Privileged Access Management Pricing 2026: 15 PAM Vendors Compared
Per-admin and per-user privileged access management pricing the vendors will not put in writing. ManageEngine PAM360 $7,995/yr (10 admins Standard), Keeper Business $3.75/user/mo, JumpCloud Device Management $9/user/mo, Okta Essentials Suite $17/user/mo (PAM at 0.5 RU), Teleport Community free under 100 emp / $10M rev, HashiCorp Boundary Community free. CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM and Segura are sales-led; we do not fabricate numbers. No demo, no NDA, no email gate.
The gap between the cheapest published anchor and the typical quote-only-enterprise-leader contract is large, and the matrix below shows exactly where each vendor lands on published pricing. Quote-only vendors are listed with a contact-sales link, not an inferred rate.
Privileged Access Management cost calculator
Tune your number of privileged admins. The calculator runs published list prices for the 6 vendors that publish rates (Teleport, HashiCorp Boundary, Keeper Business, JumpCloud, Okta, ManageEngine PAM360). The 9 quote-only vendors are surfaced below with contact links and no inferred numbers.
Informational only; cost is per-admin in the published rates.
Informational only; affects vendor-fit guidance.
| Rank | Vendor | Annual | Per admin/year (effective) | Notes |
|---|---|---|---|---|
| 1 | HashiCorp open source free | $0 | $0 | Boundary Community Edition is free. HCP Boundary bills session-time hours, not per admin; we do not infer a per-admin annual number. |
| 2 | Keeper Security per user per month | $11,250 | $45.00 | Keeper Business password vault ($3.75/user/mo x 12). The dedicated KeeperPAM bundle add-on is quote-only on top of this rate. |
| 3 | JumpCloud per user per month | $27,000 | $108 | Device Management package ($9/user/mo x 12). Platform Prime, which includes JumpCloud Privileged Access Manager, is $288/user/yr. |
| 4 | Okta tiered subscription | $51,000 | $204 | Essentials Suite annual list ($17/user/mo x 12). Premium Suite is $336/user/yr; choose Premium if Identity Governance or Identity Threat Protection are on your RFP. |
| 5 | ManageEngine per admin per year | $200,000 | $800 | Estimate scales the published $7,995/year (10 admins) Standard floor at approx $800/admin/year. Real list-price scaling involves admin packs and key packs. |
| Q | Teleport Quote only | Pricing not publicly disclosed by Teleport. Contact Teleport sales. | ||
| Q | CyberArk Quote only | Pricing not publicly disclosed by CyberArk. Contact CyberArk sales. | ||
| Q | BeyondTrust Quote only | Pricing not publicly disclosed by BeyondTrust. Contact BeyondTrust sales. | ||
| Q | Delinea Quote only | Pricing not publicly disclosed by Delinea. Contact Delinea sales. | ||
| Q | One Identity Quote only | Pricing not publicly disclosed by One Identity. Contact One Identity sales. | ||
| Q | Wallix Quote only | Pricing not publicly disclosed by Wallix. Contact Wallix sales. | ||
| Q | Saviynt Quote only | Pricing not publicly disclosed by Saviynt. Contact Saviynt sales. | ||
| Q | StrongDM Quote only | Pricing not publicly disclosed by StrongDM. Contact StrongDM sales. | ||
| Q | KeeperPAM Quote only | Pricing not publicly disclosed by KeeperPAM. Contact KeeperPAM sales. | ||
| Q | Segura Quote only | Pricing not publicly disclosed by Segura. Contact Segura sales. | ||
The 3-band answer
Most PAM procurements fall into three clear bands by number of privileged admins. The band most regulated mid-market buyers want is the middle one, 250 to 1,000 admins, where ManageEngine PAM360 published list price (approximately $800/admin/year on Standard) and Okta Premium Suite ($336/user/year, including Identity Governance) both sit. The lowest band, under 50 admins, is dominated by free tiers (Teleport Community, HashiCorp Boundary Community) and the cheapest paid SMB rates (Keeper Business, JumpCloud Device Management). The highest band, above 1,000 admins, is where most quote-only vendors actually operate, including CyberArk, BeyondTrust, Delinea and Saviynt.
