By organisation size · verified July 2026
PAM for Mid-Market 2026
Privileged Access Management options for mid-market firms with 100 to 1,000 privileged admins. ManageEngine PAM360 published list anchors the on-premise option; Okta and JumpCloud anchor the SaaS option; Delinea, BeyondTrust and CyberArk enter the shortlist for regulated verticals.
Direct Answer
What does PAM cost for a mid-market firm in 2026?
Published list anchors for mid-market: ManageEngine PAM360 at approximately $800/admin/year (entry tier), Okta Essentials Suite at $204/user/year (includes PAM at 0.5 RU). JumpCloud's PAM-bearing Platform Prime tier is now quote-only (PAM delivered via VaultOne, acquired May 2025). CyberArk, BeyondTrust, and Delinea do not publish per-admin rates. Ask the vendor directly for: (a) per-admin or per-secret rate at your volume, (b) annual escalator clause, (c) implementation fee. We do not infer rates we cannot cite to the vendor.
Published-pricing options for mid-market
| Vendor | Anchor | Best for |
|---|---|---|
| ManageEngine PAM360 | ~$800/admin/yr (entry tier) | On-premise deployment, published list, ManageEngine ecosystem |
| Okta Essentials Suite | $204/user/yr | SaaS, identity-suite consolidation (SSO+MFA+governance basics+PAM); Professional/Enterprise quote-only |
| JumpCloud Platform Prime | Quote only | SaaS, PAM via VaultOne (acquired May 2025); Platform Prime tier no longer publishes a per-user rate |
| Teleport Enterprise | Quote only (per-resource) | Cloud-native engineering access, beyond Community Edition cap |
Quote-only options that enter the mid-market shortlist
- CyberArk: enterprise PAM leader, increasingly mid-market via CyberArk Identity Cloud.
- BeyondTrust: enterprise leader, mid-market via SaaS Password Safe.
- Delinea: strongest mid-market traction of the enterprise leaders; Secret Server free trial helps.
- Wallix: EU mid-market leader, particularly regulated verticals.
- StrongDM: zero-trust infrastructure access, cloud-native mid-market.
Worked example: 300-admin regulated mid-market
Acme RegHealth Co. (illustrative example, not a real company) is a 300-admin regulated healthcare firm running an RFP.
ManageEngine PAM360 Professional approx 300 x $1,000/yr~$300,000/yr
Okta Essentials Suite 300 x $204/yr (includes PAM)$61,200/yr
Okta Professional / Enterprise Suite (with full IGA)Quote required
JumpCloud Platform Prime (PAM via VaultOne)Quote required
CyberArk / BeyondTrust / Delinea quotesRequired, multi-year
Published-rate spread$61K to $300K/yr; quote-only adds on top
How to scope the RFP
- Deployment preference. SaaS only? On-premise required? Appliance acceptable? This narrows the list immediately.
- Identity-suite consolidation. Already on Okta or Microsoft Entra? Then identity-suite PAM is a one-contract uplift.
- Engineering-access scope. Heavy SSH, Kubernetes, DB? Teleport / StrongDM / Boundary may join the shortlist alongside the central PAM.
- Module scope. Vault only? Vault + session? Vault + session + endpoint privilege + secrets? This determines whether quote-only enterprise platforms are worth the procurement runway.
See also
- PAM for SMB: under 100 admins.
- PAM for enterprise: above 1,000 admins.
- PAM buying guide.
- Run the calculator.
Last verified June 2026 · Next refresh September 2026