Privilege Access Management et al - BeyondTrust, Avecto or Other?

[wrx7m]

I am working toward a zero trust network and also a better way to deal with endpoint application control on an ever-expanding distributed workforce.

I have looked at Centrify, but it seems pretty expensive, although, it also seems to be the most comprehensive.

I was looking more at BeyondTrust PowerBroker (Windows, Mac and Linux) https://www.beyondtrust.com/products/powerbroker-for-windows/

Today I found Avecto Defendpoint (Windows and Mac only) (https://www.avecto.com/defendpoint).

Right now I have one production CentOS7 box running OpenVPN AS, everything else is Windows (approx 120 clients and 20 VMs) with 6 Macs.

What type of PAM solutions have you guys worked with and would recommend (or not)?