Real Delinea enterprise contract data from 140+ deals benchmarked. What security teams pay for the combined Thycotic plus Centrify PAM portfolio — Secret Server, Privilege Manager, Server Suite, Cloud Suite, and DevOps Secrets Vault — including how Delinea's pricing competes against CyberArk and BeyondTrust, and the contract terms that drive unexpected cost growth.
Delinea was formed in April 2021 through the merger of Thycotic and Centrify, orchestrated by private equity firm TPG Capital. The combined company offers what management describes as an "intelligent authorization" platform spanning password vaulting, endpoint privilege management, privileged session management for servers, Active Directory bridging, and DevOps secrets management. From a pricing standpoint, the commercial consequence of the merger is a portfolio with inherited pricing metrics from both legacy products — per-privileged-user for Secret Server, per-endpoint for Privilege Manager, per-protected-server for Server Suite and Cloud Suite — with ongoing work to unify these into a single platform SKU. For a broader view of how PAM is priced across vendors, see our cybersecurity pricing benchmark.
Secret Server — the flagship product and Delinea's largest revenue driver — is licensed per privileged user per year. The three tiers are Professional, Premium, and Platinum. Professional covers baseline password vaulting, rotation, and access controls. Premium adds session monitoring, proxy, and more sophisticated workflows. Platinum adds high availability, APIs, advanced integration connectors, and SDK access. Most enterprise deployments land on Premium; Platinum is reserved for deployments with custom automation or strict HA requirements. Secret Server pricing at enterprise scale runs $45–$180 per privileged user per year depending on tier and discount level.
Privilege Manager — Thycotic's endpoint privilege management product — licenses per protected endpoint per year. Enterprise deployments of Privilege Manager are typically scoped to workstations and VDI sessions where local admin privilege elevation is managed by policy rather than permanent assignment. Per-endpoint pricing runs $18–$45 per year at enterprise scale. Privilege Manager competes primarily against CyberArk Endpoint Privilege Manager and BeyondTrust Privilege Management for Windows/Mac, with BeyondTrust holding the strongest technical position in this specific submarket.
Server Suite and Cloud Suite (formerly Centrify Server Suite and Centrify Cloud Suite) are the privileged access management products for Linux, Unix, and cloud workloads. These license per protected server per year at $450–$1,500 depending on tier and the level of functionality enabled (basic AD bridging vs. privileged session recording vs. full zero-trust access workflow). For Linux-heavy and Unix-heavy enterprises — particularly financial services and telecommunications organizations with large server footprints — Server Suite and Cloud Suite are often the largest component of the Delinea contract, frequently exceeding Secret Server spend at scale.
Enterprise Delinea spend scales with privileged user count, endpoint footprint, and server scope. Our benchmark database of 140+ Delinea contracts shows the following patterns.
Small enterprise deployments (200–800 privileged users) using Secret Server Premium for password vaulting typically pay $50,000–$175,000 annually. Discounts at this tier are modest — 20–30 percent — because Delinea treats this segment as volume business transacted through partner channels. Organizations at this scale often achieve better pricing through Deloitte, KPMG, Optiv, or other security-focused VARs that have access to Delinea's partner pricing tiers.
Mid-market enterprise deployments (800–2,500 privileged users) adding Privilege Manager and limited Server Suite scope typically pay $175,000–$750,000 annually. At this scale, Delinea assigns dedicated enterprise account executives, and discounts of 30–40 percent become achievable with CyberArk or BeyondTrust on the table. Multi-product bundling — Secret Server Premium plus Privilege Manager plus Server Suite for 100–300 critical servers — creates meaningful leverage because Delinea will discount aggressively to secure broader platform commitments.
Large enterprise deployments (2,500+ privileged users with broad Server Suite footprint) represent Delinea's largest accounts and typically run $1M–$4M+ annually. Fortune 500 organizations in financial services, telecommunications, energy, and government verticals with 500+ Linux servers and complex compliance requirements drive the highest Delinea spend. At this scale, discounts of 40–50 percent off list become achievable, and Delinea often negotiates custom commercial terms including blended per-user pricing, capped escalation, and professional services credits. Competitive pressure from CyberArk is the primary discount driver — CyberArk's strategic advantages at the Fortune 500 tier mean Delinea must win on economic terms.
