Delinea (Thycotic) Pricing in 2026: What Enterprises Actually Pay

Cybersecurity

Delinea (Thycotic + Centrify) Secret Server · Privilege Manager · Server Suite · Cloud Suite · DevOps Secrets Vault

Secret Server Pro (user/yr)

How Delinea (Thycotic) Pricing Works

Delinea was formed in April 2021 through the merger of Thycotic and Centrify, orchestrated by private equity firm TPG Capital. The combined company offers what management describes as an "intelligent authorization" platform spanning password vaulting, endpoint privilege management, privileged session management for servers, Active Directory bridging, and DevOps secrets management. From a pricing standpoint, the commercial consequence of the merger is a portfolio with inherited pricing metrics from both legacy products, per-privileged-user for Secret Server, per-endpoint for Privilege Manager, per-protected-server for Server Suite and Cloud Suite, with ongoing work to unify these into a single platform SKU. For a broader view of how PAM is priced across vendors, see our cybersecurity pricing benchmark.

Secret Server, the flagship product and Delinea's largest revenue driver, is licensed per privileged user per year. The three tiers are Professional, Premium, and Platinum. Professional covers baseline password vaulting, rotation, and access controls. Premium adds session monitoring, proxy, and more sophisticated workflows. Platinum adds high availability, APIs, advanced integration connectors, and SDK access. Most enterprise deployments land on Premium; Platinum is reserved for deployments with custom automation or strict HA requirements. Secret Server pricing at enterprise scale runs $45 to $180 per privileged user per year depending on tier and discount level.

Privilege Manager, Thycotic's endpoint privilege management product, licenses per protected endpoint per year. Enterprise deployments of Privilege Manager are typically scoped to workstations and VDI sessions where local admin privilege elevation is managed by policy rather than permanent assignment. Per-endpoint pricing runs $18 to $45 per year at enterprise scale. Privilege Manager competes primarily against CyberArk Endpoint Privilege Manager and BeyondTrust Privilege Management for Windows/Mac, with BeyondTrust holding the strongest technical position in this specific submarket.

Server Suite and Cloud Suite (formerly Centrify Server Suite and Centrify Cloud Suite) are the privileged access management products for Linux, Unix, and cloud workloads. These license per protected server per year at $450 to $1,500 depending on tier and the level of functionality enabled (basic AD bridging vs. privileged session recording vs. full zero-trust access workflow). For Linux-heavy and Unix-heavy enterprises, particularly financial services and telecommunications organizations with large server footprints, Server Suite and Cloud Suite are often the largest component of the Delinea contract, frequently exceeding Secret Server spend at scale.

What Enterprises Actually Pay for Delinea

Enterprise Delinea spend scales with privileged user count, endpoint footprint, and server scope. Our benchmark database of Delinea contracts shows the following patterns.

Small enterprise deployments (200 to 800 privileged users) using Secret Server Premium for password vaulting typically pay $50,000 to $175,000 annually. Discounts at this tier are modest, 20 to 30 percent, because Delinea treats this segment as volume business transacted through partner channels. Organizations at this scale often achieve better pricing through Deloitte, KPMG, Optiv, or other security-focused VARs that have access to Delinea's partner pricing tiers.

Mid-market enterprise deployments (800 to 2,500 privileged users) adding Privilege Manager and limited Server Suite scope typically pay $175,000 to $750,000 annually. At this scale, Delinea assigns dedicated enterprise account executives, and discounts of 30 to 40 percent become achievable with CyberArk or BeyondTrust on the table. Multi-product bundling, Secret Server Premium plus Privilege Manager plus Server Suite for 100 to 300 critical servers, creates meaningful leverage because Delinea will discount aggressively to secure broader platform commitments.

Large enterprise deployments (2,500+ privileged users with broad Server Suite footprint) represent Delinea's largest accounts and typically run $1M to $4M+ annually. Fortune 500 organizations in financial services, telecommunications, energy, and government verticals with 500+ Linux servers and complex compliance requirements drive the highest Delinea spend. At this scale, discounts of 40 to 50 percent off list become achievable, and Delinea often negotiates custom commercial terms including blended per-user pricing, capped escalation, and professional services credits. Competitive pressure from CyberArk is the primary discount driver, CyberArk's strategic advantages at the Fortune 500 tier mean Delinea must win on economic terms.

Delinea Product & Module Pricing Benchmarks

Delinea Platform, Enterprise Pricing

2026 Negotiated Benchmarks

Product / Tier

Best Achieved

Secret Server Professional (user/yr)

$60 to $80

$45 to $60

$32 to $45

Secret Server Premium (user/yr)

$110 to $145

$75 to $100

$55 to $78

Secret Server Platinum (user/yr)

$160 to $200

$110 to $145

$85 to $115

Privilege Manager (endpoint/yr)

$32 to $48

$22 to $32

$15 to $22

Server Suite (server/yr)

$750 to $1,200

$500 to $800

$350 to $525

Cloud Suite (cloud server/yr)

$850 to $1,500

$600 to $950

$425 to $650

DevOps Secrets Vault (vault/yr)

$24K to $60K

$16K to $38K

$10K to $24K

Delinea Discount Benchmarks: What Drives the Best Pricing

Delinea discount flexibility is structured explicitly around competitive displacement of CyberArk. The primary drivers are: credible CyberArk or BeyondTrust alternative on the table, multi-product commitment across Secret Server, Privilege Manager, and Server Suite, deal size and privileged user count volume tier, and end-of-quarter timing (TPG-owned sales discipline produces the deepest Q-end concessions).

