How much does CyberArk Privilege Cloud cost per user in 2026?

CyberArk Privilege Cloud Standard runs $2,400 to $4,800 per privileged user per year at typical mid-market scales. Privilege Cloud Privileged runs $7,000 to $12,000 per privileged user per year at small scale, dropping to approximately $1,800 per user at 1,000 or more seats. CyberArk does not publish a list price; every deal is a direct quote based on account count, deployment model, and module selection (Vendr + Ciphers Security, August 2026).

What is CyberArk Endpoint Privilege Manager pricing?

CyberArk Endpoint Privilege Manager (EPM) lists at $30 to $85 per endpoint per year. EPM is sold separately from the core PAM platform and removes local administrator rights, enforces application control, and applies policy-based privilege elevation. EPM typically adds $15,000 or more to the minimum contract value (underdefense.com, June 2026).

How much does CyberArk Secrets Manager cost?

CyberArk Secrets Manager (Conjur Cloud) is priced per workload identity, with reported 2026 ranges of $40 to $180 per workload identity per year. Conjur secures machine-to-machine credentials, DevOps secrets, and dynamic infrastructure tokens. Volume discounts apply at 500 or more workloads, but CyberArk does not publish rate cards (underdefense.com, June 2026).

What is the typical CyberArk self-hosted price?

CyberArk self-hosted Privileged Access Manager (PAM) is sold as a perpetual license plus annual maintenance of 17 to 22 percent of license value. List pricing for self-hosted runs $800 to $1,500 per privileged user annually, including the Core PAS Vault, PVWA, PSM, CPM, and PSMP components. Infrastructure costs for self-hosted deployments add 25 to 40 percent to the total cost of ownership versus the SaaS Privilege Cloud alternative (vendorbenchmark.com, 2026).

How does CyberArk pricing compare to BeyondTrust?

CyberArk's per-user model makes it more expensive than BeyondTrust in asset-heavy scenarios where users report BeyondTrust running roughly three times less expensive because its asset-based model avoids per-user charges. The comparison depends on the user's ratio of privileged human users to managed assets. CyberArk customers pay a premium for deeper PSM, ZSP, and just-in-time capabilities; BeyondTrust customers trade some PSM depth for a lower per-asset line (checkthat.ai, July 2026).

What discounts can buyers negotiate on CyberArk?

New competitive evaluations against BeyondTrust or Delinea achieve 30 to 45 percent off list. Platform consolidation commitments (buying multiple CyberArk modules under one contract) unlock the deepest pricing. Standard renewals without competitive pressure typically yield 20 to 28 percent off list, well above the opening renewal proposal. Multi-year three-year commitments commonly offer 15 to 30 percent discount versus annual contracts (Vendr, 2026).

CyberArk Pricing 2026: Privilege Cloud and PAM Cost

CyberArk pricing in 2026 is quote-based and runs roughly $2,400 to $4,800 per privileged user per year for Privilege Cloud Standard, $7,000 to $12,000 for the Privileged tier at small scale (dropping to about $1,800 at 1,000+ seats), $30 to $85 per endpoint for EPM, and $40 to $180 per workload for Secrets Manager. The median CyberArk annual contract sits near $30,000 per Vendr transaction data (CyberArk + Vendr, August 2026).

CyberArk rewards buyers who scope precisely. Account sprawl is the single biggest source of year-over-year cost growth once the initial contract is signed.

Last verified: Sep 15, 2026.

At a glance

Privilege Cloud Standard $2,400 to $4,800 per privileged user per year
Privilege Cloud Privileged $7,000 to $12,000 per user per year, dropping to ~$1,800 at 1,000+ seats
Endpoint Privilege Manager $30 to $85 per endpoint per year
Secrets Manager (Conjur Cloud) $40 to $180 per workload identity per year
Workforce Identity $5 to $11 per user per month
Self-hosted PAM $800 to $1,500 per user plus 17 to 22 percent annual maintenance

CyberArk modules and what each costs

CyberArk sells six product pillars, each priced on a different unit. The financial decision is which modules to license, because the line item per unit is published only after the sales engagement. Privileged Access Manager is per privileged user. Endpoint Privilege Manager is per endpoint. Secrets Manager is per workload identity. Workforce Identity is per named user per month. Cloud Security is per cloud entitlement. AI and ITDR modules are platform-fee subscriptions with custom pricing (underdefense.com, June 2026).