Submit your Delinea contract and get a full pricing benchmark within 24 hours. See where your per-privileged-user, per-endpoint, and per-server costs stand versus 140+ comparable enterprises — and which competitive references against CyberArk and BeyondTrust move Delinea into its deepest discount range.
Submit Your Delinea Contract →Delinea discount flexibility is structured explicitly around competitive displacement of CyberArk. The primary drivers are: credible CyberArk or BeyondTrust alternative on the table, multi-product commitment across Secret Server, Privilege Manager, and Server Suite, deal size and privileged user count volume tier, and end-of-quarter timing (TPG-owned sales discipline produces the deepest Q-end concessions).
The most powerful discount lever is a CyberArk Privileged Access Manager proposal at equivalent scope. CyberArk is the category leader in enterprise PAM and commands premium pricing — Delinea's entire commercial positioning is built around being the better-priced alternative. Procurement teams presenting a credible CyberArk alternative with CISO endorsement consistently move Delinea pricing into the 40–50 percent discount range. Delinea's sales organization has internal commercial discretion to discount significantly when displacing CyberArk because winning those deals is strategically critical to the company's market positioning.
BeyondTrust is the secondary competitive lever and is particularly effective for endpoint privilege management deals. BeyondTrust Privilege Management for Windows/Mac is technically stronger than Delinea Privilege Manager, and in competitive endpoint PAM evaluations BeyondTrust often wins on capability. When BeyondTrust is on the table for the endpoint piece, Delinea will discount Secret Server and Server Suite aggressively to keep the broader platform deal — this bundling asymmetry is a productive negotiating angle.
For DevOps Secrets Vault specifically, the competitive alternatives are HashiCorp Vault (the category standard for developer-focused secrets management), CyberArk Conjur, and AWS Secrets Manager or Azure Key Vault for cloud-native deployments. HashiCorp Vault's open-source foundation means many organizations already have a working Vault deployment — Delinea's DevOps Secrets Vault value proposition requires a clear articulation of why a commercial secrets manager with AD integration and policy controls is worth the licensed product over self-hosted HashiCorp Vault. Where that case is not strong, DevOps Secrets Vault is typically the first product Delinea will concede in a negotiation.
Secret Server economics are well-understood and predictable. The Premium tier is the effective anchor for enterprise negotiations — it includes session monitoring, proxy, and advanced workflow that meet most enterprise PAM requirements. The Platinum tier is over-specified for the majority of deployments; procurement teams should challenge the Platinum recommendation unless HA, custom API integration, or SDK access are specifically required. Downgrading from Platinum to Premium typically saves 20–30 percent of Secret Server licensing cost with no meaningful operational impact for most organizations.
Privilege Manager pricing is where Delinea competes most directly against BeyondTrust at the endpoint level. In our benchmark data, organizations that lead with a BeyondTrust endpoint PAM quote consistently achieve 35–45 percent discounts on Delinea Privilege Manager — Delinea concedes aggressively in this specific submarket because BeyondTrust is the category leader. If your deployment scope is primarily endpoint privilege management with a secondary password vault requirement, leading with BeyondTrust for endpoint and Delinea for vault (or the reverse) produces materially lower total cost than bundling both with either vendor.
Server Suite and Cloud Suite (the Centrify heritage products) command premium pricing because they solve a specific and difficult problem — privileged access to Linux and Unix servers with AD integration — where the competitive set is narrower. CyberArk has server session management capability but is typically priced higher; BeyondTrust's Password Safe covers adjacent scope but with less mature Linux/Unix PAM workflow. For Linux-heavy enterprises, Delinea Server Suite and Cloud Suite are often a reasonable commercial choice despite their relatively high per-server pricing, because capability parity against the alternatives is solid. Focus negotiation energy on the per-server tier (basic vs. advanced functionality) rather than on discounting the per-server unit price.
