CyberArk Pricing in 2026: What Enterprises Actually Pay

Cybersecurity

CyberArk Software Ltd. PAM · Identity Security · Secrets Management · Endpoint Privilege

Privilege Cloud (per user/yr)

How CyberArk Pricing Works

CyberArk is the market leader in Privileged Access Management, a position it has held since acquiring Cybertec in 2003 and building the category around its Enterprise Password Vault. Today CyberArk operates across four distinct product lines, Privileged Access Manager (PAM), Identity Security Platform, Secrets Management, and Endpoint Privilege Manager (EPM), each with separate licensing metrics and pricing models. Understanding how these product lines interact, and where they overlap in functionality with competitors, is prerequisite to negotiating effectively.

The core PAM offering, available as Privilege Cloud (SaaS) or as the traditional self-hosted Enterprise Password Vault, is licensed per privileged account or per privileged user, depending on the deployment configuration. This distinction matters enormously in practice. Human privileged users, administrators, developers, security staff, are typically a small fraction of total privileged accounts in complex environments. Service accounts, application accounts, and automated process accounts routinely outnumber human accounts 5:1 to 20:1 in enterprise data centers. CyberArk pricing includes all account types, and the definition of what constitutes a "privileged account" has expanded steadily as the platform has grown. Organizations entering a CyberArk deal with an estimated account count regularly discover 30 to 60% more accounts in scope during implementation. The full cybersecurity pricing benchmark covers PAM alongside endpoint, identity, and SIEM vendors for complete category context.

Identity Security Platform pricing, CyberArk's workforce and consumer identity product, combining SSO, MFA, and lifecycle management, is licensed per user per month in a SaaS model. This product competes directly with Okta, Microsoft Entra ID, and Ping Identity, and is increasingly positioned as a "platform consolidation" opportunity to expand CyberArk's footprint in existing PAM accounts. The revenue strategy is straightforward: land with PAM, expand with identity, cross-sell Secrets Management for DevOps and cloud workloads, and add EPM for endpoint least-privilege enforcement.

Pricing Model

Per privileged user / account (PAM); per user/month (Identity); per app (Secrets)

Professional Services

$250 to $350/hr; often bundled as $200K to $600K packages

Training & Certification

CyberArk Trustee / Guardian programs; $2,000 to $4,000/seat

What Enterprises Actually Pay for CyberArk

Enterprise CyberArk spend varies enormously based on privileged account population, product scope, and deployment model. Our benchmark database of CyberArk contracts reveals the following pattern by organization tier.

Mid-market enterprises (500 to 2,000 privileged accounts) deploying Privilege Cloud for core PAM, vault, session management, and password rotation, typically pay $400,000 to $900,000 annually. This represents a 25 to 35% discount from list pricing. At this scale, CyberArk's negotiation flexibility is moderate; the deals are significant enough to attract attention but not large enough to warrant deep executive involvement from CyberArk.

Large enterprise deployments (2,000 to 10,000 privileged accounts) with expanded scope including Conjur (Secrets Management) and Endpoint Privilege Manager are the median enterprise CyberArk deal. Annual spend in this tier runs $1.2M to $4M. Discounts reach 30 to 40% with competitive pressure. The introduction of BeyondTrust or Delinea as alternative evaluation platforms is the most reliable mechanism for extracting concessions. CyberArk sales teams have specific discount authorization tiers, and competitive threat letters, formal documentation of an alternative evaluation, are the most consistent way to unlock approvals beyond standard field rep authority.

Global 2000 organizations with 10,000+ privileged accounts spanning hybrid cloud, legacy mainframe, and multi-cloud environments commonly pay $4M to $12M annually across the full CyberArk portfolio. At this scale, platform consolidation agreements, multi-year commitments to expand across PAM, Identity Security, Secrets Management, and EPM, produce the deepest pricing. CyberArk executive sponsors get involved directly, and creative commercial structures including credit pools, license banking, and custom SKU pricing become available.

CyberArk Privilege Cloud

SaaS PAM

Tier

$1,200/acct/yr

$800 to $950

20 to 33%

Privilege Cloud (250 to 2,500)

$900/acct/yr

$550 to $720

20 to 39%

Enterprise (2,500 to 10,000)

Custom

$400 to $600

30 to 45%

Global (10,000+)

Custom

$300 to $480

35 to 50%

CyberArk Discount Benchmarks, What's Achievable?

CyberArk discount authorization follows a tiered structure that mirrors most enterprise software vendors. Field reps have authority to approve discounts up to approximately 25% without escalation. Regional management can approve 30 to 35%. Discounts above 35% require VP or C-level sign-off from CyberArk, and deals requiring executive approval take longer and require formal competitive documentation.

The highest discounts, 38 to 45% off list, are reserved for a specific set of circumstances: competitive displacement of an incumbent vendor (particularly Thales/Safenet PAM, IBM ISAM, or Oracle PAM), platform consolidation commitments spanning three or more CyberArk product lines, multi-year deal terms of 4 to 5 years, and organizations facing audit findings that create urgency on CyberArk's side as much as the customer's. When multiple of these factors combine, CyberArk sales leadership has approved deals as deep as 48% in documented benchmark cases.