TOP CERT PREP FOR SECURITY PROFESSIONALS CompTIA Security+ SY0-801 Study Guide

Sybex • SY0-801 edition · 4.7

Check price on Amazon

Module	Licensing unit	Reported 2026 range	Minimum ACV
Privilege Cloud Standard	Named user per year	$2,400 to $4,800	~$25,000
Privilege Cloud Privileged	Named user per year	$1,800 to $12,000 (volume-dependent)	~$50,000
Endpoint Privilege Manager (EPM)	Per endpoint per year	$30 to $85	~$15,000
Secrets Manager / Conjur Cloud	Per workload identity	$40 to $180	~$20,000
Workforce Identity	Per named user per month	$5 to $11	~$10,000
CORA AI / ITDR Add-ons	Platform fee	Quote only	Varies

The headline lever in any CyberArk quote is the privileged seat count, and the per-user price drops sharply as volume climbs. At small scale, Privilege Cloud Privileged can run $7,000 to $12,000 per privileged user per year. Crossing 1,000 privileged users brings that effective rate down to approximately $1,800 per user, a volume discount of up to 51 percent versus the small-deployment rate (Vendr, 2026).

Worked cost examples at 25, 100, 500, and 1,000 accounts

The license-only estimate at different scales shows where volume discounts kick in. The table below uses reported typical effective rates per privileged user per year at each scale, before any volume discount, professional services, or premium support (underdefense.com, June 2026).

Privileged users	Typical effective rate per user per year	License-only annual estimate
25 (small team)	$4,000 to $9,000	$100,000 to $225,000
100 (mid-market)	$3,000 to $6,500	$300,000 to $650,000
500 (upper mid-market)	$2,200 to $4,000	$1.1M to $2.0M
1,000+ (enterprise)	~$1,800 to $3,000	$1.8M+

The median CyberArk contract across all deal sizes sits near $30,000 per year, dominated by smaller single-module Privilege Cloud or EPM deals. Large enterprises routinely spend $150,000 to $2M+ annually once multiple modules and professional services are factored in. A realistic 500-user all-in Year 1 TCO lands between $2.6M and $3.2M when license, professional services, premium support, storage overages, training, and one internal FTE are included (underdefense.com, June 2026).

Self-hosted versus SaaS deployment trade-off

The deployment model choice changes the cost structure more than the unit price. Privilege Cloud is the SaaS-delivered PAM platform and is now the default for most mid-market buyers; CyberArk hosts the vault, and customers pay per privileged user per year. Self-hosted PAM runs the Vault, Central Policy Manager (CPM), and Privileged Session Manager (PSM) inside the customer's data center; buyers pay an upfront license plus 17 to 22 percent annual maintenance, which covers patches, version upgrades, and standard support (CyberArk, September 2026).

GOLD STANDARD FOR SECURITY LEADERS CISSP Official Study Guide

Sybex • 10th edition · 4.7

Check price on Amazon

Self-hosted lists at $800 to $1,500 per privileged user annually, including the Core PAS components. Infrastructure costs for self-hosted deployments (servers, storage, disaster recovery replication, patching labor) add 25 to 40 percent to the total cost of ownership versus the SaaS Privilege Cloud alternative. For most new buyers, the SaaS path delivers lower first-year cost even when the per-user line is higher, because infrastructure overhead is removed from the buyer's side (vendorbenchmark.com, 2026).

Hidden costs and account sprawl

The single biggest source of year-over-year cost growth is account scope expansion. CyberArk includes all account types in the licensed count: human privileged users, service accounts, application accounts, and machine identities. Service accounts and application accounts routinely outnumber human accounts 5:1 to 20:1 in enterprise data centers. Organizations entering a CyberArk deal with an estimated account count regularly discover 30 to 60 percent more accounts in scope during implementation. Without a contractual cap, that scope expansion translates directly into renewal uplifts (vendorbenchmark.com, 2026).

Three other line items quietly inflate the budget. Professional services run 15 to 40 percent on top of license cost. Premium support typically costs 18 percent of annual contract value. Session recording storage overages are billed at then-current rates that CyberArk does not publicly disclose. Buyers that audit the privileged account count, negotiate a multi-year contract with capped renewal uplifts, and require line-item pricing for each module avoid the predictable surprises (underdefense.com, June 2026).