Only 27% of identity vendors publish a price, and identity governance scores 5 out of 100

Only 80 of the 296 identity vendors in Start with Identity's directory (27%) publish a price for any paid tier, and 158 (53%) are quote-only, according to the Identity Pricing Transparency Index 2026. The index classifies the Pricing section of every vendor profile in a snapshot taken on October 30, 2026, and checks 64 of those vendors against their live pricing pages the same day. On a 0 to 100 Pricing Transparency Score, the identity market scores 38. Identity governance scores 5.

The score runs from 93 to 0

The Pricing Transparency Score gives each vendor 100 points if it publishes a paid price or is simply free, 50 if you can start free but must ask for the paid price, and 0 if it is quote-only or sold only inside a bundle. The category score is the average. Password managers score 93 and secrets management 78. At the other end, identity governance scores 5 and CIEM scores 0: not one of the nine CIEM vendors in the directory shows a price.

For practitioners, the score is a planning number. In a high-scoring category you can shortlist on published figures. In a low-scoring one, budgeting starts with a sales call, and the evaluation has to be designed so that quotes from different vendors can be compared at all.

Governance, privilege and detection almost never show a number

Across IGA, PAM, ITDR and CIEM combined, 55 of 69 vendors (80%) are quote-only. Only four of the 69 publish a paid price: Keeper, ManageEngine PAM360, Nudge Security and Push Security. In IGA, SailPoint, Saviynt and Veza all sent us to sales when we checked.

These are also the categories where implementation services add the most to first-year cost, so the missing list price is only part of the unknown. The IGA and PAM rankings and the SailPoint vs Saviynt comparison cover what separates these vendors besides price.

Who you sell to matters more than what you sell

The strongest predictor in the index is the vendor's target market, not its category. Across all 296 profiles, 56% of vendors that sell to startups or SMBs publish prices, against 9% of enterprise-only vendors.

The gap holds inside a single group of categories. In IAM, IGA, PAM, ITDR, CIEM and zero trust, vendors that also serve SMBs publish 57% of the time and enterprise-only vendors 6% of the time. SMB-facing tools in PAM and zero trust, such as Keeper and Tailscale, behave like CIAM vendors. Enterprise-only CIAM vendors such as Transmit Security behave like IGA vendors. The practical use: if an enterprise vendor also sells to SMBs, ask for that price list. It gives you a floor for the negotiation.

CIAM free tiers range from 5,000 to 1,000,000 users

The index read the free tiers of developer-focused CIAM platforms live on October 30, 2026. They range from 5,000 MAU on SuperTokens' managed cloud to 1,000,000 MAU on WorkOS AuthKit, with a median of 17,750 MAU across 16 MAU-based free tiers. SuperTokens and WorkOS set the two ends; Clerk and Auth0 sit between them.

The headline number is the least useful part of the comparison. The report shows vendors counting "active" users in different ways (retained users, daily actives, tokens, or users plus AI agents), and B2B costs often coming from per-connection SSO and SCIM fees rather than users. Read the definition before comparing two free tiers. The best CIAM for startups ranking and the Auth0 vs Clerk comparison go further.

One in five pricing descriptions had drifted

When we re-checked 64 vendor pricing pages, 12 SWI profiles (19%) needed a pricing correction. The changes ran both ways: three vendors our profiles listed as unpublished now show prices, including Aembit and Strivacity, while six offered less than their profiles said. All twelve profiles were corrected. If roughly one in five pricing descriptions moves within a few months, any pricing claim older than a quarter, ours included, needs a re-check before it goes into a budget.

How we did it

A script pulled the Pricing section from all 297 vendor profiles and classified each into one pricing model: keyword rules made 93 confident calls, which we spot-read, and 140 more were classified by hand from the profile text, with each override and its reason recorded in the script. For the 64 vendors whose live pricing pages we read on October 30, the live page decided the classification (five more checks failed and are marked as unverified), and one retired product was excluded from every rate, leaving 296. Limits: rows outside the live sample reflect each profile's last review date, "published" means at least one real paid price rather than the price you will pay at scale, the directory is not a census of every identity vendor, and category sizes differ widely.

For the step-by-step method for getting a comparable quote from a quote-only vendor, see the full report and the RFP builder.

Use the data: download the index as CSV or JSON. It is free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.