Privileged Access Management Pricing: The Licence Is the Smallest Number

Ask what privileged access management costs and you get a range so wide it is useless: a few dollars per user per month at one end, seven figures at the other. Both are real. They are answers to different questions.

This is what is actually published, what is not, and what the four numbers in a real PAM budget are.

Which PAM vendors publish a price

We checked each vendor’s own pricing page. Not a review site, not a reseller, not an aggregator.

That table is the only cross-vendor comparison anyone can honestly publish on this question. The figures circulating in search results are mostly not list prices. They are estimates, reseller averages, or numbers reconstructed from procurement anecdotes. Some are close. Few are quotable in a business case, and none of them know your scope.

The one public anchor, and what it is good for

Since a like-for-like comparison does not exist, the single published tier table is worth reading for its shape rather than its numbers — and it is worth saying plainly that ManageEngine is not the vendor most regulated buyers end up evaluating.

Two reference points are enough. PAM360’s published subscription tiers run from roughly 8,000 USD a year at the small end to about 50,000 USD a year at the top of the published range, with a perpetual option and onboarding quoted separately. That is the order of magnitude for a mid-market platform bought off a price list, and it is a floor rather than a forecast.

The useful part is how those tiers are drawn: as a pair, not a headcount. A tier reading “10 admins / 25 keys” is breached by exceeding either. A four-person platform team managing six hundred secrets is not a ten-admin customer, whatever the org chart says. Most first quotes are wrong for exactly this reason — the buyer sizes on people, and the meter runs on objects.

Why the per-user price misleads

Most comparison articles reduce PAM to dollars per user per month. That number is rarely the one on the contract.

The four lines in a PAM budget

The licence is the line vendors compete on because it is the line buyers ask about. It is routinely the smallest of the four.

Licence. The quoted figure, for the modules and units you scoped. The only line the sales process is designed to answer.

Implementation. Discovery, integration into your directory and ticketing, onboarding accounts, building break-glass, testing failure modes. Normally a separate professional services engagement, and on a complex estate it can approach or exceed the first year of licence.

Operating time. Someone runs this — onboarding accounts, chasing rotation failures, handling elevation requests, answering audit questions. Real salaried time that almost nobody budgets, and the line that decides whether the deployment survives eighteen months. A platform nobody has time to run reverts to standing access with an expensive audit trail attached.

Renewal. Years two and three, at whatever uplift the contract permits and whatever your counts have grown to. A three-year total at today’s counts is a fiction; privileged objects do not shrink on their own.

What the Palo Alto acquisition changes

The PAM market leader is now inside a platform company that sells consolidation. That is a strategic fact rather than a criticism, but it changes what a mid-cycle buyer should be asking, and the questions are contractual rather than technical:

• Does our price protection survive a repositioning of the product inside a platform bundle? Consolidation arrives as better value, which is only better value if you wanted the rest of the suite.
• What is the support and roadmap commitment for the modules we licensed, as distinct from the platform they now sit inside?
• What is our exit path, and what does data export look like? A vault is the hardest system to leave, which is why the answer should be on paper while you still have leverage.

What to do before you take a vendor call

The scope defines every number in this market. Arriving without one means the vendor writes it for you, sized to the demo rather than to your estate.

1. 1

   Count your privileged accounts, for real

   3–5 days

   Domain and cloud admins, database superusers, application service accounts with write access to production, local administrator accounts, and the vendor logins nobody owns. Export from each console rather than estimating. This number is almost always higher than the team expects, and every quote keys on it.

2. 2

   Separate must-vault from should-govern

   2–3 days

   Shared credentials with no individual accountability need a vault. Individually attributable admin access mostly needs just-in-time elevation and review, which your directory may already do. Conflating the two buys a vault for accounts that never needed one.

3. 3

   Name who operates it, by name

   Half a day, and one difficult conversation

   Not a team — a person, with the hours costed. If that person does not exist, the honest options are to fund them, buy a smaller scope, or buy a managed deployment. Buying anyway and hoping produces shelfware with an audit finding attached.

4. 4

   Require quotes against one fixed scope

   1–2 weeks of vendor cycles

   Same account count, same secret count, same asset count, same modules, same term. Then add implementation and internal time to each before comparing. Year-one licence figures alone reliably pick the wrong platform.

5. 5

   Get years two and three in the same document

   Negotiation, not analysis

   Uplift caps, tier boundaries, and what happens when counts grow. A three-year total quoted at today's counts is not a forecast.

When a PAM platform is not the answer yet

Auditors test control outcomes, not procurement. For privileged access, what gets sampled is whether it is inventoried, granted deliberately, time-bounded, logged and reviewed.

Frameworks almost never name a product — with one exception that matters a great deal in this market. NYDFS 23 NYCRR 500.7(c) requires Class A companies to implement a privileged access management solution. A Class A company is a covered entity with at least 20 million USD in gross annual revenue from New York operations in each of the last two fiscal years, and either more than 2,000 employees or more than one billion USD in gross annual revenue, averaged over the same period and counting affiliates. If that describes you, the rule has answered the question.

For everyone else, a small estate can evidence all five outcomes with a disciplined elevation and review process on top of native tooling. Be clear-eyed about what that costs: Entra ID Privileged Identity Management requires Entra ID P2 or Entra ID Governance, not the P1 most Microsoft 365 E3 tenants hold, and Okta Privileged Access is a separate product from Workforce Identity. Neither is free. Both are usually cheaper than a dedicated platform.

A platform earns its cost when one of these is true:

• Shared or service credentials exist that no individual can be held accountable for.
• Third parties need administrative sessions into your estate.
• Session recording is required for an obligation you actually carry.
• The count of privileged objects has passed what a person can deliberately track — in our engagements, somewhere past a few hundred.
• You are in PCI DSS scope. Requirements 8.6.1 to 8.6.3, mandatory since Mar ‘25, govern interactive use of application and system accounts, prohibit hard-coded credentials in scripts and source, and set rotation against your targeted risk analysis.
• Secrets have spread into pipelines and source control, or an insurance policy or customer addendum names vaulting. Either settles the question before any risk analysis begins.

If none is true, the money buys more risk reduction elsewhere in the identity estate. If two or more are true, the platform is not the expensive option — the status quo is, and the bill arrives as an incident or a finding rather than an invoice.

Where vaultIAM fits

We do not resell licences and we do not take vendor margin. That is a structural position rather than a virtue: our recommendation on whether to buy a PAM platform at all is not paid for by the answer.

What we do is the scoping work above — the real privileged account count, the must-vault versus should-govern split, and the operating model that decides whether the platform survives the first year. Frequently that produces a smaller purchase than the one being contemplated, and occasionally none.

This is not legal advice and vaultIAM is not your auditor. Vendor prices and terms change without notice; confirm anything you intend to budget against with the vendor directly.