Privileged Access Management Pricing 2026: Ultimate Guide
Everything procurement and security teams need to evaluate privileged access management pricing in 2026. 15 vendors covered, six publish list prices, nine are quote-only. We do not fabricate numbers for the nine.
Why this matters
Privileged access management is one of the few categories where the Gartner Magic Quadrant Leaders all decline to publish per-admin pricing. That makes side-by-side procurement substantially harder than for SIEM, SSO or KYC where most vendors publish at least an entry tier. The result is that buyers run 3-6 month parallel-track procurements just to learn the headline number for shortlisted vendors.
The three procurement bands
Most PAM procurements fall into three clear bands by privileged admin count.
Band 1: Under 50 admins (SMB)
Free tiers cover most of this band. Teleport Community Edition is AGPL-free for orgs under 100 employees and under $10M revenue. HashiCorp Boundary Community is MPL-2.0-free and self-hosted. JumpCloud is free up to 10 users and 10 devices. Once you outgrow free tiers, Keeper Business ($3.75/user/mo) and JumpCloud Device Management ($9/user/mo) are the cheapest published paid rates. See PAM for SMB.
Band 2: 50-1,000 admins (mid-market)
Per-admin math matters in this band. ManageEngine PAM360 published list at approximately $800/admin/year (Standard) is the published anchor; Okta Essentials Suite at $204/user/year (includes PAM at 0.5 RU) is the SaaS published anchor; JumpCloud Platform Prime at $288/user/year is the cheapest published rate with a dedicated PAM module. Delinea, BeyondTrust and CyberArk enter the shortlist for regulated verticals. See PAM for mid-market.
Band 3: Above 1,000 admins (enterprise)
Quote-only enterprise leaders dominate this band. CyberArk, BeyondTrust, Delinea and One Identity (the PAM Magic Quadrant Leaders quadrant per the most recent Gartner Magic Quadrant for Privileged Access Management) plus Saviynt (a Leader in the separate IGA Magic Quadrant, not PAM) all operate sales-led pricing with multi-year commit, multi-module bundles and implementation services scoped separately. See PAM for enterprise.
All 15 vendors at a glance
| Vendor | Pricing | Cheapest published rate | Per-admin/yr anchor | Pricing model | Deployment |
|---|---|---|---|---|---|
| Teleport Teleport Access Platform (Community Edition) | Public | Free, Community Edition (under 100 emp, under $10M rev) | Free at qualifying scale | open source free | Self-hosted (Community) or Teleport Cloud (Enterprise) |
| HashiCorp HashiCorp Boundary (Community Edition) | Public | Free, Boundary Community Edition (MPL 2.0) | Free at qualifying scale | open source free | Self-hosted (Community), HCP Boundary (managed), Boundary Enterprise (self-hosted commercial) |
| Keeper Security Keeper Business | Public | $3.75/user/month, Business tier (annual) | ~$45/admin/yr | per user per month | SaaS (multi-region), zero-knowledge architecture |
| JumpCloud JumpCloud Open Directory Platform | Public | $9/user/month, Device Management package (annual) | ~$108/admin/yr | per user per month | SaaS |
| Okta Okta Privileged Access (in Workforce Identity Cloud) | Public | $17/user/month, Essentials Suite (includes PAM at 0.5 RU) | ~$204/admin/yr | tiered subscription | SaaS (Okta-managed multi-tenant cloud) |
| ManageEngine ManageEngine PAM360 | Public | $7,995/year, 10 admins + 25 keys, English Standard subscription | ~$800/admin/yr | per admin per year | Self-hosted (on-premise or customer-cloud), SaaS option available |
| BeyondTrust BeyondTrust Password Safe | Quote Only | Quote only - contact BeyondTrust sales | Quote only | quote only | SaaS or self-hosted |
| CyberArk CyberArk Identity Security Platform | Quote Only | Quote only - contact CyberArk sales | Quote only | quote only | SaaS (CyberArk Identity Security Platform) or self-hosted |
| Delinea Delinea Secret Server | Quote Only | Quote only - contact Delinea sales | Quote only | quote only | SaaS (Secret Server Cloud) or self-hosted (Secret Server) |