DevOps Secrets Vault is the weakest commercial position in the Delinea portfolio because HashiCorp Vault's open-source base sets a near-zero price anchor for the submarket. Unless your organization has specific requirements for AD-integrated secrets with centralized policy management, DevOps Secrets Vault is typically not the strongest commercial choice. In negotiations, DevOps Secrets Vault is the first SKU to concede — use it as a trade-off item rather than a core commitment.
VendorBenchmark has analyzed 140+ Delinea enterprise contracts. We benchmark your renewal against peer deployments of similar scope — privileged user count, endpoint footprint, server scope — and tell you exactly which competitive levers will produce the largest discount movement.
Benchmark Your Renewal →Delinea renewal negotiations in the TPG-owned era follow a consistent pattern. Delinea arrives with a proposal showing 5–7 percent uplift on base pricing plus recommended expansions — Privilege Manager if not currently deployed, Server Suite expansion to additional Linux/Unix footprint, DevOps Secrets Vault addition, or Platinum tier upgrade on Secret Server. The operational narrative — "zero-trust is maturing, you need these additional controls" — is accurate at a category level but the specific pricing of the add-ons is the negotiating opportunity.
Effective renewal approach: benchmark current-state Delinea pricing against peer deployments first, then negotiate the base renewal at flat or 0–3 percent uplift using CyberArk or BeyondTrust competitive references. Address expansion proposals as separate new-business conversations with proper competitive evaluation — CyberArk for enterprise PAM, BeyondTrust for endpoint, HashiCorp for DevOps secrets. The renewal plus expansion bundle at Delinea's default renewal pricing produces 20–30 percent higher total-cost outcomes than negotiating the two separately.
For organizations with significant Linux and Unix server footprint, the Server Suite and Cloud Suite conversation deserves special attention at renewal. These products command premium pricing because of limited competition, but the per-server pricing is often out-of-date relative to actual deployment — many organizations have migrated servers to cloud (where Cloud Suite applies) or consolidated physical footprints. Audit actual licensed server count against current deployment reality and negotiate true-down provisions at renewal. See our CyberArk pricing benchmark and BeyondTrust pricing benchmark for the two essential competitive references, and our SailPoint pricing benchmark for complementary identity governance context.
Secret Server runs $45–$180 per privileged user per year at negotiated enterprise rates depending on tier. Privilege Manager runs $18–$35 per endpoint per year. Server Suite and Cloud Suite run $450–$1,100 per protected server per year. Enterprise annual contracts range from $125K for mid-market deployments to $3M+ for Fortune 500 deployments spanning the full Delinea portfolio.
Enterprise discounts range from 25 to 50 percent off list. New logos displacing CyberArk achieve 35–50 percent. Renewals with CyberArk or BeyondTrust quotes in hand achieve 25–40 percent. Multi-year commits add 5–10 percent. End-of-quarter and end-of-year timing produces the deepest concessions given Delinea's TPG-owned sales discipline.
Thycotic and Centrify were separate PAM vendors that merged in April 2021 under TPG Capital ownership to form Delinea. Thycotic contributed Secret Server and Privilege Manager. Centrify contributed Server Suite and Cloud Suite (privileged access for Linux/Unix with AD integration). Delinea now sells the combined portfolio under a unified brand. Legacy Thycotic-only or Centrify-only contracts have been migrated to Delinea structures over 2023–2025.
CyberArk PAM runs $120–$200 per privileged user per year — 30–50 percent above Delinea for comparable scope. BeyondTrust Password Safe runs $100–$160 per privileged user per year, positioning between Delinea and CyberArk. Delinea's pricing discipline is its primary competitive weapon. At Fortune 500 scale with complex certification requirements, CyberArk retains strategic advantage despite the price premium.
Key traps: privileged user count expansion to include service and application accounts; stacked product licensing versus consolidated Platform SKU; professional services attach at full rate card for deployment; and 5–7 percent annual renewal uplift compounded over contract term. Each requires specific contract language — define privileged user scope, force Platform SKU comparison, unbundle PS, and cap annual uplift at 3 percent or CPI.
Our benchmark database covers 140+ Delinea enterprise contracts. Submit your current Delinea proposal or renewal and receive a full analysis within 24 hours — including per-privileged-user, per-endpoint, and per-server benchmarks, contract risk flags, and a specific negotiation playbook.