Which of these accounts onboarding methods is considered proactive?

A Rest API integration with account provisioning software is considered a proactive account onboarding method, because it enables the automatic creation and management of accounts in the Vault as soon as they are provisioned in the target systems. This way, the accounts are secured from the start and do not need to be discovered or onboarded manually later. A Rest API integration with account provisioning software can be achieved by using the CyberArk Accounts Feed REST API, which allows external applications to send account information to the Vault1.

The other options are not proactive account onboarding methods, because they rely on the discovery of existing accounts that may have been exposed or compromised before being onboarded to the Vault. Accounts Discovery is a feature that enables the Vault to scan target systems and identify privileged accounts that are not managed by the Vault2. Detecting accounts with PTA is a feature that enables the Privileged Threat Analytics (PTA) component to detect and alert on suspicious account activities and credential thefts3. A DNA scan is a feature that enables the Discovery and Audit (DNA) tool to scan Windows and Unix machines and generate a report on the privileged accounts and vulnerabilities found4.

References:

CyberArk Accounts Feed REST API - CyberArk, section “CyberArk Accounts Feed REST API”

Accounts Discovery - CyberArk, section “Accounts Discovery”

Detect and Respond to Privileged Account Threats - CyberArk, section “Detect and Respond to Privileged Account Threats”

CyberArk DNA - CyberArk, section “CyberArk DNA”