| KeeperPAM KeeperPAM (add-on to Keeper Business / Enterprise) | Quote Only | Quote only (requires Keeper Business or Enterprise prerequisite) | Quote only | quote only | SaaS, zero-knowledge |
| One Identity One Identity Safeguard for Privileged Passwords | Quote Only | Quote only - contact One Identity sales | Quote only | quote only | Hardened virtual appliance (Safeguard) or hardware appliance |
| Saviynt Saviynt Identity Cloud (with Privileged Access Management) | Quote Only | Quote only - contact Saviynt sales | Quote only | quote only | SaaS (Saviynt Identity Cloud) |
| Segura Segura PAM Platform (formerly senhasegura) | Quote Only | Quote only - contact Segura sales | Quote only | quote only | Self-hosted or SaaS |
| StrongDM StrongDM Zero Trust PAM Platform | Quote Only | Quote only - contact StrongDM sales | Quote only | quote only | SaaS (StrongDM control plane) plus local relay gateways |
| Wallix Wallix Bastion (PAM4ALL platform) | Quote Only | Quote only - contact Wallix sales | Quote only | quote only | Self-hosted appliance, SaaS option for some modules |
How PAM vendors price
Five pricing models dominate the category. See How PAM vendors price for a per-model deep dive.
- Per-user-per-month (SaaS). Keeper Business, JumpCloud, Okta. Annual billing typically discounted.
- Per-administrator-per-year (self-hosted list). ManageEngine PAM360. Published bands with key/resource caps.
- Open-source free. Teleport Community Edition (AGPL), HashiCorp Boundary Community (MPL 2.0). Commercial paths quote-only.
- Per-resource (quote). Teleport Enterprise. Counts servers, databases, Kubernetes clusters and apps separately.
- Bundle-quote. CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM, Segura. Multi-year, multi-module enterprise contracts.
Hidden costs beyond the headline
See Hidden PAM costs for the full breakdown. The big ones:
- Implementation services. 200-2,000 engineer-hours; on quote-only enterprise vendors the services dollar figure is set in the vendor or partner statement of work for your scope, not in any published benchmark.
- Module add-ons. Endpoint Privilege Manager, Secrets Hub, DevOps Secrets, Privileged Behavior Analytics are commonly separate quote lines on enterprise vendors.
- Hardware appliances. Wallix Bastion, One Identity Safeguard, BeyondTrust B Series carry per-appliance and per-maintenance cost.
- Annual escalator. 3-7% on multi-year quote-only deals; negotiable but not always headlined.
- Identity migration. Vault import, policy authoring, break-glass workflow design always understated in vendor pitches.
Running an RFP
See PAM RFP template. Key sections: functional requirements (vault, session, secrets, endpoint privilege, JIT elevation, analytics), deployment (SaaS / self-hosted / appliance), commercial terms (per-admin vs bundle, escalator, multi-year), and integration scope (AD, IdP, SIEM, ticketing).
Buying guide
See PAM buying guide. The decision tree starts with deployment preference (SaaS vs self-hosted vs appliance), then on whether identity-suite consolidation is in scope (Okta route) vs dedicated PAM platform (CyberArk, BeyondTrust, Delinea route), then on engineering-led-access scope (Teleport, StrongDM, Boundary).
Implementation cost
See PAM implementation cost. Real implementation effort is typically 200-2,000 engineer-hours; enterprise rollouts on CyberArk or BeyondTrust commonly run 6-12 months with services scoped per vendor or partner statement of work.
Adjacent categories
See PAM vs IAM vs IGA vs CIEM vs Secrets. Quick map: IAM is workforce identity (Okta, Microsoft Entra ID); IGA is access governance and certification (SailPoint, Saviynt); CIEM is cloud entitlement management (often a PAM-adjacent module); Secrets Management is machine-to-machine credentials (HashiCorp Vault, Conjur, AWS Secrets Manager).
Where to go next
- Run the calculator with your admin count.
- See the nine quote-only vendor dossiers.
- Read the methodology.
- Read the sources.