Standard renewal discounts, absent competitive pressure, run 20 to 28%. CyberArk's renewal strategy is to emphasize the installed base risk of migration, the integration complexity of replacing a mature PAM deployment, and the "platform value" of expanding rather than replacing. Organizations that allow CyberArk to frame the renewal as a platform discussion rather than a PAM-only transaction routinely end up with higher spend, not lower, even while believing they negotiated well. The defense: benchmark before the conversation starts, not during it.

CyberArk Pricing by Product and Module

CyberArk's product portfolio has expanded significantly since its PAM origins. Understanding where each product sits in the pricing structure, and which products have genuine competitive alternatives, is essential for controlling total CyberArk spend.

Privileged Access Manager (Self-Hosted) remains the legacy enterprise deployment model, now on version 14.x of the original Enterprise Password Vault architecture. List pricing runs $800 to $1,500 per privileged user annually, including the Core PAS (Vault, PVWA, PSM, CPM, PSMP) components. Maintenance and support runs 18 to 22% of net license annually. Infrastructure costs for self-hosted deployments, servers, storage, DR replication, patching labor, add 25 to 40% to the total cost of ownership versus Privilege Cloud SaaS pricing, making self-hosted comparisons to SaaS competitors more complex than list price alone suggests.

Secrets Manager (formerly Conjur) targets DevOps, CI/CD pipelines, and cloud workloads that need to retrieve credentials without human intervention. Pricing is per application or per workload rather than per human user. Enterprise list pricing runs $600 to $1,200 per application annually; volume discounts begin at 100 applications. This product competes with HashiCorp Vault (now owned by IBM), AWS Secrets Manager, Azure Key Vault, and increasingly with native Kubernetes secret management tools. The competitive landscape gives procurement teams genuine alternatives, which CyberArk's sales team must address. Discounts on Secrets Manager of 30 to 40% are common when competitive alternatives are documented.

Endpoint Privilege Manager (EPM) removes local admin rights from Windows and Mac workstations while providing just-in-time privilege elevation for authorized applications. Pricing runs $60 to $120 per endpoint per year at list. This competes with BeyondTrust PowerBroker for Windows, Delinea Privilege Manager, and Microsoft's increasingly capable built-in endpoint privilege control. EPM is frequently bundled into platform deals as a discount mechanism, CyberArk will reduce the per-unit price significantly when EPM is added to a PAM+Secrets renewal. The endpoint count at large organizations (50,000 to 200,000 endpoints) makes EPM a substantial line item even at negotiated pricing.

Identity Security Platform (ISP), CyberArk's SSO, MFA, and lifecycle management product, lists at $8 to $18 per user per month depending on feature tier. This competes directly with Okta Workforce Identity, Microsoft Entra ID, and Ping Identity. CyberArk ISP's primary selling point in existing PAM accounts is the integration with the privileged access layer, unified policy, shared analytics, and a single vendor relationship. In new evaluations without an existing CyberArk footprint, ISP struggles to compete on price against Okta or Microsoft. Discounts on ISP of 25 to 40% are achievable, particularly when bundled with PAM expansions.

Is your CyberArk deal competitive?

We've benchmarked $2.1B+ in enterprise software contracts. Submit your CyberArk renewal or new deal for a 24-hour benchmark report showing exactly where you stand versus market, and where you should push back.

Common CyberArk Contract Traps to Watch For

CyberArk contracts contain several provisions that routinely create unexpected cost or constrain negotiating leverage at renewal. These are not obscure clauses, they appear in the standard CyberArk order form and MSA, but procurement teams without PAM-specific experience frequently miss them.

The account scope definition is the most significant cost driver in CyberArk deployments. The standard CyberArk definition of a "privileged account" includes all accounts with elevated permissions, including service accounts, application accounts, automation accounts, and shared accounts in addition to named human users. Organizations estimating their CyberArk requirements by counting privileged users, IT administrators, security engineers, DBAs, routinely discover during implementation that service accounts outnumber human accounts 8:1 to 15:1 in complex environments. A company that believes it is licensing for 500 privileged users may find it needs 4,000 to 6,000 account licenses. Negotiate a right to audit your account population before finalizing the initial contract scope, and include provisions for account right-sizing if decommissioned accounts reduce scope.

The annual escalation provision in standard CyberArk agreements allows for 7 to 8% per year price increases, often described as "CPI plus" or simply as a fixed percentage. Multi-year contracts that appear to lock in pricing may actually escalate annually within the term. Negotiate to cap annual escalations at 3 to 4%, or better yet, lock pricing for the full term. CyberArk will accept caps of 4 to 5% in most enterprise negotiations; the standard 7 to 8% clause exists as a negotiating anchor, not a floor.

Professional services bundling is a consistent source of friction. CyberArk's standard implementation approach involves significant professional services, design, deployment, integration, and knowledge transfer, which the sales team frequently bundles with license pricing in ways that obscure the true per-unit cost. Unbundle services from licenses explicitly. Establish clear deliverables and milestone-based payment for professional services. CyberArk partners (EY, Deloitte, Accenture) often provide equivalent professional services at lower rates than CyberArk direct, compare the options before signing a bundled deal.

