CP005 | BeyondTrust is also a direct Delinea incumbent because its PAM positioning centers on privileged access, session control, and enterprise platform breadth. | 中 | SP005, SP006 |
| CP006 | CyberArk’s product PAM surface is more explicitly vault-first and privileged-account-centric than Delinea’s newer platform narrative. | 中 | SP008, SP001 |
| CP007 | BeyondTrust markets itself as a broader platform, which means Delinea faces a direct comparison on whether its own platform story is sufficiently differentiated from another all-in-one PAM vendor. | 中 | SP006, SP005, SP001 |
| CP008 | Microsoft is a major bundle competitor because Entra ID and Defender for Identity sit inside many enterprise environments before Delinea is even considered. | 高 | SP013, SP012 |
| CP009 | Okta competes less as a direct PAM clone and more as a broader workforce-identity and governance suite that can absorb adjacent buying criteria. | 中 | SP015, SP016 |
| CP010 | SailPoint represents a governance-led competitive threat where buyers prioritize identity governance and lifecycle control over pure PAM depth. | 中 | SP014 |
| CP011 | CrowdStrike competes as an identity-security flank threat by extending endpoint distribution into identity protection and next-generation ITDR. | 中 | SP009 |
| CP012 | SentinelOne similarly competes from the endpoint and identity direction rather than from the traditional vault-first PAM direction. | 中 | SP010 |
| CP013 | Silverfort positions itself around unified identity security and agentless control, creating a different architectural flank than Delinea’s core PAM heritage. | 中 | SP018 |
| CP014 | Semperis Purple Knight shows that free or low-friction identity-assessment tools can shape buyer expectations before a full platform purchase. | 中 | SP011 |
| CP015 | Teleport competes from the infrastructure-access and zero-trust side, which makes it more relevant in engineering-led infrastructure workflows than in classic audit-led vault deals. | 中 | SP017 |
| CP016 | StrongDM competes from the runtime and infrastructure-access side rather than from the legacy PAM-vault center, which helps explain why Delinea chose to buy it. | 中 | SP021, SP003 |
| CP017 | 1Password’s enterprise positioning makes it an adjacent extended-access-management competitor focused on workforce and device access more than on traditional privileged-admin vaulting. | 中 | SP019, SP020 |
| CP018 | Saviynt represents a suite-style enterprise-identity competitor whose relevance rises when a buyer frames the project around governance and cloud identity more than around PAM depth. | 中 | SP022 |
| CP019 | The practical direct-peer set for Delinea in PAM remains concentrated around CyberArk and BeyondTrust even as the wider identity-security landscape expands. | 中 | SP008, SP005, SP023, SP024 |
| CP020 | Gartner Peer Insights and PeerSpot both keep Delinea visible in active PAM comparison surfaces, which suggests it still belongs on buyer shortlists. | 中 | SP023, SP024 |
| CP021 | QKS Group’s 2025 SPARK Matrix for PAM reinforces that the category is crowded enough that buyers can credibly force comparison on feature breadth and execution. | 中 | SP025 |
| CP022 | Solutions Review’s identity-security list shows that buyers increasingly evaluate Delinea inside a wider identity-security field rather than in a siloed PAM-only lane. | 中 | SP026 |
| CP023 | Among adjacent rivals, Microsoft has the strongest installed-base and bundling advantage because identity and identity-threat tooling are already embedded in many enterprise estates. | 中 | SP013, SP012, SP016 |
| CP024 | Endpoint vendors such as CrowdStrike and SentinelOne have a distribution edge in accounts that prefer to add identity controls to an existing endpoint relationship. | 中 | SP009, SP010 |
| CP025 | The runtime-authorization versus vault-centric distinction matters because engineering-led buyers may prioritize ephemeral infrastructure access over classical credential storage workflows. | 中 | SP021, SP017, SP008, SP003 |
| CP026 | Delinea looks stronger against point or narrow entrants when the buyer wants one platform spanning PAM, governance, and AI-identity control rather than a single engineering-access use case. | 中 | SP001, SP002, SP017, SP021 |
| CP027 | Delinea is weaker when a buyer already gets enough value from Microsoft or Okta bundles and does not need dedicated privileged-depth or runtime authorization. | 中 | SP013, SP012, SP015, SP016 |
| CP028 | Public pricing and packaging are not cleanly disclosed across most PAM incumbents, so outside buyers mostly infer pricing posture from contract model, bundling, and implementation scope rather than list prices. | 中 | SP002, SP008, SP005, SP015 |
| CP029 | Switching costs in PAM and identity-security platforms come primarily from policy design, privileged-account discovery, integrations, and audit process change rather than from commodity software installation alone. | 中 | SP001, SP008, SP005, SP013 |
| CP030 | Multi-homing is likely common because buyers can run Delinea alongside Microsoft identity tooling, endpoint ITDR, or adjacent infrastructure-access tools rather than replacing everything at once. | 中 | SP013, SP012, SP009, SP001 |
| CP031 | Analyst reports and review ecosystems matter because they shape shortlists and enterprise trust in a market where direct feature evaluation is costly and slow. | 中 | SP004, SP007, SP023, SP025 |
| CP032 | Analyst visibility and enterprise reputation act as trust proxies in PAM because buyers are selecting a control plane for sensitive access, not a disposable peripheral tool. | 中 | SP004, SP007, SP023 |
| CP033 | Public competitor materials do not show a single supplier choke point, but they do show dependence on integrations, ecosystem trust, and platform compatibility as meaningful competitive variables. | 中 | SP001, SP015, SP013, SP017 |
| CP034 | Bundle pressure from Microsoft and broader identity suites is a real moat-compression risk because some buyers can satisfy enough requirements without buying a dedicated PAM expansion. | 中 | SP013, SP016, SP014, SP023 |
| CP035 | Agentless identity-security and runtime-access entrants create genuine flank risk even if they are not full Delinea replacements, because they can win the first budget and narrow Delinea’s eventual wedge. | 中 | SP018, SP017, SP021, SP003 |
