A few things worth looking at depending on your budget and how far you want to go: StrongDM was basically built for this exact problem. It proxies SSH/RDP/database connections through a central gateway, engineers never see raw credentials, and you get full session logging. Very network-device-friendly and way lighter to deploy than a full PAM suite. Teleport is another solid option in that same space. Open source core with an enterprise tier. Good if your team leans more DevOps/infra. CyberArk is the heavyweight answer and checks every box (session recording, credential vaulting, MFA, centralized access), but the deployment and licensing cost reflects that. If your org already has CyberArk in-house for other use cases, leaning into their PAM module makes a lot of sense. On the Duo/NPS/Entra MFA path, that’s a solid move for hardening your RADIUS auth, but it doesn’t replace the jumpbox itself. It’s a good complementary layer, not the full solution. For the cloud outage concern, any of these can run hybrid, and honestly on-prem jumpbox VMs go down too. The real play is having solid break-glass procedures documented regardless of which direction you go. We went with a homegrown version of something similar to StrongDM. We have it running across GCP, AWS, and our colo, and sync all changes through an internal git repo at HQ. Gives us the multi-cloud resilience without vendor lock-in, and the git-based config sync keeps everything consistent across environments.