Alright, so I'm evaluating privileged access management solutions and Clutch Security keeps coming up as a "modern," "cloud-native" contender. Their marketing is predictably sleek, all about simplifying JIT and breaking away from legacy PAM. What they aren't sleek about is the actual price tag.
Every time I try to get a straight number, it's the classic "it depends" song and dance. Depends on what? The number of privileged accounts? The number of human users? The types of resources (SSH keys, cloud IAM, databases)? Do they charge for the break-glass vault instances separately?
I've heard whispers of a minimum annual commit that would make a CFO wince, and that their per-user cost isn't just for admins but for *everyone* with any level of delegated access, which could blow up the math quickly.
Has anyone actually gone through a procurement cycle with them recently and can shed light on the real unit economics? I'm particularly interested in how the licensing model scales (or doesn't) for a scenario with, say, 500 employees where maybe 100 need some form of elevated access, but only 20 are core infrastructure admins. The difference between charging for 20 vs 100 vs 500 users is, as you'd expect, the difference between a viable business case and a non-starter.
— skeptical but fair
— skeptical but fair
I completely understand the frustration with the "it depends" pricing. I've been digging into this for our own procurement process, and from what I've gathered in recent conversations, the primary licensing unit is indeed the human user, not the privileged account or resource. This seems to be a common point of confusion.
Your scenario with 500 employees is really pertinent, because the licensing often includes any employee who could potentially be granted access, even if it's just temporary. So it's not just the 20 core admins or the 100 needing elevated access, it's the entire user base that could be a target for delegation. This radically changes the cost projection from what a traditional PAM model might suggest.
Have you found any way to scope it down to just active privilege users, or is their stance pretty firm on the total potential user pool? I'm trying to see if there's a way to structure the initial rollout to keep the first year's costs palatable.
Their stance is firm on the total user pool from what I've seen. That's the shift with these cloud-native PAM tools - they're selling an identity-centric model, not a vault-seat model.
You might get them to agree on a phased rollout based on departments. Start with the 100 users in engineering and infra, get that contract signed, then expand later. But the per-user cost will apply to that initial 100, not your 500. It's still a big jump from budgeting for 20 admins.
The real kicker is the add-ons. The base user license might look okay, but you'll need the modules for SSH, cloud IAM, and databases. Those are priced per resource type and can double the cost.
YAML all the things.
You've nailed the shift in the pricing model here. Identity-centric vs. vault-seat explains a lot of the sticker shock.
That phased rollout approach is smart and often the only practical path, but you've got to watch the contract language. Sometimes the per-user price for future phases isn't locked in, so you could be facing a price hike when you go from 100 to 200 users. It pays to negotiate that expansion rate upfront.
And oh, the modules. I've seen teams get a decent quote on the core platform only to find the SSH key management or cloud IAM connector priced as a separate SKU that costs nearly as much. Always ask for a bundled quote covering the specific resource types you need day one.
I just wrapped up a procurement evaluation that included Clutch. Your breakdown of 500 employees, 100 with elevated access, and 20 core admins is the exact scenario that causes the pricing tension.
You're right that the quote is for the entire identity pool, not just active privilege users. In our case, that meant licensing all 500 potential users. The per-user cost was in the $60-80 annual range for the core platform, but that's before modules. The SSH key management and cloud IAM connectors each added a ~40% premium to the total annual contract value.
The minimum annual commit you've heard about is real - it was effectively a 100-user minimum in our negotiations, even if our actual initial rollout group was smaller. That's where the CFO wince comes from: a ~$10k minimum before you even turn anything on.