| CP036 | Delinea’s moat looks moderate rather than dominant: strong enough to remain in the enterprise PAM consideration set, but not so strong that bundle rivals or adjacent specialists can be dismissed. | 中 | SP001, SP008, SP005, SP013, SP021 |
| CP037 | Public sources do not provide reliable win-rate, displacement-rate, or price-to-value data across Delinea and its main rivals, which limits competitive-underwriting precision. | 中 | SP023, SP024, SP025 |
| CP038 | The competitive takeaway is that Delinea sits between direct PAM incumbents above it, broader identity suites beside it, and runtime or agentless entrants below and around it. | 中 | SP001, SP008, SP005, SP013, SP021, SP018 |
| CI001 | Delinea’s public product surface shows a multi-module selling model spanning platform bundles, server PAM, remote privileged access, business-application access control, and AI-driven authorization rather than a single-product vault motion. | 高 | SI001, SI002, SI010, SI011, SI012, SI013 |
| CI002 | The Delinea Platform bundles narrative implies that customers can land on one control plane and expand across adjacent modules, which is structurally supportive of upsell-led recurring revenue. | 高 | SI002, SI006, SI013 |
| CI003 | Server Suite is a separately merchandised Delinea SKU focused on just-in-time and just-enough privilege for Linux, Unix, and Windows servers. | 中 | SI010 |
| CI004 | Privileged Remote Access is a separately merchandised Delinea SKU focused on browser-based, VPN-less privileged access for remote admins and vendors. | 中 | SI011 |
| CI005 | Fastpath Access Control gives Delinea a monetizable governance and segregation-of-duties SKU beyond classical PAM. | 中 | SI012, SI006 |
| CI006 | Delinea’s AI-driven authorization positioning adds a newer authorization-oriented upsell layer to the platform story. | 中 | SI013 |
| CI007 | Delinea’s public product pages emphasize demos, trials, and contact-led conversion rather than publishing list prices, indicating a quote-led enterprise sales motion. | 高 | SI001, SI010, SI011, SI012 |
| CI008 | Open sources do not provide a reliable Delinea list-price, realized-price, or average-contract-value series that would support underwriting ASP directly. | 中 | SI001, SI023, SI024 |
| CI009 | Delinea’s 2024 partner program and 2026 Climb expansion both indicate that channel, reseller, and distributor routes are a material part of go-to-market rather than a minor adjunct. | 高 | SI007, SI008 |
| CI010 | The Delinea partner program explicitly offers financial incentives, marketing support, training, and tiered rewards, which implies spend on channel enablement as part of sales efficiency. | 中 | SI007 |
| CI011 | The 2026 Climb partnership expansion shows Delinea is still investing in EMEA distribution rather than treating Europe as a maintenance-only territory. | 中 | SI008 |
| CI012 | Recent leadership announcements show Delinea investing in global sales, channels, solution engineering, customer success, and services leadership to support growth execution. | 中 | SI003, SI007, SI005 |
| CI013 | Delinea disclosed that the legacy Thycotic business had grown to over $100 million in revenue by the time the combined company was scaling its go-to-market leadership in 2022. | 中 | SI004 |
| CI014 | Delinea said it had surpassed a $350 million ARR milestone as of Q2 2024. | 中 | SI003 |
| CI015 | Delinea said its ARR had surpassed $400 million by the first half of fiscal 2025. | 中 | SI005 |
| CI016 | Delinea’s August 2025 performance update said SaaS made up the majority of its ARR footprint. | 中 | SI005 |
| CI017 | Delinea’s CFO described the company as operating with healthy margins in the August 2025 performance update, but without publishing audited margin percentages. | 中 | SI005 |
| CI018 | Delinea’s August 2025 update said the first half closed with several record-breaking transactions, indicating enterprise-deal contribution to ARR growth. | 中 | SI005 |
| CI019 | Fastpath, Authomize, and later StrongDM show Delinea has been deploying capital into adjacent acquisitions instead of relying only on internal product expansion. | 中 | SI006, SI003, SI020 |
| CI020 | Delinea’s UK data-centre launch confirms a cloud-delivery footprint with regional data-residency and capacity commitments rather than a purely centralized hosting model. | 中 | SI009 |
| CI021 | Regional data centres and locally hosted Secret Server Cloud instances imply ongoing infrastructure, compliance, and support costs that scale with cloud adoption. | 中 | SI009, SI010 |
| CI022 | SecurityWeek reported that Delinea had to investigate a security incident, block affected SOAP endpoints, and ship patches after a failed disclosure process, underscoring trust and engineering-response cost risk. | 中 | SI014 |
| CI023 | CyberArk’s SEC filing shows that more than 90% of its 2023 revenue was recurring, illustrating the kind of recurring-revenue mix mature identity-security vendors target after subscription transition. | 中 | SI021 |
| CI024 | CyberArk disclosed 2023 ARR of $774 million and subscription revenue of $472.0 million, providing a public benchmark for scale and mix in a mature identity-security peer. | 中 | SI021 |
| CI025 | CyberArk disclosed total revenue of $751.9 million in 2023 after growing from $502.9 million in 2021 and $591.7 million in 2022. | 中 | SI021 |
| CI026 | CyberArk’s filing says subscription cost of revenue is driven primarily by customer-support personnel, cloud operations, cloud infrastructure, and amortization, which is a useful proxy for Delinea’s likely SaaS cost stack. | 中 | SI021 |
| CI027 | CyberArk’s filing says gross margin depends on revenue mix, cloud infrastructure cost, and personnel cost, underscoring why Delinea’s undisclosed margin cannot be inferred from ARR alone. | 中 | SI021 |
| CI028 | CyberArk’s filing says the shift to subscription contracts can reduce upfront multi-year cash collection and pressure near-term profitability even while improving long-term visibility. | 中 | SI021 |
| CI029 | Delinea’s quote-led platform selling, SaaS-majority ARR disclosure, and multi-module control surface together suggest revenue quality is likely recurring and subscription-heavy rather than transaction-led. | 中 | SI002, SI005, SI010, SI011 |
