I'm digging into Delinea's Secret Server and Privilege Manager, but I'm stuck on a fundamental budgeting question. Their pricing, like most PAM vendors, seems to be per privileged account. I need to map that to actual headcount and systems before I can even start a trial.
My understanding is that it's not just human admin users. Could someone confirm or correct this breakdown?
From what I've reverse-engineered, a 'privileged account' likely includes:
* **Human Users:** Any individual (IT admin, DevOps engineer, 3rd-party contractor) who needs access to a privileged credential.
* **Local Administrator Accounts:** The built-in admin/root accounts on servers, workstations, and network devices.
* **Service Accounts:** Accounts used by applications or services to access databases, APIs, or other systems. These often have high privileges.
* **SSH Keys & API Keys:** Used for machine-to-machine access, which is a form of non-human privileged credential.
* **Secrets:** Application passwords, database connection strings, and other sensitive data that needs to be secured and rotated.
If all of the above count, the cost can scale quickly. For a mid-sized AWS environment, you might have 50 engineers, but potentially thousands of service accounts, instance roles, and automated secrets.
Is there a standard industry definition they use? More importantly, how does Delinea's licensing actually meter this? Per account vaulted, per account managed, or something else? I'm trying to build an accurate TCO model and this is the biggest variable.
You're mostly right, but you're mixing two different things: the *account* itself and the *secret* for it. That's where the budgeting gets messy.
Vendors usually charge for the *credential object* they're managing and rotating. That means your local admin account is one line item, the SSH key for your CI/CD pipeline is another, and that database connection string is a third. The human user who checks them out might not even factor into the count.
Your AWS example is the key. If you have 100 EC2 instances each with a local admin account and an application service account, that's 200 privileged accounts right there, before you've added a single human. That's why the cost scales.
Integration is not a project, it's a lifestyle.
Yeah, that breakdown is spot-on. You've hit the core budgeting pain point - the sheer volume of non-human credentials.
A real kicker people forget is *ephemeral* accounts. Think temporary AWS IAM roles assumed by your CI/CD system, or a container service account that only lives for minutes. Some vendors charge for those as they're vaulted secrets, others might not if they're truly short-lived. It's a question worth asking the sales rep.
Your AWS example is the perfect mental model. Count every instance, every database user, every app config secret. That total is your starting number, and it's usually a shock 😅
APIs > promises
Your list is exactly what you'll be charged for. The only item you're missing is that *privileged* secret.
That's the critical filter. Don't waste budget vaulting a read-only API key. The real budget killer is every single service account in your CI/CD pipeline, your database connectors, and those shared admin keys on firewalls you forgot about.
Start your count there, then double it. You'll be closer to the true number.
Trust but verify – and audit