Panthera and CyberQP: frequently asked questions

The full privileged access lifecycle in one platform: Discover & Assess, Remediation of Privileged Access, Zero-Knowledge Credential Vault, Zero-Knowledge Credential Rotation, MFA & Secure Access Enforcement, Just-in-Time Access & Zero Standing Privilege, Auditing, Monitoring & Alerting, and Endpoint Privilege Management. CyberQP also offers QGuard for privileged access and QDesk for end-user access at the service desk.

Active Directory, Entra ID, Microsoft 365 and Google Workspace, plus local accounts on Windows servers and on Windows and macOS workstations.

CyberQP does not directly integrate with RMMs and MDMs but includes pre-built deployment scripts for the CyberQP agent for the most popular RMMs, including ConnectWise Automate, DattoRMM, NinjaOne, N-Able RMM and N-Able N-Central as well as Microsoft Intune MDM. PowerShell and Command Line scripts are also available to be used with Group Policy and any other RMM or MDM platform.

Panthera stores privileged credentials, API keys and tokens in its own zero-knowledge vault. QGuard also integrates with the password vaults in IT Glue and Hudu.

Our knowledge base includes detailed step-by-step guides for setting up and configuring 3rd party integrations here.

CyberQP currently integrates with ConnectWise PSA, Datto Autotask PSA, and Halo PSA.

Currently, end-user identity verification, sending a password reset link, manual password resets, unlocking accounts, and enabling/disabling an account are available for end-user accounts within the QDesk PSA integrations. More capabilities will be added in the future to add additional functionality.

Yes, in a zero-knowledge vault. CyberQP doesn't hold the encryption keys, so it can't read your credentials in plain text, including while Panthera rotates them. Your data is never sent to a third-party AI model provider.

On a schedule you set, from every day to once a year, or automatically after each use.

Yes. When a Windows service account's password rotates, CyberQP finds the service, updates the password and restarts the service so the change takes effect. Scheduled tasks that use the account are updated too.

Shared, break-glass and service-account credentials across local Windows accounts, Active Directory, Entra ID, Microsoft 365 and Google Workspace. The vault stays zero-knowledge through every rotation.

Yes. Manage every client environment from one console and switch tenants without re-authenticating, with role-based access and clean separation between them. Set a policy at the parent level and it cascades to the orgs beneath it.

Either. A technician can elevate a single process or an end user. Safe elevations can be approved automatically based on a risk score, so only the risky ones need a look.

Yes. It detects every local administrator on an endpoint and its current UAC settings, removes local admin rights and enforces stricter UAC settings.

Windows endpoints, including Windows servers and workstations.

Yes. It uses number-matching MFA registered with the QTech mobile app on iOS and Android.

Yes. Passwordless technician login uses just-in-time accounts by default on Windows endpoints. For Microsoft 365 or Entra ID, you can use Temporary Access Passes, OTP, or Microsoft Authenticator passwordless sign-in.

Yes. A technician can only use a just-in-time account under a policy that sets the customer, the account type, the privileges allowed and the time frames permitted.

Yes, after every use.

QDesk sends a 6-digit code by SMS or email, or a push notification through the CyberQP mobile app or Microsoft Authenticator.

Reset their password, unlock their account, and get notified before their password expires.

Yes, including CIS v8, CMMC 2.0, ISO 27001:2022, NIST 800-53, SOC 2 and HIPAA. Panthera generates the privileged-access evidence auditors and cyber insurers ask for, on demand.

Two licenses. The technician license covers your operators and everything they administer, including servers, Active Directory, Entra ID and Google Workspace. The device license covers the workstations your end users work on. Buy either on its own, or both.

Your discount follows your total monthly spend, not the count of any one license type, so putting both licenses on one agreement works in your favor. The pricing page has the details.

We have agreements with many industry peer groups. Check with your group or a member of the CyberQP team to see if an agreement is in place with your peer group.

We accept credit card for monthly billing. If you would like to pay annual up-front, we will accept bank transfer and can often provide a discount for doing so.

No account carries admin rights around the clock. Access is granted when it's needed, scoped to the task, and removed when the task is done, so there's nothing standing for an attacker to steal or abuse.

Admin accounts that stay enabled even when nobody is using them, giving persistent, always-on privileged access.

- Active Directory Domain Administrator Accounts
- Entra ID Global Administrator Accounts
- Windows Local Administrator Accounts

Admin rights granted only when a task needs them, and removed afterwards. Each grant should have:
- A reason for access
- A time frame for access
- The least privilege necessary to perform the task

It removes always-on local admin rights from workstations and replaces them with policy-controlled elevation. Users can still do legitimate work, while malware and ransomware lose the admin rights they rely on.

Every user and technician gets the minimum access needed to do the job, and no more.

From one multi-tenant console that discovers privileged, admin and service accounts across every client, vaults and rotates their credentials, and grants technicians just-in-time access. Panthera's Prompt Terminal can run that work from a plain-language request.

It removes standing privilege without slowing technicians down. Technicians get just-in-time access instead of standing admin rights or shared passwords, break-glass and shared accounts rotate automatically, and unused, misconfigured or over-privileged accounts are flagged for clean-up.

End to End Help Desk Automation helps MSPs and in-house IT teams eliminate their most costly help desk tickets and empowers technicians of all skill levels to resolve tickets quickly.

Panthera logs every privileged account change, including creation, disabling, deletion and password changes, and alerts on high-risk activity.

Self-Service Password Reset enables end users to quickly, easily, and securely reset their passwords, potentially eliminating up to 95% of password reset tickets.

A vault where the provider never holds the encryption keys, so it can't read what's stored. Panthera's vault stays zero-knowledge even while it rotates credentials, which is rare even in enterprise PAM.