| CI030 | Public sources imply implementation, services, and customer-success activity, but they do not quantify professional-services revenue as a separate line item for Delinea. | 中 | SI005, SI003 |
| CI031 | Public ownership history shows Delinea has operated under private-equity sponsorship, which likely provides strategic financing support but also obscures cash balances and leverage from outside investors. | 中 | SI019, SI020, SI016 |
| CI032 | Public sources do not disclose Delinea’s cash balance, monthly burn, debt load, or explicit runway, so capital adequacy cannot be underwritten directly from open evidence. | 中 | SI005, SI016, SI017, SI018 |
| CI033 | Third-party company databases disagree materially on Delinea’s funding, valuation, founding date, and employee footprint, which makes those databases unsuitable as primary underwriting anchors. | 中 | SI015, SI016, SI017, SI018 |
| CI034 | Delinea’s own ARR milestones are more reliable than third-party database revenue or valuation snapshots because the databases are visibly inconsistent with one another. | 中 | SI015, SI003, SI005, SI017, SI018 |
| CI035 | Public review surfaces show buyers evaluate Delinea-like PAM products on implementation and pricing, but they do not publish enough detail to model discounting or sales efficiency precisely. | 中 | SI023, SI024 |
| CI036 | Okta’s public SEC-filings index illustrates how much richer benchmark disclosure is for public identity-software peers than for Delinea, highlighting the private-company information gap. | 中 | SI022 |
| CI037 | Recent disclosures imply Delinea is allocating capital not only to product R&D but also to cloud footprint, channel expansion, and customer-facing leadership capacity. | 中 | SI009, SI007, SI008, SI003, SI005 |
| CI038 | The most defensible public-only verdict is that Delinea has high-quality recurring revenue momentum and active growth investment, but margin path and capital adequacy remain only partially observable because cash, debt, CAC, NRR, and audited gross margin are undisclosed. | 中 | SI005, SI003, SI021, SI016, SI017 |
| CE001 | Delinea currently positions the Delinea Platform around end-to-end visibility, dynamic privilege, and adaptive security across multiple identity types. | 高 | SE001, SE016 |
| CE002 | Delinea’s current public surface spans platform bundles, identity threat protection, secret discovery and vaulting, server privilege, endpoint privilege, governance controls, remote access, and AI-driven authorization. | 高 | SE001, SE002, SE003, SE005, SE004, SE008 |
| CE003 | Identity Threat Protection is publicly described as continuously monitoring identities, access, and anomalous behavior, then recommending or automating remediation. | 中 | SE003 |
| CE004 | Identity Threat Protection publicly claims to visualize identity access pathways across SaaS, cloud, and traditional infrastructure and to integrate those insights into existing security operations signals. | 中 | SE003 |
| CE005 | Privilege Control for Servers is marketed as applying least privilege across Windows, Linux, and Unix environments. | 中 | SE004, SE001 |
| CE006 | Secret Server Discovery is publicly documented as finding local privileged accounts and Active Directory privileged accounts and importing them into Secret Server for management. | 中 | SE005 |
| CE007 | Secret Server Discovery is also documented as mapping service-account dependencies and related services so that credential rotation does not break downstream business processes. | 中 | SE005 |
| CE008 | Secret Server Discovery can be extended with PowerShell when out-of-the-box connectors are insufficient, indicating a scriptable discovery model rather than a closed wizard-only system. | 中 | SE005 |
| CE009 | Secret Server Discovery is publicly documented as scanning AWS, Google Cloud, and Microsoft-connected environments for privileged accounts and shadow administrators. | 中 | SE005 |
| CE010 | Secret Server’s privileged-session controls include proxying both RDP and SSH sessions through the vault for greater control and logging. | 中 | SE006 |
| CE011 | Secret Server publicly documents real-time session monitoring with the ability to message users or terminate risky sessions. | 中 | SE006 |
| CE012 | Secret Server publicly documents session recording, keystroke logging, activity heat maps, and searchable playback for audit review. | 中 | SE006 |
| CE013 | Secret Server’s session-management materials also reference Delinea Connection Manager for managing multiple RDP and SSH sessions in a unified interface. | 中 | SE006 |
| CE014 | Privilege Manager publicly documents integration with Active Directory for synchronizing domain objects and enforcing least-privilege policies against AD structures. | 中 | SE007 |
| CE015 | Privilege Manager publicly documents ServiceNow integration so support requests and responses can be managed and reported within the ticketing system. | 中 | SE007 |
| CE016 | Privilege Manager publicly documents working in tandem with Secret Server, including Secret Server as an authentication source and as a store for local credentials. | 中 | SE007 |
| CE017 | Privilege Manager publicly documents integrations with VirusTotal, Syslog or SIEM targets, SCCM, and other endpoint-management tooling. | 中 | SE007 |
| CE018 | Privilege Manager’s enterprise-readiness documentation says it exposes a public API for automating bulk and repeatable policy operations. | 中 | SE008 |
| CE019 | Privilege Manager publicly documents high availability, load balancing, and reverse-proxy deployment patterns for resilience and safer network exposure. | 中 | SE008 |
| CE020 | Privilege Manager publicly documents a mobile app for endpoint administration, approvals, and event alerts. | 中 | SE008 |
| CE021 | Delinea operates a public integrations marketplace, indicating that integration breadth is part of the platform value proposition rather than an undocumented side feature. | 中 | SE009, SE007 |
| CE022 | Delinea’s public Service Level Addendum commits the multi-tenant Delinea Platform to 99.995% monthly availability in the geographies where the service is offered. | 中 | SE010 |
