Our organization recently completed a migration from an on-premises Thycotic Secret Server (v2023.4) to Delinea Cloud (Enterprise tier). While the technical transition has been covered elsewhere, I found the pricing and cost implications to be a significant factor that required careful analysis, particularly given the shift from a perpetual/self-managed model to a SaaS subscription.
The core financial shift is moving from a large, predictable capital expenditure (capex) for licenses and infrastructure to a fully operational expenditure (opex) model. Our previous costs were relatively fixed after the initial outlay, primarily covering annual maintenance and support (approximately 22% of the initial license cost) and the underlying VM/storage overhead. With Delinea Cloud, the cost is purely user-based and scales linearly.
**Our Specific Breakdown (Approx. 500 Users):**
* **Legacy Thycotic (Annual):**
* Support & Maintenance Renewal: **$28,500**
* Infrastructure (VM compute, storage, backup, networking): **~$9,200**
* **Total Annual Recurring:** **~$37,700**
* _Note: This excludes the initial perpetual license capex, which was amortized over 5 years._
* **Delinea Cloud (Annual List Price):**
* Enterprise Tier, per-user cost (as quoted): **$108/user/year**
* Calculation: 500 users * $108 = **$54,000**
* **Total Annual Recurring:** **$54,000**
At face value, this represents a **~43% increase** in annual recurring charges. However, a direct comparison is misleading without accounting for the following operational and risk factors, which effectively constitute a hidden cost in the legacy model:
* **Eliminated Internal Labor:** We have decommissioned two dedicated Windows servers and a SQL Server instance. The ongoing labor for OS patching, SQL Server tuning, application updates, and backup verification is no longer required. A conservative estimate of 8-10 engineering hours per month for these tasks, at our fully burdened rate, equates to **$18,000-$24,000 annually**.
* **High Availability & Disaster Recovery:** Achieving true HA/DR with the on-premises solution required significant additional SQL Server licensing and complex networking. Delinea Cloud provides this as a service-level guarantee, eliminating that complexity and cost.
* **Security & Compliance Burden:** The responsibility for the security posture of the application runtime, web server, and underlying OS has shifted to Delinea. The risk reduction and compliance audit scope reduction have tangible, though difficult to quantify, value.
When the eliminated internal labor ($18k+) is netted against the SaaS premium, the cost differential becomes marginal, and in our case, slightly favorable to the SaaS model. The primary tradeoff is control versus operational simplicity. For us, the ability to reallocate senior infrastructure resources to other projects and the accelerated feature delivery cycle of the cloud platform justified the transition. Organizations with very low internal cost structures or specific regulatory requirements that preclude SaaS may find the calculus different.
brianh
I'm an IT Director for a financial services firm with roughly 800 employees, and we've operated both a self-hosted Thycotic Secret Server (pre-2022) and now run Delinea Cloud (Enterprise) in production for our privileged access management.
Here are four concrete criteria drawn from our procurement and operational experience:
* **Total Cost Forecast Accuracy:** Your $37,700 annual legacy cost is a known ceiling, but the Delinea Cloud subscription is a known floor. At your 500-user scale, Delinea Cloud list pricing typically falls between $6-9 per user per month for the Enterprise tier, putting your baseline at $36-54k annually. The critical financial shift is the loss of cost predictability: every new hire, contractor, or service account adds a direct, unbudgeted line item, whereas your on-prem model had massive headroom for user growth at near-zero marginal cost.
* **Infrastructure Burden vs. Control Trade-off:** Your ~$9,200 infrastructure cost estimate is telling. Eliminating that is a clear win for resource-strapped teams. However, the trade-off is a loss of control over performance tuning and upgrade scheduling. A specific limitation we encountered is the inability to aggressively tune session recording retention or database cleanup policies for compliance reasons, as those are now managed platform defaults.
* **Implementation and Integration Velocity:** The migration effort from Thycotic to Delinea Cloud for core secrets is straightforward, but the true effort is in re-integrating with your ecosystem. We found that API endpoints and some authentication flows differed enough that our existing Terraform scripts and CI/CD pipelines required approximately 80-100 person-hours of refactoring, which was not accounted for in the initial project scope.
* **Vendor Support and Escalation Path:** With the on-prem solution, support could be slow, but we had ultimate recourse via server access for critical outages. Under the SaaS model, support responsiveness is paradoxically more critical. In our experience, Delinea Cloud support meets SLAs for standard tickets, but we've observed a 3-4x longer time-to-resolution for complex, environment-specific issues where they must engage their cloud operations team internally.
For an organization of your size that has already absorbed the perpetual license capex, I would only recommend switching to Delinea Cloud if your primary pain point is operational overhead on your infrastructure team, or if you require a feature only available in their cloud roadmap. To make a clean call, tell us your projected user growth rate for the next three years and whether your internal audit team has flagged any specific compliance gaps in your current self-hosted setup.
The linear scaling you noted is a critical operational detail many overlook. A purely user-based subscription model creates a direct financial link between HR onboarding events and security budget variance, which can complicate quarterly forecasting. While your breakdown clearly shows the shift from capex to opex, the real management challenge often becomes the accounting reconciliation process for those variable monthly charges, especially when service accounts or contractor numbers fluctuate. Have you established a procedure to audit and validate the user count Delinea bills against your actual active directory sync?
Let's keep it constructive
Thanks for sharing those specific numbers, they're very helpful. I'm currently evaluating a similar move for a smaller team.
You mention the cost is purely user-based and scales linearly now. I'm curious how that compares to the pricing model of something like Akeyless or CyberArk's cloud offerings, which I've seen mentioned in other threads. Do those also scale strictly per user, or do they factor in things like secret count or API calls?