The most powerful discount lever is a CyberArk Privileged Access Manager proposal at equivalent scope. CyberArk is the category leader in enterprise PAM and commands premium pricing, Delinea's entire commercial positioning is built around being the better-priced alternative. Procurement teams presenting a credible CyberArk alternative with CISO endorsement consistently move Delinea pricing into the 40 to 50 percent discount range. Delinea's sales organization has internal commercial discretion to discount significantly when displacing CyberArk because winning those deals is strategically critical to the company's market positioning.

BeyondTrust is the secondary competitive lever and is particularly effective for endpoint privilege management deals. BeyondTrust Privilege Management for Windows/Mac is technically stronger than Delinea Privilege Manager, and in competitive endpoint PAM evaluations BeyondTrust often wins on capability. When BeyondTrust is on the table for the endpoint piece, Delinea will discount Secret Server and Server Suite aggressively to keep the broader platform deal, this bundling asymmetry is a productive negotiating angle.

For DevOps Secrets Vault specifically, the competitive alternatives are HashiCorp Vault (the category standard for developer-focused secrets management), CyberArk Conjur, and AWS Secrets Manager or Azure Key Vault for cloud-native deployments. HashiCorp Vault's open-source foundation means many organizations already have a working Vault deployment, Delinea's DevOps Secrets Vault value proposition requires a clear articulation of why a commercial secrets manager with AD integration and policy controls is worth the licensed product over self-hosted HashiCorp Vault. Where that case is not strong, DevOps Secrets Vault is typically the first product Delinea will concede in a negotiation.

Delinea Pricing by Product Line

Secret Server economics are well-understood and predictable. The Premium tier is the effective anchor for enterprise negotiations, it includes session monitoring, proxy, and advanced workflow that meet most enterprise PAM requirements. The Platinum tier is over-specified for the majority of deployments; procurement teams should challenge the Platinum recommendation unless HA, custom API integration, or SDK access are specifically required. Downgrading from Platinum to Premium typically saves 20 to 30 percent of Secret Server licensing cost with no meaningful operational impact for most organizations.

Privilege Manager pricing is where Delinea competes most directly against BeyondTrust at the endpoint level. In our benchmark data, organizations that lead with a BeyondTrust endpoint PAM quote consistently achieve 35 to 45 percent discounts on Delinea Privilege Manager, Delinea concedes aggressively in this specific submarket because BeyondTrust is the category leader. If your deployment scope is primarily endpoint privilege management with a secondary password vault requirement, leading with BeyondTrust for endpoint and Delinea for vault (or the reverse) produces materially lower total cost than bundling both with either vendor.

Server Suite and Cloud Suite (the Centrify heritage products) command premium pricing because they solve a specific and difficult problem, privileged access to Linux and Unix servers with AD integration, where the competitive set is narrower. CyberArk has server session management capability but is typically priced higher; BeyondTrust's Password Safe covers adjacent scope but with less mature Linux/Unix PAM workflow. For Linux-heavy enterprises, Delinea Server Suite and Cloud Suite are often a reasonable commercial choice despite their relatively high per-server pricing, because capability parity against the alternatives is solid. Focus negotiation energy on the per-server tier (basic vs. advanced functionality) rather than on discounting the per-server unit price.

DevOps Secrets Vault is the weakest commercial position in the Delinea portfolio because HashiCorp Vault's open-source base sets a near-zero price anchor for the submarket. Unless your organization has specific requirements for AD-integrated secrets with centralized policy management, DevOps Secrets Vault is typically not the strongest commercial choice. In negotiations, DevOps Secrets Vault is the first SKU to concede, use it as a trade-off item rather than a core commitment.

Common Delinea Contract Traps

Delinea contracts license by privileged user, but the definition in enterprise contracts often expands beyond human administrators to include service accounts, break-glass accounts, application accounts, and API service identities. Organizations deploying Secret Server broadly during the contract term find their effective user count grows 2 to 3x beyond initial estimates, triggering true-up billing at renewal. Define what counts as a privileged user explicitly in the SOW, include human users, exclude service and application accounts, or negotiate a separate per-secret pricing tier for non-human identities.

Initial Delinea proposals often quote Secret Server, Privilege Manager, Server Suite, Cloud Suite, and DevOps Secrets Vault as separate licensed products with independent pricing tiers. Stacking these at individual list produces total contract value 30 to 45 percent above the equivalent Delinea Platform SKU that bundles them. Force Delinea to quote a consolidated Platform SKU alternative and compare line-by-line. In our benchmark data, Platform SKU pricing wins in 75 percent of deployments with three or more Delinea products in scope.

