By organisation size · verified June 2026
PAM for Mid-Market 2026
Privileged Access Management options for mid-market firms with 100 to 1,000 privileged admins. ManageEngine PAM360 published list anchors the on-premise option; Okta and JumpCloud anchor the SaaS option; Delinea, BeyondTrust and CyberArk enter the shortlist for regulated verticals.
Direct Answer
What does PAM cost for a mid-market firm in 2026?
Published list anchors for mid-market: ManageEngine PAM360 Standard at approximately $800/admin/year, Okta Essentials Suite at $204/user/year (includes PAM at 0.5 RU), JumpCloud Platform Prime at $288/user/year (includes JumpCloud Privileged Access Manager module). CyberArk, BeyondTrust, and Delinea do not publish per-admin rates. Ask the vendor directly for: (a) per-admin or per-secret rate at your volume, (b) annual escalator clause, (c) implementation fee. We do not infer rates we cannot cite to the vendor.
Published-pricing options for mid-market
| Vendor | Anchor | Best for |
|---|---|---|
| ManageEngine PAM360 | ~$800/admin/yr (Standard) | On-premise deployment, published list, ManageEngine ecosystem |
| Okta Essentials Suite | $204/user/yr | SaaS, identity-suite consolidation (SSO+MFA+IGA+PAM) |
| Okta Premium Suite | $336/user/yr | Same as Essentials + Identity Governance + Identity Threat Protection |
| JumpCloud Platform Prime | $288/user/yr | SaaS, includes JumpCloud Privileged Access Manager |
| Teleport Enterprise | Quote only (per-resource) | Cloud-native engineering access, beyond Community Edition cap |
Quote-only options that enter the mid-market shortlist
- CyberArk: enterprise PAM leader, increasingly mid-market via CyberArk Identity Cloud.
- BeyondTrust: enterprise leader, mid-market via SaaS Password Safe.
- Delinea: strongest mid-market traction of the enterprise leaders; Secret Server free trial helps.
- Wallix: EU mid-market leader, particularly regulated verticals.
- StrongDM: zero-trust infrastructure access, cloud-native mid-market.
Worked example: 300-admin regulated mid-market
Acme RegHealth Co. (illustrative example, not a real company) is a 300-admin regulated healthcare firm running an RFP.
ManageEngine PAM360 Professional approx 300 x $1,000/yr~$300,000/yr
Okta Essentials Suite 300 x $204/yr$61,200/yr
Okta Premium Suite (with IGA) 300 x $336/yr$100,800/yr
JumpCloud Platform Prime 300 x $288/yr$86,400/yr
CyberArk / BeyondTrust / Delinea quotesRequired, multi-year
Published-rate spread$61K to $300K/yr; quote-only adds on top
How to scope the RFP
- Deployment preference. SaaS only? On-premise required? Appliance acceptable? This narrows the list immediately.
- Identity-suite consolidation. Already on Okta or Microsoft Entra? Then identity-suite PAM is a one-contract uplift.
- Engineering-access scope. Heavy SSH, Kubernetes, DB? Teleport / StrongDM / Boundary may join the shortlist alongside the central PAM.
- Module scope. Vault only? Vault + session? Vault + session + endpoint privilege + secrets? This determines whether quote-only enterprise platforms are worth the procurement runway.
See also
- PAM for SMB: under 100 admins.
- PAM for enterprise: above 1,000 admins.
- PAM buying guide.
- Run the calculator.
Last verified June 2026 · Next refresh September 2026