How Vendors Price Privileged Access Management (PAM)
Five pricing models dominate the PAM market in 2026. Knowing which model applies to your shortlisted vendors is the difference between a fair side-by-side comparison and a $200K mistake.
1. Per-user-per-month (SaaS)
The model most procurement teams are used to from SaaS in general. Vendor publishes a per-user-per-month rate, with annual billing typically discounted vs monthly. Most vendors in this category have a free tier or time-limited trial.
Vendors
- Keeper Business: $3.75/user/month annual ($45/user/year).
- JumpCloud: $9 to $24/user/month annual depending on package.
- Okta Workforce Identity Suites: $17 to $28/user/month annual.
Best for
SMB and mid-market buyers wanting predictable per-seat cost and SaaS deployment. Annual billing the norm; switching cost is configuration time, not licence sunk cost.
2. Per-administrator-per-year (self-hosted list)
Published per-admin annual rate, typically with a key or resource cap. The buyer pays for additional admin packs and key packs separately.
Vendors
- ManageEngine PAM360: $7,995/year Standard (10 admins, 25 keys), approximately $9,995/year Professional, approximately $13,995/year Enterprise.
Best for
Mid-market and enterprise buyers wanting on-premise deployment with a public anchor. Procurement-team-friendly because the headline number is real.
3. Open-source free
Community Edition is free under an OSI-approved licence. Commercial path is quote-only.
Vendors
- Teleport Community Edition: AGPL, free under 100 employees and under $10M annual revenue.
- HashiCorp Boundary Community Edition: MPL 2.0, free self-hosted.
Best for
Engineering-led teams that want the control plane in-house and have the operational capacity to run HA, upgrades, audit log retention and IdP integration. Crossing the eligibility cap triggers commercial conversion.
4. Per-resource (quote)
The vendor charges per resource (server, database, Kubernetes cluster, app) rather than per admin. Quote-only; useful when you have many admins but few resources, or few admins but many resources.
Vendors
- Teleport Enterprise: per-resource, quote-only.
Best for
Cloud-native organisations with disproportionate resource counts (microservice architectures with thousands of Kubernetes pods accessed by a small SRE team).
5. Bundle-quote (enterprise)
Sales-led pricing with multi-year commit, multi-module bundle, and implementation services scoped separately. The headline figure is rarely the per-admin cost; it is a platform contract.
Vendors
- CyberArk: Identity Security Platform.
- BeyondTrust: Identity Security Platform.
- Delinea: Secret Server + modules.
- One Identity Safeguard: Safeguard family.
- Wallix: PAM4ALL platform.
- Saviynt: Identity Cloud (PAM as module).
- StrongDM: Essentials / Platform / Platform Plus.
- KeeperPAM: bundle add-on on Keeper Business / Enterprise.
- Segura: full-suite PAM modules.
Best for
Regulated enterprises that need full-suite PAM with mainframe / legacy / cloud coverage and have the procurement runway for a 3-6 month evaluation.
How to normalise across models
The fair side-by-side comparison normalises to per-admin-per-year USD. For per-user-per-month SaaS vendors multiply by 12. For per-admin-per-year vendors divide the published bundle by the admin count it covers. For open-source vendors, the comparison is zero at qualifying scale and quote-only above. For per-resource and bundle-quote, you cannot normalise without a quote. See methodology for the full calculator model.