| CE023 | The public SLA lists availability commitments across US, EU, UK, SEA, AU, CA, and UAE regions, reinforcing that Delinea is operating a regionalized platform footprint. | 中 | SE010 |
| CE024 | Delinea’s public SLA limits remedies to service credits or conversion to a substantially similar product offering, showing enterprise-grade commitments but bounded customer recourse. | 中 | SE010 |
| CE025 | Delinea says it is SOC 2 Type 2 recertified for six products: Secret Server Cloud, DevOps Secrets Vault, Privilege Manager Cloud, Privileged Behavior Analytics, Access Controller Suite, and Account Life Cycle Manager. | 中 | SE011 |
| CE026 | Delinea’s SOC 2 recertification article explicitly frames SOC 2 as a frequent deal requirement and competitive trust signal for customers. | 中 | SE011 |
| CE027 | Delinea said in May 2025 that it had initiated the FedRAMP High authorization process for Secret Server with UberEther as a deployment partner. | 中 | SE012 |
| CE028 | The FedRAMP announcement ties Secret Server to centralized vaulting, privileged-account discovery, automated provisioning and rotation, RBAC workflows, and session monitoring and recording. | 中 | SE012 |
| CE029 | Delinea maintains a public security-advisories surface, which suggests a visible vulnerability-communication process even though underlying engineering details are limited. | 中 | SE013 |
| CE030 | NVD lists CVE-2024-33891 as an authentication-bypass issue in Delinea Secret Server before version 11.7.000001 related to the SOAP API. | 高 | SE015, SE014 |
| CE031 | SecurityWeek reported that Delinea had to investigate a security incident, block affected SOAP endpoints, and ship patches after a failed disclosure process. | 中 | SE014 |
| CE032 | Delinea maintains a public GitHub repository devoted to platform tools, examples, and resources rather than limiting developers to closed support channels. | 中 | SE016 |
| CE033 | Delinea’s public Python SDK supports both Secret Server and Platform authentication and documents REST API usage for secret retrieval. | 中 | SE017 |
| CE034 | Delinea publishes a Terraform provider for DevOps Secrets Vault, showing infrastructure-as-code support rather than only console-driven workflows. | 中 | SE018 |
| CE035 | Delinea publishes a GitHub Action for DevOps Secrets Vault, exposing a direct CI/CD retrieval workflow for secrets. | 中 | SE019 |
| CE036 | Delinea publishes a CLI that converts platform network requirements into Terraform, Ansible, AWS security-group, and other infrastructure formats. | 中 | SE020 |
| CE037 | Across public GitHub repos, Delinea exposes examples, SDKs, CI integrations, Terraform support, and operational tooling, which is meaningful developer signal for a security vendor whose core product is not open source. | 高 | SE016, SE017, SE018, SE019, SE020 |
| CE038 | Delinea’s public platform materials and SLA language both support a cloud-native, multi-tenant delivery model for the Delinea Platform. | 高 | SE002, SE010 |
| CE039 | Delinea’s publicly documented emphasis on least privilege, session control, discovery, and identity context aligns closely with the identity pillar of CISA’s zero-trust maturity model. | 中 | SE026, SE004, SE006, SE003 |
| CE040 | Delinea’s documented workflows are designed to help administrators discover unknown privileged accounts, proxy and record high-risk sessions, and enforce least privilege without handing out raw credentials. | 中 | SE005, SE006, SE004 |
| CE041 | Public product materials show Delinea depends materially on external systems such as Active Directory, cloud providers, ticketing systems, and endpoint tooling to deliver its full workflow value. | 中 | SE007, SE005, SE010 |
| CE042 | Despite detailed feature pages, Delinea’s public materials do not deeply document the core platform’s internal service architecture, data stores, or processing topology. | 中 | SE001, SE002, SE016 |
| CE043 | Delinea’s public trust content summarizes certification and audit posture, but it does not publish underlying SOC 2 reports or the detailed FedRAMP package publicly. | 中 | SE011, SE012 |
| CE044 | Delinea publicly names many integrations, but the open web still gives only partial visibility into deployment effort, support boundaries, and configuration depth for each connector. | 中 | SE009, SE007 |
| CE045 | Relative to broader identity suites from Microsoft and Okta, Delinea’s public differentiation is deeper emphasis on privileged discovery, session control, vaulting, least privilege, and integrated remediation. | 中 | SE001, SE003, SE005, SE006, SE022, SE023 |
| CU001 | Delinea’s public customers page lays out a structured customer journey that starts before purchase and extends through deployment, ongoing use, expansion, and renewal. | 中 | SU001 |
| CU002 | Delinea says new customers receive support-portal access, documentation, community access, and e-learning resources at no additional cost during onboarding. | 中 | SU001 |
| CU003 | Delinea publicly describes introductions to Professional Services, Technical Account Managers, and Customer Success Managers as part of customer onboarding for appropriate accounts. | 中 | SU001 |
| CU004 | Delinea says a renewal representative may contact customers as early as 120 days before renewal, which is a visible signal of formal renewal management rather than purely reactive support. | 中 | SU001 |
| CU005 | The customers page advertises Secret Society, weekly office hours, a monthly customer newsletter, and quarterly roadmap updates, showing Delinea invests in post-sale community and enablement surfaces. | 高 | SU001, SU013 |
| CU006 | Delinea Edge, announced for 2027, is positioned as a customer conference focused on product, engineering, peer exchange, and hands-on identity-security practice, reinforcing a deliberate customer-education motion. | 高 | SU013, SU001 |
| CU007 | Delinea’s August 2025 performance update highlighted new leadership across global services and customer success, suggesting customer retention and expansion are active operating priorities. | 中 | SU016 |
| CU008 | As of the January 2025 Chris Kelly announcement, Delinea publicly anchored its customer footprint at more than 8,500 organizations worldwide, but that disclosure point is dated rather than a current live count. | 中 | SU015 |
