PAM Pricing: Meters, Minimums and Fees Compared

Who publishes PAM prices

Few vendors do, and the ones that do sell mainly to enterprises. Most PAM tools sold to MSPs quote on request.

ManageEngine PAM360: subscriptions are priced by administrators and SSH keys, with "no limit on users and resources". The smallest subscription tier is 10 administrators and 25 keys, listed from $7,995 a year. A free edition covers one administrator and 10 resources, and the trial runs 30 days with up to five administrators.
Okta Privileged Access: an add-on to the Starter and Core Essentials suites ($6 and $14 per user per month, billed annually), included for two admins in Essentials ($17), and licensed in Resource Units on Professional and Enterprise, which are priced through sales. Okta says "Resource Units are how Privileged Access is licensed." Workforce Identity carries a $1,500 annual contract minimum.

Two different meters in two published examples. That's the pattern across the market: the unit changes from vendor to vendor, so a price per seat means little until you know what a seat is.

The four ways PAM is metered

Almost every PAM price is built on one of four meters, or a mix. Each one counts something different in an MSP's business, and each one punishes a different shape of MSP.

Per user in the directory. Every person in the identity platform counts, whether or not they ever touch privileged access. Okta's Workforce suites work this way. For an MSP, that means every employee at every client, so the bill follows your clients' headcount, not your technicians' work.
Per device. Every managed workstation, and often every server, counts. Endpoint privilege tools usually price this way. The bill follows the number of machines, including the ones where nobody ever asks to elevate.
Per administrator or privileged user. Only the people who use the PAM tool count, sometimes with a second count for resources or keys. ManageEngine's administrators-plus-keys model is one version. Cheap for a small team; expensive for an MSP with many part-time or tier-1 technicians who each need a seat.
Per technician plus per workstation. Two meters: the people who hold privileged access, and the workstations where endpoint privilege is managed. Servers and directories sit with the technician count. Built for the MSP shape, where a small team administers a large estate.

On top of any of these, some vendors add a per-client fee or minimum, which punishes MSPs with many small clients, and a platform fee, which is the same whatever you license.

One MSP under each meter

Take an example MSP: 12 technicians, 45 clients, 1,800 client workstations, 90 client servers and 2,400 client users. Here is how many billable units each meter creates, before any rate is applied:

Per user in the directory: 2,400 units.
Per device: 1,890 units (1,800 workstations + 90 servers).
Per administrator: 12 units, plus a resource or key count if the vendor meters one.
Per technician plus per workstation: 12 technician units + 1,800 workstation units, with the 90 servers on the technician meter.
Per-client fee or minimum, if there is one: 45 more charges on top, one per client.

Now add five small clients of 20 users and 20 workstations each:

Per user: +100 units.
Per device: +100 units.
Per administrator: +0, until you hire.
Per technician plus per workstation: +100 workstation units, +0 technician units.
Per-client fee: +5 charges, each at the minimum, however small the client.

None of these is cheap or expensive by itself; that depends on the rate. The point is which number you'll be watching every month. A per-user meter ties your PAM cost to your clients' hiring. A per-client minimum makes your smallest clients your least profitable. A per-administrator meter makes adding a technician a licensing decision.

The fees that change the total

The rate is one line. These are the others, and they're where two quotes with the same per-seat price end up far apart:

Platform fee: a fixed charge regardless of what you license.
Per-client fee or minimum: a charge for each client tenant, or a floor per client.
Servers vs workstations: whether a server costs the same as a workstation, more, or nothing extra.
Read-only access: whether a technician who only views a vault entry needs a seat.
Discovery before licensing: whether you can find every privileged account in a client before paying for any of it.
AI or usage charges: whether AI features are included or metered by use.
Implementation and onboarding: a one-off fee, or scoped separately by a services team.
Support tier: included, or a percentage on top.
Minimum commitment: whether the minimum is a seat count or a dollar amount, and per client or per account.
Changes mid-term: whether you can add licenses at any time, and when reductions take effect.

Questions to ask any PAM vendor

Ask every vendor the same questions, in writing, and compare the answers against your own counts:

What exactly is one license: a user, a device, an administrator, a technician, a client?
Is there a platform fee?
Is there a per-client fee or a per-client minimum?
What does a server cost compared with a workstation?
Does read-only vault access need a license?
Can we run discovery across a client before we license anything?
Are AI features included or metered?
Is the minimum a number of seats or a dollar amount?
Can we add licenses mid-term, and when do reductions take effect?
What do implementation and support cost, and are they in the quote?

Then price your real shape: technicians, clients, workstations, servers and users, plus the five clients you expect to add this year.

PAM as a service: what it means for an MSP

"PAM as a service" means two things. To an enterprise buyer, it usually means PAM delivered as SaaS: the vendor hosts it, and the buyer doesn't run servers for it. To an MSP, it also means PAM packaged as a managed service you sell to clients.

The second meaning is a pricing question. Your PAM cost follows the vendor's meter; your revenue follows how you bill the client. The closer the two match, the more predictable the margin. If your cost is per workstation, a per-device line on the client's agreement tracks it. If your cost is per user in the directory, a per-user line does. If your cost includes a per-client minimum, your smallest clients need a floor on their price too. Work it out per client with the example above before you set the line item.

Where PAM fits in the service you sell, phase by phase from discovery to endpoint privilege, is in zero standing privilege: the PAM journey for MSPs.

How Panthera is priced

CyberQP doesn't publish a price list. Panthera is quoted from your counts, and the model is published on the pricing page:

Two licenses: a technician license and a device license, used on their own or together. Servers, Active Directory, Entra ID and Google Workspace sit with the technician license; the device license covers workstations.
Nothing you add consumes a license until you assign one, so discovery and inventory across a client come before any licensing decision.
No platform fee, no per-client fee, no charge for the AI.
The monthly minimum is a dollar amount, not a headcount. There's no minimum number of technicians, workstations or clients.
Read access never consumes a license in the vault.
Licenses can be added at any time; reductions take effect at renewal.
Combined spend earns a better rate.

For the example MSP above, that's 12 technician licenses, with the 90 servers covered by them, plus 1,800 device licenses if you manage endpoint privilege on every workstation; or the technician licenses alone, or device licenses alone. Adding five small clients adds their workstations and nothing per client. There's a 30-day free trial on your own environment, so you can run discovery on a real client and count before you're quoted.

Frequently asked questions

How much does privileged access management cost?

Most vendors quote on request. Among those that publish, ManageEngine lists PAM360 from $7,995 a year for 10 administrators and 25 SSH keys, and Okta sells Privileged Access with Workforce suites at $6 to $17 per user per month, with a $1,500 annual minimum. Compare the meter and the fees, not only the rate.

Is there free PAM software?

Some vendors offer limited free editions; ManageEngine's PAM360 free edition covers one administrator and 10 resources. For local administrator passwords on Windows, Microsoft's Windows LAPS is free; where it stops is covered in Windows LAPS vs a PAM platform.

Does CyberQP publish Panthera's prices?

No. Panthera is quoted from your counts of technicians and workstations. The licensing model, including what is and isn't charged, is on the pricing page.

What is PAM as a service?

PAM delivered as SaaS, hosted by the vendor. For an MSP it also means PAM packaged as a managed service you sell to clients, priced per device or per user to track your own cost.

Does read-only access to a password vault need a license?

It depends on the vendor, so ask. ManageEngine places no restriction on password users and auditors; in Panthera, read access never consumes a license.

Sources (checked 22 October 2026): ManageEngine, PAM360 pricing; Okta, pricing; CyberQP, Panthera pricing.