# Identity Pricing Transparency Index 2026

Source: https://startwithidentity.com/reports/identity-pricing-transparency-index-2026/
Last updated: 2026-10-31
License: content by Start with Identity. Cite the source URL.

---

**Most identity software has no public price.** Of the 296 identity vendors in our directory that are still on sale, only **80 (27%) publish a price for any paid tier**, and **158 (53%) are quote-only**. Our Pricing Transparency Score for the market is **38 out of 100**. The split is sharp: password managers (93), secrets management (78) and CIAM (65) mostly show their prices, while identity governance (5), CIEM (0), ITDR (14) and PAM (16) almost never do. But the clearest predictor isn't category. It's who the vendor sells to. Vendors that sell to startups or SMBs publish prices 56% of the time; enterprise-only vendors do so 9% of the time.

This report covers the whole index: what we counted, how we classified it, the CIAM free tiers we checked live on October 30, 2026, and a practical guide to pricing a quote-only deal. The full dataset is free to download under CC BY 4.0 (links below).

## Methodology

**Snapshot.** October 30, 2026. The population is all 297 vendor profiles in the SWI [vendor directory](https://startwithidentity.com/vendors/), across 17 categories. One product, Microsoft Entra Permissions Management, is retired and excluded from every rate, leaving 296.

**Source text.** Every SWI profile has a Pricing section, written to the [editorial standard](https://startwithidentity.com/editorial-policy/) and scored under our [methodology](https://startwithidentity.com/methodology/). A zero-dependency Node script (`scripts/reports/identity-pricing-index.mjs`, in the site repository) pulls that section from each profile and classifies it.

**Classification scheme.** One model per vendor:

| Model | Definition | Points |
|---|---|---|
| `published` | List price for at least one paid production tier on the vendor site; no free tier | 100 |
| `free-tier+published` | Permanent free tier and published paid prices | 100 |
| `free` | Free product with no paid tier at all | 100 |
| `free-tier+quote` | Permanent free tier, but every paid tier needs a quote | 50 |
| `open-source` | Free open-source core is the offer; commercial support or cloud is quoted | 50 |
| `quote-only` | No published paid price and no free tier (50 if a public cloud-marketplace listing shows a price) | 0 |
| `bundled` | Only sold inside a larger suite or contract | 0 |

Open-core vendors that do publish managed-cloud prices (Supabase, Ory, Infisical, Cerbos and others) count as `free-tier+published` and carry an `open_source_core` flag. A free trial is not a free tier.

**Rules, then people.** Keyword rules classify each Pricing section ("quote-based", "not published", "free tier", dollar amounts and so on, with negations handled). A call counts as confident only when one model fires cleanly. The rules made 93 confident calls, all of them `quote-only`, which we spot-read. The other 140 were classified by hand from the profile text, and each override sits in the script with its reason. The script won't write the dataset while any low-confidence call lacks an override.

**Live verification.** We loaded the pricing pages of 69 vendors on October 30, 2026, starting with the most-searched names, and read 64 successfully. For those 64, the live page decides the classification, and the dataset records the URL, the free-tier limit and the first paid price. Five checks failed and are marked `verified_live: false`. BeyondTrust, Entrust (Onfido) and Persona returned HTTP 403, Stripe served Canadian-dollar prices. Userfront's pricing page now describes a different product. Where a profile turned out to be wrong, we corrected it. That happened 12 times (see "Profiles we corrected" below).

**Pricing Transparency Score.** For any group of vendors: *PTS = the mean of vendor points*, on a 0 to 100 scale, using the points column above. A category where every vendor publishes scores 100. A category where every vendor is quote-only scores 0.

**Segments and ownership.** "Serves SMB/startup" means the profile's `target_segments` includes Startup, SMB, Personal or Consumer. Everything else is enterprise-only. Ownership buckets come from the profile's `ownership` field: independent private, private equity, public company, acquired or subsidiary, product line of a larger company, acquisition pending, and community or nonprofit. Ownership reflects the profiles as of October 31, 2026, after that day's acquisitions update; a re-run the same day also picked up Obsidian Security's newly listed free tier.

**Limits.** Most rows outside the live sample reflect each profile's last review date, which is in the dataset, so a vendor may have changed its pricing since. "Published" means a buyer can see at least one real paid price. It doesn't mean the price you'll pay at scale: almost every published model still ends in an "Enterprise: contact us" tier. The directory isn't a census of every identity vendor, and the category sizes differ (5 machine-identity profiles, 44 identity verification profiles). We don't track discounts, and none appear here.