| CU009 | Delinea’s 2022 brand-launch materials claimed customers included more than half of the Fortune 100, which supports large-enterprise penetration even though the company does not publish a current named roster. | 中 | SU017 |
| CU010 | Delinea maintains a visible public case-study library with named customer examples spanning utilities, telecom, mobility, media, travel, retail, housing, manufacturing, and technology workflows. | 高 | SU002, SU006, SU007, SU008, SU009, SU010, SU011, SU012, SU004, SU003, SU005 |
| CU011 | The most detailed public customer proof leans toward regulated, audit-heavy, or operationally critical environments rather than lightweight self-serve SMB deployments. | 中 | SU004, SU005, SU006, SU007, SU026 |
| CU012 | Robert Weed says it uses Secret Server to manage privileged credentials for nearly 200 systems and more than 100 workstations. | 高 | SU001, SU003 |
| CU013 | Robert Weed estimated that, after implementing Secret Server, password-management work takes about 10% of the prior time and effort. | 高 | SU001, SU003 |
| CU014 | Robert Weed planned to onboard managed-service and network-service providers into Secret Server with check-in, check-out, and rotation workflows, indicating post-deployment expansion rather than a one-and-done vault project. | 中 | SU003 |
| CU015 | Boyner deployed both Delinea Secret Server and Delinea Privileged Remote Access on the Delinea Platform, tying vaulting and third-party remote-access controls into one customer deployment. | 高 | SU001, SU004 |
| CU016 | Boyner’s case study frames the retailer as a six-brand organization with more than 250 department stores and more than 8,000 employees. | 中 | SU004 |
| CU017 | Boyner said Delinea reduced the time and cost associated with managing privileged accounts by more than 40 percent. | 高 | SU001, SU004 |
| CU018 | Boyner also said Delinea reduced the effort required to support compliance by 60 percent while improving audit readiness. | 高 | SU001, SU004 |
| CU019 | The Trade Desk used Fastpath to support segregation-of-duties and change-tracking controls around its Oracle Cloud ERP environment. | 高 | SU001, SU005 |
| CU020 | The Trade Desk case study cites more than 1,200 global users and over 100 accounting and finance users across three geographies on Fastpath-supported controls. | 中 | SU005 |
| CU021 | The Trade Desk said Fastpath helped supply audit and change-tracking reports Oracle could not provide natively, which is strong proof of fit for audit-driven finance teams. | 中 | SU005 |
| CU022 | TEPCO Systems implemented Secret Server as part of a shift toward zero trust and J-SOX-compliant privileged-access controls for systems supporting power operations. | 中 | SU006 |
| CU023 | TEPCO Systems reported a 40 percent reduction in privileged-ID management workload and 48 hours saved per audit after implementing Secret Server. | 中 | SU006 |
| CU024 | SBA Communications used Fastpath to improve segregation-of-duties analysis, password control, and change tracking for Microsoft Dynamics GP in a public-company SOX context. | 中 | SU007 |
| CU025 | SBA said Fastpath reduced the time required to generate meaningful compliance reports from days or weeks to hours and made audit reporting a continuous process. | 中 | SU007 |
| CU026 | PeerSpot reviewers consistently praise Delinea Secret Server for password rotation, session monitoring, access control, auditability, and overall stability. | 中 | SU018 |
| CU027 | PeerSpot reviewers also point to friction around API flexibility, reporting, setup complexity, integration, pricing, and some session-management details. | 中 | SU018 |
| CU028 | TrustRadius reviews emphasize secure vaulting, scheduled privileged access, audit trails, Active Directory integration, password rotation, and broad role-based control. | 中 | SU019 |
| CU029 | TrustRadius users also report clunky workflows, slower adoption for new users, weak mobile experience, manual onboarding effort, and integration limitations. | 中 | SU019 |
| CU030 | Across public review surfaces, Delinea appears strongest where buyers need secure vaulting, auditability, and approval workflows for privileged access. | 高 | SU018, SU019, SU026 |
| CU031 | Across public review surfaces, the main adoption drag appears to be implementation, reporting, and integration friction rather than disbelief in the underlying security use case. | 高 | SU018, SU019 |
| CU032 | Delinea’s public retention evidence is procedural rather than numerical: the company documents renewal workflows, training, support, community, newsletters, and customer events, but not NRR or churn. | 高 | SU001, SU013, SU016 |
| CU033 | No public Delinea source reviewed in this run disclosed NRR, GRR, logo churn, renewal rate, or contract length by segment. | 中 | SU001, SU016, SU015 |
| CU034 | No public source reviewed in this run disclosed top-customer ARR concentration, top-10 revenue share, or any equivalent customer concentration metric for Delinea. | 中 | SU001, SU016, SU015 |
| CU035 | Publicly named customer proof is much richer for enterprise and upper-midmarket environments than for small-business deployments, even though Delinea markets to organizations of all sizes. | 中 | SU017, SU003, SU004, SU005, SU006, SU007 |
| CU036 | Public customer stories show Delinea selling beyond a single core vault product into adjacent modules such as Privileged Remote Access and Fastpath compliance controls, which supports a land-and-expand motion. | 中 | SU004, SU005, SU007 |
| CU037 | The 2024 Secret Server disclosure controversy and resulting CVE create a plausible customer-trust and renewal risk, especially for regulated buyers who underwrite vendor response discipline. | 高 | SU024, SU025 |
| CU038 | The Trade Desk’s own public site confirms it is an omnichannel advertising platform, which corroborates Delinea’s public proof in a technology and digital-advertising buyer segment. | 高 | SU005, SU021 |
| CU039 | SBA Communications’ investor site corroborates that the customer is a public wireless-infrastructure operator, reinforcing Delinea’s public proof in regulated telecom and infrastructure environments. | 高 | SU007, SU022 |
| CU040 | Norwegian Cruise Line Holdings’ public site corroborates the travel-and-hospitality context visible in Delinea’s customer case-study library. | 高 | SU010, SU023 |