Delinea sales typically attach mandatory professional services at initial purchase, deployment services, migration from legacy Thycotic or Centrify instances, custom integration development, at $75K to $750K+ as a required line item. PS pricing is generally at full rate card ($275 to $375 per hour) and frequently subcontracted to GSI partners at Delinea's markup. Unbundle professional services, compete PS independently through VARs or GSIs, and negotiate a PS credit against licensing for unused services.

Standard Delinea master agreements include 5 to 7 percent annual uplift on base licensing, compounded over the contract term. Over a 3-year agreement, uplift provisions add 15 to 22 percent to year-three pricing versus year-one. The uplift is often buried in commercial terms sections rather than highlighted in the quote. Negotiate a cap on annual uplift (3 percent or CPI, whichever is lower) and require the uplift to be applied only to base licensing, not to professional services or maintenance attach.

Delinea Renewal Strategy

Delinea renewal negotiations in the TPG-owned era follow a consistent pattern. Delinea arrives with a proposal showing 5 to 7 percent uplift on base pricing plus recommended expansions, Privilege Manager if not currently deployed, Server Suite expansion to additional Linux/Unix footprint, DevOps Secrets Vault addition, or Platinum tier upgrade on Secret Server. The operational narrative, "zero-trust is maturing, you need these additional controls", is accurate at a category level but the specific pricing of the add-ons is the negotiating opportunity.

Effective renewal approach: benchmark current-state Delinea pricing against peer deployments first, then negotiate the base renewal at flat or 0 to 3 percent uplift using CyberArk or BeyondTrust competitive references. Address expansion proposals as separate new-business conversations with proper competitive evaluation, CyberArk for enterprise PAM, BeyondTrust for endpoint, HashiCorp for DevOps secrets. The renewal plus expansion bundle at Delinea's default renewal pricing produces 20 to 30 percent higher total-cost outcomes than negotiating the two separately.

For organizations with significant Linux and Unix server footprint, the Server Suite and Cloud Suite conversation deserves special attention at renewal. These products command premium pricing because of limited competition, but the per-server pricing is often out-of-date relative to actual deployment, many organizations have migrated servers to cloud (where Cloud Suite applies) or consolidated physical footprints. Audit actual licensed server count against current deployment reality and negotiate true-down provisions at renewal. See our CyberArk pricing benchmark and BeyondTrust pricing benchmark for the two essential competitive references, and our SailPoint pricing benchmark for complementary identity governance context.

Delinea (Thycotic) Pricing: FAQ

How much does Delinea cost for enterprises?

Secret Server runs $45 to $180 per privileged user per year at negotiated enterprise rates depending on tier. Privilege Manager runs $18 to $35 per endpoint per year. Server Suite and Cloud Suite run $450 to $1,100 per protected server per year. Enterprise annual contracts range from $125K for mid-market deployments to $3M+ for Fortune 500 deployments spanning the full Delinea portfolio.

What discount can enterprises negotiate on Delinea?

Enterprise discounts range from 25 to 50 percent off list. New logos displacing CyberArk achieve 35 to 50 percent. Renewals with CyberArk or BeyondTrust quotes in hand achieve 25 to 40 percent. Multi-year commits add 5 to 10 percent. End-of-quarter and end-of-year timing produces the deepest concessions given Delinea's TPG-owned sales discipline.

Thycotic vs Centrify vs Delinea: What's the relationship?

Thycotic and Centrify were separate PAM vendors that merged in April 2021 under TPG Capital ownership to form Delinea. Thycotic contributed Secret Server and Privilege Manager. Centrify contributed Server Suite and Cloud Suite (privileged access for Linux/Unix with AD integration). Delinea now sells the combined portfolio under a unified brand. Legacy Thycotic-only or Centrify-only contracts have been migrated to Delinea structures over 2023 to 2025.

Delinea vs CyberArk vs BeyondTrust: Pricing comparison?

CyberArk PAM runs $120 to $200 per privileged user per year, 30 to 50 percent above Delinea for comparable scope. BeyondTrust Password Safe runs $100 to $160 per privileged user per year, positioning between Delinea and CyberArk. Delinea's pricing discipline is its primary competitive weapon. At Fortune 500 scale with complex certification requirements, CyberArk retains strategic advantage despite the price premium.

What are the biggest traps in Delinea contracts?

Key traps: privileged user count expansion to include service and application accounts; stacked product licensing versus consolidated Platform SKU; professional services attach at full rate card for deployment; and 5 to 7 percent annual renewal uplift compounded over contract term. Each requires specific contract language, define privileged user scope, force Platform SKU comparison, unbundle PS, and cap annual uplift at 3 percent or CPI.

Know What Delinea Should Cost You

Your free Vera AI trial opens the benchmarking database, 1,341 benchmarks across 1,140 vendors, plus the negotiation guides, playbooks, and talking points for your own renewals. No card needed, a corporate email is all it takes.

Related Cybersecurity Pricing Benchmarks

See how Delinea (Thycotic) compares with other Cybersecurity vendors enterprise procurement teams benchmark most often. Each page shows real discount ranges and negotiation leverage data.