Teleport Community Edition free under 100 employees and $10M revenue. HashiCorp Boundary Community free, self-hosted. JumpCloud free up to 10 users + 10 devices. Keeper Business $3.75/user/month annual once you outgrow free tiers.
ManageEngine PAM360 published list price at approximately $800/admin/yr Standard. Okta Essentials Suite $204/user/yr (PAM at 0.5 RU). JumpCloud Platform Prime $288/user/yr (includes Privileged Access Manager). Quote- only enterprise leaders enter the shortlist here for regulated verticals.
CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM and Segura all require a sales call at this volume. Multi-year commit with vault + session + secrets + endpoint privilege management bundled is the default contract shape.
All 15 PAM vendors at a glance
Sorted by ascending per-admin-per-year anchor, then quote-only vendors. Every cell links to the vendor's own pricing page (where one exists) and to a per-vendor dossier on this site. Nine vendors flagged Quote Only have no publicly disclosed price; we do not fabricate numbers for them, we link to their contact pages.
| Vendor | Pricing | Cheapest published rate | Per-admin/yr anchor | Pricing model | Deployment |
|---|---|---|---|---|---|
| Teleport Teleport Access Platform (Community Edition) | Public | Free, Community Edition (under 100 emp, under $10M rev) | Free at qualifying scale | open source free | Self-hosted (Community) or Teleport Cloud (Enterprise) |
| HashiCorp HashiCorp Boundary (Community Edition) | Public | Free, Boundary Community Edition (MPL 2.0) | Free at qualifying scale | open source free | Self-hosted (Community), HCP Boundary (managed), Boundary Enterprise (self-hosted commercial) |
| Keeper Security Keeper Business | Public | $3.75/user/month, Business tier (annual) | ~$45/admin/yr | per user per month | SaaS (multi-region), zero-knowledge architecture |
| JumpCloud JumpCloud Open Directory Platform | Public | $9/user/month, Device Management package (annual) | ~$108/admin/yr | per user per month | SaaS |
| Okta Okta Privileged Access (in Workforce Identity Cloud) | Public | $17/user/month, Essentials Suite (includes PAM at 0.5 RU) | ~$204/admin/yr | tiered subscription | SaaS (Okta-managed multi-tenant cloud) |
| ManageEngine ManageEngine PAM360 | Public | $7,995/year, 10 admins + 25 keys, English Standard subscription | ~$800/admin/yr | per admin per year | Self-hosted (on-premise or customer-cloud), SaaS option available |
| BeyondTrust BeyondTrust Password Safe | Quote Only | Quote only - contact BeyondTrust sales | Quote only | quote only | SaaS or self-hosted |
| CyberArk CyberArk Identity Security Platform | Quote Only | Quote only - contact CyberArk sales | Quote only | quote only | SaaS (CyberArk Identity Security Platform) or self-hosted |
| Delinea Delinea Secret Server | Quote Only | Quote only - contact Delinea sales | Quote only | quote only | SaaS (Secret Server Cloud) or self-hosted (Secret Server) |
| KeeperPAM KeeperPAM (add-on to Keeper Business / Enterprise) | Quote Only | Quote only (requires Keeper Business or Enterprise prerequisite) | Quote only | quote only | SaaS, zero-knowledge |
| One Identity One Identity Safeguard for Privileged Passwords | Quote Only | Quote only - contact One Identity sales | Quote only | quote only | Hardened virtual appliance (Safeguard) or hardware appliance |
| Saviynt Saviynt Identity Cloud (with Privileged Access Management) | Quote Only | Quote only - contact Saviynt sales | Quote only | quote only | SaaS (Saviynt Identity Cloud) |
| Segura Segura PAM Platform (formerly senhasegura) | Quote Only | Quote only - contact Segura sales | Quote only | quote only | Self-hosted or SaaS |
| StrongDM StrongDM Zero Trust PAM Platform | Quote Only | Quote only - contact StrongDM sales | Quote only | quote only | SaaS (StrongDM control plane) plus local relay gateways |
| Wallix Wallix Bastion (PAM4ALL platform) | Quote Only | Quote only - contact Wallix sales | Quote only | quote only | Self-hosted appliance, SaaS option for some modules |
Why privileged access management pricing varies
The dispersion in PAM pricing is real and it has four structural drivers, none of which is "market chaos".
