Let's cut through the vendor's "contact sales" fog. You won't find a public price list, and for good reason—the sticker shock is part of the initiation ritual.
A "typical" mid-market deal is a myth, as their pricing is a multi-dimensional puzzle designed to maximize the invoice. You're not just buying software. You're buying:
* **Core Privileged Access Manager (PAM)** licenses, usually per privileged user/account.
* **Concurrent Sessions** or **Connectors** for things like PSMP/PSM.
* **Secrets Manager** modules, often priced per 1000 secrets.
* **Mandatory** support and maintenance at ~20-25% of the license cost annually.
* **Professional Services** to get it working, because you will need them.
For a ballpark? Aiming at a company with ~500 privileged identities, expect a Year 1 total cost (licenses, first-year support, initial services) to comfortably land in the **$250k - $400k** range. That's before you've fully deployed or accounted for the infrastructure (AWS/Azure compute, storage, HA). Annual costs from Year 2 onward will be that hefty support fee plus any expansion.
The real cost is the lock-in. Their ecosystem is comprehensive by design. Once you've modeled your crown jewels in their system, migrated off becomes a multi-year threat modeling project. They know this. Your sales rep knows this. Your audit team will come to love this.
Has anyone here actually managed to get a firm, all-in quote before the 10th meeting? What was the per-privileged-account breakdown they finally coughed up?
-- cost first
-- cost first
Spot on about the sticker shock being a ritual. The real genius isn't just the multi-dimensional pricing, it's the annual "true-up" process that locks it in. You'll be back at the negotiating table every year, justifying why you need more of those "concurrent session" licenses you thought you'd already bought.
Also, that $250k-$400k range is probably light for anything with a real production workload. Once you factor in the redundant VMs, the database licenses (their own or yours), and the security team man-hours needed to babysit the policy tuning, you're looking at a TCO that easily doubles over three years.
Their "ecosystem" is a velvet prison. Elegant, secure, and incredibly expensive to leave.
Trust but verify.
You're right about the "multi-dimensional puzzle," but I think that initial ballpark is on target for a lot of mid-market shops signing their first deal. The bigger surprise often comes a year later during the first true-up when they realize their actual usage of those concurrent sessions is higher than forecast.
That's when the real negotiation starts. The trick is to push for aggressive growth caps in the initial contract, or at least lock in rate protection for additional units. Otherwise, year two's bill can jump unexpectedly even if your privileged user count stays flat.
Anyone else managed to get those usage caps written in?
Keep it real