| CU041 | Even though the open web gives limited corporate-detail text, Boyner’s public storefront corroborates the retailer context presented in Delinea’s case study. | 中 | SU004, SU020 |
| CR001 | Delinea’s privacy policy says the company processes personal information across website interactions, community forums, events, support, professional services, billing, and cloud operations. | 中 | SR001 |
| CR002 | Delinea’s privacy policy explicitly contemplates sharing personal information with partner-program participants, CRM and marketing platforms, webinar providers, email platforms, hosting providers, and customer-success tooling. | 中 | SR001 |
| CR003 | Delinea’s privacy policy explicitly references GDPR and CCPA concepts, privacy rights, international transfers, and a processor role governed by the DPA for cloud services. | 高 | SR001, SR004 |
| CR004 | The European Commission describes GDPR as part of the EU’s binding data-protection framework and notes that cross-border transfers require safeguards such as adequacy decisions, SCCs, or BCRs. | 中 | SR024 |
| CR005 | California’s CCPA guidance says consumers have rights to know, delete, correct, limit sharing, and in some breach circumstances sue for statutory damages of up to $750 per incident. | 中 | SR025 |
| CR006 | Delinea’s website terms select California law and venue in Santa Clara County for site-related disputes. | 中 | SR002 |
| CR007 | Delinea’s website terms broadly disclaim warranties and consequential-damage liability for site materials and services, subject to applicable law. | 中 | SR002 |
| CR008 | Delinea’s MSLA provides one-, two-, or three-year initial terms, annual advance payment, and one-year renewal terms unless otherwise agreed. | 中 | SR003 |
| CR009 | The MSLA gives Delinea usage-reporting and audit rights for usage-based solutions and permits list-pricing true-ups for materially delinquent reporting. | 中 | SR003 |
| CR010 | The MSLA says purchases through authorized channel partners are managed commercially through those partners even while Delinea governs product use, adding channel-process complexity to customer relationships. | 高 | SR003, SR012 |
| CR011 | Delinea’s DPA says its cloud services operate in a multitenant architecture with customer data kept logically and-or physically separated from other customers. | 中 | SR004 |
| CR012 | Delinea’s DPA explicitly describes a shared-responsibility model in which cloud providers secure infrastructure, Delinea secures the application portfolio, and customers remain responsible for operating the services within their own policies. | 高 | SR004, SR028, SR029 |
| CR013 | The DPA says Delinea uses both AWS and Microsoft Azure to host cloud services and their associated customer data. | 中 | SR004 |
| CR014 | Delinea says its cloud-service security measures are subject to annual ISO 27001 and SOC 2 assessments and annual third-party penetration testing. | 高 | SR004, SR020 |
| CR015 | The DPA says Delinea will not use customer data to train or improve AI models without prior written agreement from the customer. | 中 | SR004 |
| CR016 | Delinea’s trust center lists CVE-2026-2409, an SQL injection issue in Cloud Suite with a CVSS v4 score of 9.3. | 中 | SR005 |
| CR017 | Delinea’s trust center also lists Cloud Suite and Privileged Access Service vulnerabilities from 2025, including request-smuggling and SQL-injection issues. | 中 | SR005 |
| CR018 | Delinea’s trust center says Secret Server on-premises customers remain responsible for protecting the application server and underlying environment, and warns that admin-level host control can expose both database data and the encryption key. | 中 | SR005 |
| CR019 | SecurityWeek reported that Delinea had to scramble to patch a critical Secret Server flaw after a failed responsible-disclosure attempt. | 中 | SR021 |
| CR020 | NVD documents CVE-2024-33891 as an authentication-bypass issue in Delinea Secret Server before version 11.7.000001 related to the SOAP API. | 中 | SR022 |
| CR021 | Taken together, the trust-center CVEs, the 2024 NVD record, and SecurityWeek’s reporting establish product-security and disclosure-process risk as a real, not hypothetical, operating concern for Delinea. | 高 | SR005, SR022, SR021 |
| CR022 | Delinea’s status center shows emergency maintenance in May 2026 to rotate TLS certificates on connector relay infrastructure that could briefly disrupt Active Directory authentication and MFA for endpoint agents. | 中 | SR006 |
| CR023 | The status center shows an EU-region Secret Server Cloud incident in May 2026 where some users could not launch secrets because of an outage affecting a cloud infrastructure service used by Delinea. | 中 | SR006 |
| CR024 | The status center also reports May 2026 US login timeout errors caused by a disruption at an upstream network-provider datacenter. | 中 | SR006 |
| CR025 | Delinea’s own status history shows that even with strong uptime claims, customers still face emergency maintenance, degraded performance, and upstream-cloud or network incidents. | 高 | SR006, SR019 |
| CR026 | Delinea’s UK data-centre launch shows active investment in regional hosting to mitigate latency and data-residency concerns for customers with local regulatory requirements. | 中 | SR014 |
| CR027 | Delinea started the FedRAMP High process in May 2025 and reached Under Assessment in September 2025, but the public sources reviewed do not show a completed authorization. | 高 | SR007, SR008 |
| CR028 | Both FedRAMP announcements position UberEther as Delinea’s deployment partner, making the public-sector motion at least partially dependent on partner execution. | 高 | SR007, SR008, SR027 |
| CR029 | CISA’s Zero Trust Maturity Model and Delinea’s own zero-trust materials both emphasize explicit verification, least privilege, and just-in-time access, showing that Delinea’s product direction is aligned with an active federal control paradigm. | 高 | SR023, SR009 |
| CR030 | Delinea’s 2024 partner program introduced tiering, incentives, enablement, and support across resellers, GSIs, and MSPs, indicating that channels are a material GTM dependency rather than a side route. | 中 | SR012 |
