Fazlur Rahman
Quick Answer
CyberArk pricing in 2026 is quote-based and runs roughly $2,400 to $4,800 per privileged user per year for Privilege Cloud Standard, $7,000 to $12,000 for the Privileged tier at small scale (dropping to about $1,800 at 1,000+ seats), $30 to $85 per endpoint for EPM, and $40 to $180 per workload for Secrets Manager. The median CyberArk annual contract sits near $30,000 per Vendr transaction data (CyberArk + Vendr, August 2026).
CyberArk rewards buyers who scope precisely. Account sprawl is the single biggest source of year-over-year cost growth once the initial contract is signed.
Last verified: Sep 15, 2026.
At a glance
- Privilege Cloud Standard $2,400 to $4,800 per privileged user per year
- Privilege Cloud Privileged $7,000 to $12,000 per user per year, dropping to ~$1,800 at 1,000+ seats
- Endpoint Privilege Manager $30 to $85 per endpoint per year
- Secrets Manager (Conjur Cloud) $40 to $180 per workload identity per year
- Workforce Identity $5 to $11 per user per month
- Self-hosted PAM $800 to $1,500 per user plus 17 to 22 percent annual maintenance
CyberArk modules and what each costs
CyberArk sells six product pillars, each priced on a different unit. The financial decision is which modules to license, because the line item per unit is published only after the sales engagement. Privileged Access Manager is per privileged user. Endpoint Privilege Manager is per endpoint. Secrets Manager is per workload identity. Workforce Identity is per named user per month. Cloud Security is per cloud entitlement. AI and ITDR modules are platform-fee subscriptions with custom pricing (underdefense.com, June 2026).
| Module | Licensing unit | Reported 2026 range | Minimum ACV |
|---|---|---|---|
| Privilege Cloud Standard | Named user per year | $2,400 to $4,800 | ~$25,000 |
| Privilege Cloud Privileged | Named user per year | $1,800 to $12,000 (volume-dependent) | ~$50,000 |
| Endpoint Privilege Manager (EPM) | Per endpoint per year | $30 to $85 | ~$15,000 |
| Secrets Manager / Conjur Cloud | Per workload identity | $40 to $180 | ~$20,000 |
| Workforce Identity | Per named user per month | $5 to $11 | ~$10,000 |
| CORA AI / ITDR Add-ons | Platform fee | Quote only | Varies |
The headline lever in any CyberArk quote is the privileged seat count, and the per-user price drops sharply as volume climbs. At small scale, Privilege Cloud Privileged can run $7,000 to $12,000 per privileged user per year. Crossing 1,000 privileged users brings that effective rate down to approximately $1,800 per user, a volume discount of up to 51 percent versus the small-deployment rate (Vendr, 2026).
Worked cost examples at 25, 100, 500, and 1,000 accounts
The license-only estimate at different scales shows where volume discounts kick in. The table below uses reported typical effective rates per privileged user per year at each scale, before any volume discount, professional services, or premium support (underdefense.com, June 2026).
| Privileged users | Typical effective rate per user per year | License-only annual estimate |
|---|---|---|
| 25 (small team) | $4,000 to $9,000 | $100,000 to $225,000 |
| 100 (mid-market) | $3,000 to $6,500 | $300,000 to $650,000 |
| 500 (upper mid-market) | $2,200 to $4,000 | $1.1M to $2.0M |
| 1,000+ (enterprise) | ~$1,800 to $3,000 | $1.8M+ |
The median CyberArk contract across all deal sizes sits near $30,000 per year, dominated by smaller single-module Privilege Cloud or EPM deals. Large enterprises routinely spend $150,000 to $2M+ annually once multiple modules and professional services are factored in. A realistic 500-user all-in Year 1 TCO lands between $2.6M and $3.2M when license, professional services, premium support, storage overages, training, and one internal FTE are included (underdefense.com, June 2026).
Self-hosted versus SaaS deployment trade-off
The deployment model choice changes the cost structure more than the unit price. Privilege Cloud is the SaaS-delivered PAM platform and is now the default for most mid-market buyers; CyberArk hosts the vault, and customers pay per privileged user per year. Self-hosted PAM runs the Vault, Central Policy Manager (CPM), and Privileged Session Manager (PSM) inside the customer's data center; buyers pay an upfront license plus 17 to 22 percent annual maintenance, which covers patches, version upgrades, and standard support (CyberArk, September 2026).
Self-hosted lists at $800 to $1,500 per privileged user annually, including the Core PAS components. Infrastructure costs for self-hosted deployments (servers, storage, disaster recovery replication, patching labor) add 25 to 40 percent to the total cost of ownership versus the SaaS Privilege Cloud alternative. For most new buyers, the SaaS path delivers lower first-year cost even when the per-user line is higher, because infrastructure overhead is removed from the buyer's side (vendorbenchmark.com, 2026).
Hidden costs and account sprawl
The single biggest source of year-over-year cost growth is account scope expansion. CyberArk includes all account types in the licensed count: human privileged users, service accounts, application accounts, and machine identities. Service accounts and application accounts routinely outnumber human accounts 5:1 to 20:1 in enterprise data centers. Organizations entering a CyberArk deal with an estimated account count regularly discover 30 to 60 percent more accounts in scope during implementation. Without a contractual cap, that scope expansion translates directly into renewal uplifts (vendorbenchmark.com, 2026).
Three other line items quietly inflate the budget. Professional services run 15 to 40 percent on top of license cost. Premium support typically costs 18 percent of annual contract value. Session recording storage overages are billed at then-current rates that CyberArk does not publicly disclose. Buyers that audit the privileged account count, negotiate a multi-year contract with capped renewal uplifts, and require line-item pricing for each module avoid the predictable surprises (underdefense.com, June 2026).