The Success Plan upsell, CyberArk's enhanced support tier, adds 5 to 8% annually on top of standard 18 to 20% maintenance. The incremental value over standard maintenance is modest for most enterprises. Evaluate whether the Success Plan SLAs actually differ from the standard maintenance contract before accepting the upsell, and negotiate Success Plan pricing as part of the overall discount discussion rather than as a separate line item.

CyberArk Renewal Pricing: What Changes and What Doesn't

CyberArk renewal pricing follows a predictable pattern that procurement teams can use strategically. Understanding what CyberArk will and will not move on at renewal eliminates wasted negotiation effort and focuses leverage on the areas that produce results.

At renewal, CyberArk's default position is a 5 to 8% price increase applied to the prior-year contract value, plus upsell proposals for new products, typically the ISP for organizations not already using it, or expanded Secrets Manager scope for DevOps teams. The renewal price increase is presented as a maintenance and support increase or "list price adjustment" rather than explicitly as a negotiated position. Organizations that accept this framing and negotiate off the proposed renewal number typically achieve 2 to 4% savings from CyberArk's opening position, a marginal outcome compared to benchmarked market pricing.

Organizations that approach the renewal with competitive benchmark data, showing that comparable deals in our database are 20 to 35% below the proposed renewal price, achieve materially different outcomes. CyberArk's renewal discount authority at the field level is limited; demonstrated competitive exposure escalates the conversation to regional and national management levels where larger concessions are available. Multi-year renewal commitments (3-year terms at renewal) unlock CyberArk's platform pricing, which sits 15 to 25% below annual renewal rates for equivalent scope.

What CyberArk will not typically concede at renewal: removal of accounts already deployed in production (true-down provisions are rare), migration from self-hosted to Privilege Cloud without incremental contract value, or elimination of Success Plan if it was included in the prior term. These are not absolute rules, exceptions exist in large enterprise negotiations, but they are the standard positions that require significant leverage to overcome.

Get the full CyberArk pricing benchmark, free

Enter your work email and we will send the complete CyberArk discount ranges, contract benchmarks, and negotiation levers. No sales call.

Frequently Asked Questions

How much does CyberArk cost for enterprises?

Enterprise CyberArk annual spend ranges from $400,000 for mid-market PAM deployments to $10M+ for Global 2000 organizations with the full portfolio. Privilege Cloud pricing at enterprise discount runs $400 to $700 per privileged account annually. The most important variable is account scope, count every service account, not just human administrators.

What discounts can enterprises negotiate on CyberArk?

Enterprise CyberArk discounts range from 20 to 45% off list. New competitive evaluations against BeyondTrust or Delinea achieve 30 to 45%. Platform consolidation commitments unlock the deepest pricing. Standard renewals without competitive pressure typically yield 20 to 28% off list, well above what CyberArk's opening renewal proposal reflects.

CyberArk vs BeyondTrust vs Delinea: which is cheapest?

At list, BeyondTrust and Delinea are typically 20 to 40% less expensive than CyberArk for comparable PAM functionality. With enterprise discounts applied, the gap narrows to 10 to 25%. CyberArk's platform breadth, adding Identity Security, Secrets Management, and EPM, creates scenarios where CyberArk total cost of ownership is competitive or lower than multi-vendor alternatives. The comparison requires full portfolio analysis, not just PAM list prices.

What are the biggest CyberArk contract traps?

The three most costly CyberArk contract traps: underestimating privileged account scope (service accounts routinely outnumber human accounts 8:1), accepting annual escalation clauses of 7 to 8% without cap negotiation, and agreeing to bundled professional services without clear deliverables. Define account scope precisely, cap annual escalations at 3 to 4%, and unbundle services from licenses.

Is CyberArk Privilege Cloud or Self-Hosted better value?

Privilege Cloud (SaaS) typically offers better total cost of ownership for organizations without air-gapped environments or strict data residency requirements. When infrastructure, patching, and upgrade labor are included, SaaS is 10 to 20% lower TCO than self-hosted at comparable account scale. CyberArk will push Privilege Cloud aggressively, validate the comparison with your infrastructure team before accepting the SaaS narrative at face value.

Stop Accepting CyberArk's Opening Price

Your free Vera AI trial opens the benchmarking database, 1,341 benchmarks across 1,140 vendors, plus the negotiation guides, playbooks, and talking points for your own renewals. No card needed, a corporate email is all it takes.

Related Cybersecurity Vendor Benchmarks

Vendor Benchmark BeyondTrust Pricing 2026 Vendor Benchmark SailPoint Pricing 2026 Vendor Benchmark Tanium Pricing 2026 Category Guide Cybersecurity Pricing Guide 2026

Related Cybersecurity Pricing Benchmarks

See how CyberArk compares with other Cybersecurity vendors enterprise procurement teams benchmark most often. Each page shows real discount ranges and negotiation leverage data.