| CR031 | The 2026 Climb expansion into the UK, Ireland, and DACH extends Delinea’s distributor-led reach and increases dependence on external channel execution in Europe. | 高 | SR013, SR026 |
| CR032 | The Fastpath acquisition broadened Delinea into identity governance, segregation-of-duties, and audit-control workflows after regulatory review. | 高 | SR011, SR015, SR016 |
| CR033 | The StrongDM acquisition broadens Delinea into runtime authorization across databases, containers, CI/CD pipelines, and AI-driven environments, with transaction terms undisclosed. | 中 | SR010 |
| CR034 | Back-to-back platform-expanding acquisitions raise integration, roadmap, and go-to-market complexity even if the strategic logic is sound. | 高 | SR011, SR010, SR018 |
| CR035 | Delinea’s GTM leadership has transitioned from James Legg to Rick Hanson and then to Chris Kelly across the post-merger growth period. | 高 | SR030, SR017 |
| CR036 | The company’s 2025 releases show continuing additions in channels, services, and customer-success leadership, which is positive for scale but also evidence of organizational change load. | 高 | SR017, SR018, SR012 |
| CR037 | Despite public ARR claims above $400 million, Delinea still does not publish audited public filings with debt, cash, burn, NRR, or detailed risk-factor disclosure. | 中 | SR018, SR017 |
| CR038 | CyberArk’s SEC filing illustrates how much richer public cyber-vendor disclosure can be on recurring revenue, cost drivers, and risk factors than Delinea’s private-company narrative. | 中 | SR031, SR018 |
| CR039 | The DPA’s cloud-hosting architecture and CyberArk’s public filing both support the idea that cloud infrastructure, support, and compliance operations are meaningful cost and risk drivers in identity-security SaaS. | 高 | SR004, SR031, SR006 |
| CR040 | Fastpath Access Control and Access Review are explicitly positioned to analyze segregation-of-duties conflicts, certify access, automate follow-up, and produce auditor-facing evidence. | 高 | SR015, SR016 |
| CR041 | Delinea’s trust center includes active monitoring notes about heightened cyber-threat conditions in the Middle East and possible indirect impact through third-party cloud infrastructure providers. | 中 | SR005 |
| CR042 | Delinea’s SLA and status surfaces show a broad regional footprint and formal uptime commitments, but also clarify that maintenance windows, emergency work, and bounded remedies remain part of the operating reality. | 高 | SR019, SR006 |
| CR043 | Although partners matter materially, Delinea’s channel model is not visibly tied to a single reseller because the public program spans multiple partner types and the Climb expansion is presented as an extension, not the only route. | 高 | SR012, SR013, SR026 |
| CR044 | The public sources reviewed for this run did not surface privacy-enforcement actions, lawsuits, or equivalent legal proceedings against Delinea, leaving legal-exposure assessment incomplete rather than cleanly low-risk. | 中 | SR001, SR002, SR025, SR024 |
| CR045 | Public sources show public-sector ambition through FedRAMP, but do not disclose public-sector revenue share or dependence on government bookings. | 中 | SR007, SR008, SR018 |
| CR046 | The public record reviewed in this run does not disclose top-customer concentration or revenue dependency on any single customer or cohort. | 中 | SR018, SR017 |
| CR047 | The most important thesis-break cluster visible from public evidence is security and reliability failure propagating into customer trust, renewal friction, support costs, and delayed public-sector expansion. | 高 | SR005, SR006, SR021, SR008 |
| CV001 | Delinea said in August 2025 that ARR had surpassed $400 million, that SaaS remained the majority of ARR, and that the company was operating with healthy margins. | 中 | SV001 |
| CV002 | Crunchbase lists Delinea as acquired by TPG for $1.4 billion on March 2, 2021, which is the clearest public transaction-value benchmark in the current source set. | 中 | SV002 |
| CV003 | Mergr separately frames the 2021 Delinea transaction as a secondary buyout from Thoma Bravo and Golub Capital, reinforcing sponsor ownership continuity rather than a new venture-style funding round. | 中 | SV003 |
| CV004 | None of the reviewed public sources provides a new post-2021 valuation mark, financing price, or IPO range for Delinea. | 中 | SV001, SV002, SV003 |
| CV005 | Third-party market-data providers materially disagree on Delinea’s profile: GetLatka reports $132.4 million revenue and a $397.3 million valuation, which conflicts with Delinea’s own >$400 million ARR claim and the sponsor-backed transaction history visible in Crunchbase and Mergr. | 中 | SV004, SV001, SV002, SV003 |
| CV006 | CyberArk’s May 2026 market cap of about $20.63 billion and TTM revenue of about $1.30 billion imply an approximately 15.9x revenue multiple. | 中 | SV005, SV006 |
| CV007 | Okta’s May 2026 market cap of about $15.10 billion and TTM revenue of about $2.91 billion imply an approximately 5.2x revenue multiple. | 中 | SV008, SV009 |
| CV008 | SailPoint’s May 2026 market cap of about $8.29 billion and TTM revenue of about $1.07 billion imply an approximately 7.7x revenue multiple. | 中 | SV011, SV012 |
| CV009 | Multiples.vc’s May 2026 sector data shows public cybersecurity software around 13.8x revenue and governance, risk, and compliance software around 9.3x revenue. | 中 | SV013 |
| CV010 | Taken together, the reviewed public comp set places relevant identity and security software in roughly a 5x to 16x revenue band in May 2026, with the lower end closer to Okta-scale identity-platform pricing and the upper end closer to CyberArk-grade security multiples. | 中 | SV005, SV006, SV008, SV009, SV011, SV012, SV013 |
| CV011 | Applying that roughly 5x to 16x peer band to Delinea’s publicly claimed >$400 million ARR implies a broad scenario range of about $2.0 billion to $6.4 billion before debt, cash, and sponsor-structure adjustments. | 低 | SV001, SV005, SV006, SV008, SV009, SV011, SV012, SV013 |
| CV012 | A more disciplined base underwriting band of roughly 7x to 10x ARR would imply about $2.8 billion to $4.0 billion for Delinea if retention, gross margin, and disclosure quality prove closer to mid-tier public identity peers than to the best-in-class CyberArk case. | 低 | SV001, SV008, SV009, SV011, SV012, SV013 |
