We recently completed a migration from Thycotic Secret Server (on-premises) to Delinea Cloud Platform (formerly Cloud Suite). The primary driver was operational overhead, but as a FinOps practitioner, I required a detailed cost analysis to justify the shift from a CapEx-heavy model to a SaaS subscription. Here is my breakdown.
**Previous Thycotic (On-Prem) Cost Structure (Annualized):**
* **Hardware & Hosting:** Two `m5.xlarge` EC2 instances (for application and SQL) in AWS us-east-1. Reserved Instance (3-year, all upfront) amortized cost: ~$1,800/yr.
* **Storage:** 500 GB GP3 EBS volumes for each instance: ~$600/yr.
* **SQL Server Licensing:** The most significant cost, often overlooked. Two Standard Edition core licenses + Software Assurance: ~$7,500/yr.
* **Operational Labor:** Estimated 8 hours/month for maintenance, patching, and backup verification at a blended rate. This was the true hidden cost: ~$12,000/yr.
**Delinea Cloud Platform Costs (Direct):**
Our tier is based on 500 privileged accounts/users.
* **Annual Subscription:** Flat fee of $14,500. This includes all infrastructure, licensing, high availability, and backups.
* **No variable compute/storage costs.** The pricing is user/account-based, which simplifies forecasting.
**Comparative Analysis:**
The direct "hard" costs were surprisingly close. Thycotic on-prem totaled ~$9,900 in direct infrastructure/licensing, versus Delinea's $14,500. However, adding the operational labor burden pushed the on-prem solution to ~$21,900 annually, making Delinea Cloud a net saving of roughly $7,400 per year, or **~34%**.
**Key Observations:**
* The SaaS model converts unpredictable operational labor (a large, variable risk) into a predictable, flat operational expense.
* We eliminated the long-term commitment and risk of Reserved Instances. While RIs save money, they lock you into a specific instance family for three years.
* The cost model shift is significant: from managing infrastructure components (CPU, RAM, SQL licenses) to a pure consumption model based on a business metric (number of secrets/accounts). This aligns cost directly with business value.
**Configuration Note:**
One must carefully map the on-premises feature set to the correct Delinea Cloud tier. Our initial quote was lower but omitted certain API access requirements. The final `delinea.yaml` for our infrastructure-as-code integration looked like this:
```yaml
module "delinea_connector" {
source = "delinea/cloud-connector/aws"
version = "~> 2.0"
tenant_name = var.tenant_name
connector_count = 2
instance_type = "t3.large" # Managed by Delinea, cost included
secrets_engine = "vault"
auto_scaling_enabled = true
}
```
The verdict, from a pure cost optimization standpoint, is that the SaaS model wins not by being the absolute cheapest in hardware, but by providing a superior **cost-to-value ratio** when operational labor, risk, and innovation velocity are factored into the TCO.
Less spend, more headroom.