- Open-source vs proprietary. Teleport and HashiCorp Boundary both ship a Community Edition that is free at small scale. The licence model (AGPL for Teleport, MPL 2.0 for Boundary) and the qualifying scale cap (Teleport: under 100 employees and under $10M revenue) determine when the procurement conversation actually starts.
- Per-user-per-month vs per-admin-per-year. Keeper, JumpCloud and Okta price per user per month annual. ManageEngine PAM360 prices per administrator per year with a key cap. CyberArk, BeyondTrust and Delinea price per quote bundle including session, vault and analytics modules. Normalising to per-admin-per-year is the only honest cross-vendor comparison.
- Bundled vs add-on full PAM functionality. Keeper Business at $3.75/user/mo is the password vault only; the dedicated KeeperPAM bundle (Connection Manager + Secrets Manager + Remote Browser Isolation) is quote-only on top. Okta's $17 Essentials Suite includes Privileged Access at 0.5 RU, not as a stand-alone SKU; the real number for Identity Governance + Threat Protection RFPs is the $28 Premium Suite.
- Deployment model. SaaS vendors (Keeper, JumpCloud, Okta) price per user. On-premise / self-hosted vendors (ManageEngine, One Identity, Wallix, sometimes Delinea) often add hardware appliance, HA pair, certificate management and database licence on top of the headline figure.
The nine vendors that won't quote a price
CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM and Segura all require a sales call to learn the price. We do not infer historical or mid-market rates for them. See the quote-only vendors deep dive for the operational consequences of vendor opacity in PAM procurement.
By organisation size
Different sizes have different PAM economics. SMBs typically run JumpCloud, Keeper or Teleport Community on a single-platform contract. Mid-market buyers run ManageEngine PAM360 or Okta Workforce Identity Suite, often alongside Teleport for engineering access. Enterprises run CyberArk, BeyondTrust or Delinea as the system-of-record with a separate engineering-access tool (Teleport, StrongDM, HashiCorp Boundary) for cloud-native workloads.
- PAM for SMB: under 100 admins, free tiers and per-user SaaS.
- PAM for mid-market: 100 to 1,000 admins, ManageEngine and Okta dominate.
- PAM for enterprise: above 1,000 admins, quote-only leaders.
Per-vendor dossiers
Each dossier includes pricing-model explainer, full rate table where published, worked example and source URL. Six published-pricing vendors plus nine quote-only vendors.
Head-to-head comparisons
- CyberArk vs BeyondTrust: enterprise leaders, both quote-only.
- CyberArk vs Delinea: legacy enterprise vs merged Thycotic+Centrify.
- Teleport vs StrongDM: cloud-native engineering access.
- Okta vs CyberArk: identity-suite PAM vs dedicated PAM leader.
- ManageEngine vs Delinea: published list vs quote-only mid-market.
Topical guides
- Privileged access management pricing 2026 ultimate guide.
- Hidden Privileged Access Management (PAM) costs: implementation, modules, hardware.
- How vendors price Privileged Access Management (PAM): per-admin, per-user, per-resource, quote.
- Privileged Access Management (PAM) vs alternative categories: IAM, IGA, CIEM, Secrets.
- Privileged Access Management (PAM) buying guide.
- Privileged Access Management (PAM) RFP template.
- Privileged Access Management (PAM) implementation cost.
Where to go next
- Use the calculator above with your actual privileged admin count.
- For sister-site cost research, see siemcostcalculator.com (SIEM), kycpricing.com (KYC), identityverificationcost.com (IDV) and soc2compliancecost.com (SOC 2).
- For the methodology, see methodology.
- For why we treat CyberArk, BeyondTrust, Delinea, One Identity, Wallix, Saviynt, StrongDM, KeeperPAM and Segura as quote-only, see quote-only vendors.