9 of 15 vendors covered · no inferred rates · contact sales required
Quote-Only PAM Vendors
CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM and Segura all decline to publish per-admin pricing. We do not fabricate a number. Each dossier explains what the vendor does, why they don't publish, and where to start a procurement conversation.
Direct Answer
Why don't these PAM vendors publish per-admin pricing?
Enterprise PAM pricing is sales-led because the buyer is signing a multi-year contract bundling vault, session management, secrets, endpoint privilege management and analytics modules. Publishing per-admin rates would anchor the contract negotiation and reveal volume discounts that vary by vertical.
Our interest is in not making up numbers. A figure that the vendor would disavow on a call is worse than no figure at all.
The nine vendors
One dossier per vendor below. Same depth as our published-pricing vendors, minus the price rows, plus an explicit "contact sales" CTA in place of the rate card.
CyberArk
CyberArk Identity Security Platform
Deployment
SaaS (CyberArk Identity Security Platform) or self-hosted
Best for
Large regulated enterprises needing market-leading PAM coverage and compliance recognition
CyberArk does not publish per-user or per-admin pricing. CyberArk is the long-standing market leader in legacy enterprise PAM (Privileged Access Manager, formerly Privileged Account Security Solution). Pricing is enterprise sales-led, multi-year, and bundled into a per-vertical commercial. Recognised as a Leader by Gartner in the Privileged Access Management Magic Quadrant.
- Pricing not publicly disclosed by CyberArk. Contact CyberArk sales.
- Recognised as a Leader in the Gartner Privileged Access Management Magic Quadrant.
- Deepest coverage of legacy on-premise privileged accounts (Windows, Unix, mainframe, network devices).
- Identity Security Platform consolidates PAM, Endpoint Privilege Management, Secrets Management, Cloud Privilege Security.
Status verified 2026-06-17
BeyondTrust
BeyondTrust Password Safe
Deployment
SaaS or self-hosted
Best for
Enterprises wanting integrated PAM, Endpoint Privilege Management, Remote Support and vulnerability management
BeyondTrust does not publish per-user or per-admin pricing for Password Safe (PAM) or for the broader BeyondTrust Identity Security Platform. Recognised as a Leader by Gartner in the Privileged Access Management Magic Quadrant. Pricing is enterprise sales-led.
- Pricing not publicly disclosed by BeyondTrust. Contact BeyondTrust sales.
- Recognised as a Leader in the Gartner Privileged Access Management Magic Quadrant.
- Strong fit for organisations consolidating PAM with Remote Support (formerly Bomgar) and Endpoint Privilege Management.
- Password Safe is the credential vault; Privileged Remote Access is the session broker; both typically licensed together.
Status verified 2026-06-17
Delinea
Delinea Secret Server
Deployment
SaaS (Secret Server Cloud) or self-hosted (Secret Server)
Best for
Mid-market and enterprise wanting credential vault, session monitoring and JIT elevation across hybrid estate
Delinea (the merged Thycotic + Centrify entity) does not publish per-user or per-admin pricing for Secret Server or for the broader Delinea Platform. Recognised by Gartner as a Leader in the Privileged Access Management Magic Quadrant. Pricing is quote-only.
- Pricing not publicly disclosed by Delinea. Contact Delinea sales.
- Recognised as a Leader in the Gartner Privileged Access Management Magic Quadrant.
- Secret Server (vault + session) and Privileged Behavior Analytics commonly licensed together.
- Server Suite (formerly Centrify) covers Unix/Linux privilege elevation and AD bridging.
Status verified 2026-06-17
One Identity
One Identity Safeguard for Privileged Passwords
Deployment
Hardened virtual appliance (Safeguard) or hardware appliance
Best for
Enterprises with heavy Active Directory and Unix estates wanting integrated privileged password + session + analytics
One Identity does not publish per-user or per-admin pricing for the Safeguard family. Recognised by Gartner as a Leader in the Privileged Access Management Magic Quadrant. Pricing is enterprise sales-led, often bundled with One Identity Manager (identity governance) and Active Roles (AD management).
- Pricing not publicly disclosed by One Identity. Contact One Identity sales.
- Recognised as a Leader in the Gartner Privileged Access Management Magic Quadrant.
- Safeguard for Privileged Passwords (vault) + Safeguard for Privileged Sessions (session broker) + Safeguard for Privileged Analytics commonly licensed together.
- Hardened-appliance deployment model (virtual or physical) is distinctive in the market.
Status verified 2026-06-17
Wallix
Wallix Bastion (PAM4ALL platform)
Deployment
Self-hosted appliance, SaaS option for some modules
Best for
European enterprises and regulated EU verticals wanting an EU-headquartered PAM under EU contract
Wallix does not publish per-user or per-admin pricing. European PAM vendor (HQ Paris) particularly strong in EMEA and regulated verticals (utilities, healthcare). Pricing is sales-led; quotes are typically in EUR.
- Pricing not publicly disclosed by Wallix. Contact Wallix sales.
- Recognised in the Gartner Privileged Access Management Magic Quadrant.
- EU-headquartered (France), strong public-sector and critical-infrastructure adoption.
- PAM4ALL platform brings session management, password vault, access governance under one console.
Status verified 2026-06-17
Saviynt
Saviynt Identity Cloud (with Privileged Access Management)
Deployment
SaaS (Saviynt Identity Cloud)
Best for
Enterprises converging IGA, PAM, third-party access and CIEM on a single SaaS platform
Saviynt does not publish per-user or per-admin pricing. Cloud-native converged identity and PAM platform; PAM is delivered as a module of the broader Identity Cloud. Recognised in the Gartner Privileged Access Management Magic Quadrant.