| CV013 | Public peers disclose materially more detail than Delinea: CyberArk’s 2025 results include revenue, ARR, subscription mix, and cash, while Okta’s annual report represents the standardized public-company disclosure package absent from Delinea’s record. | 中 | SV007, SV010 |
| CV014 | CyberArk disclosed full-year 2025 revenue of $1.361 billion, subscription ARR of $1.267 billion, and cash plus marketable securities of $2.095 billion, illustrating the precision public investors receive from a listed identity-security peer. | 中 | SV007 |
| CV015 | Sponsor ownership likely lowers immediate external-financing risk for Delinea relative to an unfunded startup, but it leaves leverage, dividend recap potential, and preference or waterfall economics largely opaque in public sources. | 中 | SV002, SV003 |
| CV016 | Because current entry price, leverage, and preference-stack economics are not public, the open-web record does not support a price-sensitive buy recommendation even though the business appears strategically credible. | 中 | SV001, SV002, SV003, SV004 |
| CV017 | A constructive Delinea thesis is still visible in public sources: ARR scale above $400 million, SaaS-majority mix, sponsor backing, and a relevant public comp set that values identity/security software materially above generic SaaS averages. | 中 | SV001, SV002, SV005, SV006, SV013 |
| CV018 | The anti-thesis is primarily valuation opacity rather than category weakness: Delinea lacks a current public mark, third-party databases conflict, and the real multiple could compress sharply if NRR, gross margin, or leverage prove worse than peer assumptions. | 中 | SV004, SV001, SV008, SV009, SV011, SV012 |
| CV019 | Bull, base, and bear scenarios are directionally useful for Delinea, but precise probability weighting cannot be supported from public data alone because retention, margin, debt, and exit-timing inputs remain undisclosed. | 中 | SV001, SV010, SV007 |
| CV020 | The most defensible public-only call is Track rather than Buy: the company appears worth monitoring for an IPO, sponsor exit, or new financing, but valuation cannot be underwritten cleanly without management-grade financial and capital-structure data. | 中 | SV001, SV007, SV010, SV013 |
| CV021 | The Delinea thesis would weaken materially if diligence showed NRR below 100%, gross margin structurally below public identity peers, heavy debt or preference overhang, or a new financing/IPO price above about 12x ARR without substantially better disclosure. | 中 | SV008, SV009, SV011, SV012, SV005, SV006, SV013 |
| CV022 | The highest-value diligence asks are the current valuation mark, cap table and debt stack, audited ARR/NRR/gross-margin bridge, concentration and cohort retention data, and evidence of exit-process readiness. | 中 | SV002, SV003, SV010, SV007 |
| CV023 | PitchBook’s public preview continues to frame Delinea as a private-equity-backed company and references IPO-style status rather than a fresh priced round. | 中 | SV014 |
| CV024 | Tracxn adds another conflicting market-data layer, reinforcing that third-party profile databases are not reliable valuation anchors for Delinea by themselves. | 中 | SV015, SV004, SV002 |
| CV025 | SecurityWeek reported a failed responsible-disclosure episode around a critical Secret Server flaw, which is the kind of trust event that can justify a valuation discount in security software. | 中 | SV016 |
| CV026 | NVD documented CVE-2024-33891 as an authentication-bypass issue in Secret Server, reinforcing that the 2024 incident was not merely a media artifact. | 中 | SV017 |
| CV027 | Delinea’s trust center publicly lists security advisories and vulnerability notices, showing that product-security maintenance is an ongoing cost and diligence topic. | 中 | SV018 |
| CV028 | Delinea’s status center shows incidents and maintenance events, confirming that operational reliability should be treated as a valuation input rather than an assumed constant. | 中 | SV019 |
| CV029 | Delinea’s global partner program indicates an explicit channel and distribution strategy that could support valuation if it scales efficiently, but it also adds execution dependence on partners. | 中 | SV020 |
| CV030 | The strongDM acquisition broadens Delinea’s authorization and infrastructure-access scope, which can support a broader platform valuation story if integration succeeds. | 中 | SV021 |
| CV031 | The Fastpath acquisition broadened Delinea into governance and access-review workflows, supporting a more diversified identity-security platform narrative. | 中 | SV022 |
| CV032 | Delinea’s FedRAMP motion was still under assessment rather than authorized, so public-sector upside should be treated as optionality rather than fully banked valuation support. | 中 | SV023 |
| CV033 | CISA’s zero-trust guidance reinforces the strategic relevance of least privilege and identity control, helping explain why the category can sustain premium valuation multiples. | 中 | SV024 |
| CV034 | European data-protection requirements increase compliance burden for identity vendors even while supporting demand for stronger access governance. | 中 | SV025 |
| CV035 | California privacy rules create additional rights and potential exposure that identity vendors must manage, adding compliance burden alongside category demand. | 中 | SV026 |
| CV036 | Thoma Bravo’s 2022 rebrand announcement confirms that Delinea emerged as the combined, sponsor-backed platform identity after the earlier consolidation period. | 中 | SV027 |
| CV037 | CyberArk’s SEC filing archive provides a public filing benchmark with formal risk-factor and disclosure depth that private Delinea does not yet match. | 中 | SV028 |
| CV038 | Okta maintains an investor-facing SEC filings index, illustrating the recurring disclosure cadence public peers provide to outside investors. | 中 | SV029 |
| CV039 | Delinea’s 2025 GTM leadership hire shows the company is still investing in sales, channels, and customer-success capacity rather than operating as a static asset. | 中 | SV030 |
| CV040 | Any future positive Delinea recommendation would still need to be highly price-sensitive because security-response risk, operational incidents, and sponsor opacity are all still part of the story. | 中 | SV016, SV017, SV019, SV002, SV003 |