- Pricing not publicly disclosed by Saviynt. Contact Saviynt sales.
- Recognised in the Gartner Privileged Access Management Magic Quadrant.
- PAM is a module of the broader Identity Cloud (which also covers IGA, third-party access governance, Cloud Identity Governance).
- Strong fit for buyers consolidating identity governance + PAM in one contract.
Status verified 2026-06-17
StrongDM
StrongDM Zero Trust PAM Platform
Deployment
SaaS (StrongDM control plane) plus local relay gateways
Best for
Engineering-led teams wanting modern zero-trust infrastructure access with strong DB and Kubernetes coverage
StrongDM does not publish per-user or per-admin pricing. The pricing page lists per-user editions (Essentials, Platform, Platform Plus) but the numeric rates are gated behind a sales contact. Modern zero-trust PAM with a strong focus on infrastructure access (SSH, DB, Kubernetes).
- Pricing not publicly disclosed by StrongDM. Contact StrongDM sales.
- Three published edition names (Essentials, Platform, Platform Plus) but no numeric rate on the page.
- Strong fit for cloud-native infrastructure access (databases, Kubernetes, SSH, Windows RDP) with zero-trust posture.
- Session recording, query-level audit and just-in-time access on Platform and above.
Status verified 2026-06-17
KeeperPAM
KeeperPAM (add-on to Keeper Business / Enterprise)
Deployment
SaaS, zero-knowledge
Best for
Existing Keeper Business or Enterprise customers wanting the dedicated PAM bundle in the same console
KeeperPAM is the dedicated PAM bundle from Keeper Security (Connection Manager + Secrets Manager + Remote Browser Isolation). Keeper now publishes the PACKAGING but not the price: four volume tiers scoped by non-human identities and monthly workloads, with every tier routing to a quote. Keeper states it charges per user, billed annually.
- KeeperPAM bundle pricing is still not publicly disclosed. Every tier routes to Request a Quote.
- Keeper does now publish the packaging: Tier 1 covers 25 to 99 non-human identities and 5,001 to 25,000 monthly workloads, Tier 2 covers 100 to 249 NHIs and 25,001 to 250,000 workloads, Tier 3 covers 250 to 749 NHIs and 250,001 to 1,000,000 workloads, and Enterprise covers 750+ NHIs and over 1,000,000 workloads.
- Keeper publishes one free allowance: up to 24 annual active NHIs transacting through the Keeper Gateway and 5,000 monthly workloads at no additional cost.
- Keeper states it charges per user, billed annually, for KeeperPAM.
- Bundle includes Keeper Connection Manager (privileged session), Secrets Manager (machine-to-machine secrets), Remote Browser Isolation.
- Zero-knowledge architecture inherited from the underlying Keeper vault.
Status verified 2026-09-23
Segura
Segura PAM Platform (formerly senhasegura)
Deployment
Self-hosted or SaaS
Best for
Mid-market and enterprise wanting full-suite PAM with appliance or SaaS deployment options
Segura (the rebranded senhasegura platform) does not publish per-user or per-admin pricing. The vendor's dedicated PAM-pricing page states pricing is calculated per customer requirements. Latin-American-origin PAM vendor with strong global reach, recognised in the Gartner Privileged Access Management Magic Quadrant.
- Pricing not publicly disclosed by Segura. Contact Segura sales.
- Recognised in the Gartner Privileged Access Management Magic Quadrant.
- Rebranded from senhasegura in 2024.
- Full-suite PAM (credential vault, session management, JIT, certificate management, DevOps secrets).
Status verified 2026-06-17
Operational consequences of vendor opacity
- Procurement cycle 6-12 weeks minimum. Demo, discovery, RFI, commercial conversation, legal review, contract negotiation.
- You cannot benchmark without an NDA. Most quote-only PAM vendors will quote only under NDA. You cannot circulate the number internally for board sign-off without legal review.
- Volume and vertical discounts vary widely. Banking, federal, healthcare and critical-infrastructure quotes typically differ by 20-50% even for identical admin counts.
- Multi-year commit is the default. Quote-only PAM vendors typically discount only on 3-5 year commitments. The annual escalator (typically 3-7%) is negotiable but not always surfaced in the headline number.
- Hidden costs often sit in modules and services, not per-admin. A vendor that quotes $400/admin/year may charge $250,000 implementation, $100,000 annual platform fee, and separately licensed Endpoint Privilege Manager, Secrets Hub or Privileged Behavior Analytics modules.
How to run a procurement against quote-only PAM vendors
If you must include quote-only vendors in your shortlist, run the procurement in parallel tracks. Track A: the published-pricing vendors (Teleport, HashiCorp Boundary, Keeper Business, JumpCloud, Okta, ManageEngine PAM360) where you can build a working cost model in an afternoon using our calculator. Track B: the quote-only vendors, where you brief them with the same admin count, module scope, timeline and integration list and ask for a written quote with an expiry date. The headline anchor from Track A becomes your reference for Track B negotiation.
Why we will not publish inferred numbers
Cost-comparison sites that publish "estimated $1,000-$3,500 per admin/year" for quote-only PAM vendors are inferring from old leaked contracts, third-party marketplace pages, or vendor PR. Those numbers age badly and the vendor can disavow them. Our policy is to publish what the vendor publishes, and to point readers to the vendor's contact page for the rest.
Related reading
- Calculator runs only on the six published-pricing vendors.
- Methodology is the data-integrity policy.
- Sources registry of every URL we cite.
- PAM buying guide.
- PAM RFP template.
Verification date shown per vendor row · Keeper re-verified September 2026