## Finding 1: a quarter of the market shows you a price

| Pricing model | Vendors | Share |
|---|---|---|
| Quote-only | 158 | 53.4% |
| Free tier + published | 42 | 14.2% |
| Published | 38 | 12.8% |
| Open source (paid support quoted) | 22 | 7.4% |
| Free (no paid tier) | 14 | 4.7% |
| Free tier + quote | 13 | 4.4% |
| Bundled | 9 | 3.0% |
| **Total currently sold** | **296** | |

Eighty vendors (27.0%) publish at least one paid price. Add the 14 products that are simply free, and you can know the cost of 94 (31.8%) without talking to anyone. Free entry is more common than published pricing: 55 vendors have a permanent free tier, and 36 more are free open source or free outright. In identity, it's often easier to start using a product than to find out what it costs.

## Finding 2: the Transparency Score by category

| Category | Vendors | Publish a paid price | Any free entry | Quote-only | Bundled | **PTS** |
|---|---|---|---|---|---|---|
| [Password management](https://startwithidentity.com/vendors/password-management/) | 22 | 72.7% | 50.0% | 4.5% | 0% | **93** |
| [Open-source IAM](https://startwithidentity.com/vendors/open-source/) | 15 | 33.3% | 100% | 0% | 0% | **80** |
| [Secrets management](https://startwithidentity.com/vendors/secrets/) | 9 | 66.7% | 44.4% | 11.1% | 0% | **78** |
| [CIAM](https://startwithidentity.com/vendors/ciam/) | 30 | 56.7% | 66.7% | 23.3% | 3.3% | **65** |
| [Authorization](https://startwithidentity.com/vendors/authorization/) | 11 | 36.4% | 63.6% | 18.2% | 9.1% | **59** |
| [PKI and certificates](https://startwithidentity.com/vendors/pki/) | 9 | 33.3% | 33.3% | 33.3% | 0% | **56** |
| [MFA](https://startwithidentity.com/vendors/mfa/) | 18 | 33.3% | 16.7% | 50.0% | 5.6% | **42** |
| [Machine identity](https://startwithidentity.com/vendors/machine-identity/) | 5 | 0% | 60.0% | 40.0% | 0% | **40** |
| [Decentralized identity](https://startwithidentity.com/vendors/decentralized-identity/) | 17 | 11.8% | 52.9% | 47.1% | 0% | **35** |
| [IAM platforms](https://startwithidentity.com/vendors/iam/) | 20 | 25.0% | 15.0% | 65.0% | 0% | **33** |
| [Zero trust](https://startwithidentity.com/vendors/zero-trust/) | 13 | 30.8% | 23.1% | 69.2% | 0% | **31** |
| [Identity verification](https://startwithidentity.com/vendors/identity-verification/) | 44 | 15.9% | 4.5% | 84.1% | 0% | **16** |
| [PAM](https://startwithidentity.com/vendors/pam/) | 19 | 10.5% | 15.8% | 68.4% | 10.5% | **16** |
| [Agentic and AI identity](https://startwithidentity.com/vendors/ai-identity/) | 14 | 7.1% | 14.3% | 78.6% | 7.1% | **14** |
| [ITDR](https://startwithidentity.com/vendors/itdr/) | 21 | 9.5% | 4.8% | 76.2% | 9.5% | **14** |
| [Identity governance (IGA)](https://startwithidentity.com/vendors/iga/) | 20 | 0% | 10.0% | 85.0% | 5.0% | **5** |
| [CIEM](https://startwithidentity.com/vendors/ciem/) | 9 | 0% | 0% | 100% | 0% | **0** |
| **All identity** | **296** | **27.0%** | **30.7%** | **53.4%** | **3.0%** | **38** |

"Any free entry" counts free tiers, free open-source cores and free products. Machine identity scores 40 without a single list price because [HashiCorp Vault](https://startwithidentity.com/vendors/machine-identity/hashicorp-vault/) Community and SPIFFE/SPIRE are free to run and [Akeyless](https://startwithidentity.com/vendors/machine-identity/akeyless/) has a free tier. Its paid tiers are all quoted.

The hypothesis we started with mostly holds. Developer and self-serve tools publish. Governance, privileged access and detection tools don't. Across IGA, PAM, ITDR and CIEM combined, **55 of 69 vendors (80%) are quote-only**, and only four publish a paid price: [Keeper](https://startwithidentity.com/vendors/pam/keeper-security/) (business password plans per user, with KeeperPAM quoted), [ManageEngine PAM360](https://startwithidentity.com/vendors/pam/manageengine-pam360/) (from $7,995 a year for 10 administrators and 25 keys), [Nudge Security](https://startwithidentity.com/vendors/itdr/nudge-security/) ($750 a month up to 150 users, then $5 per user) and [Push Security](https://startwithidentity.com/vendors/itdr/push-security/) ($5 per user per month up to 500 employees). In IGA, [SailPoint](https://startwithidentity.com/vendors/iga/sailpoint/), [Saviynt](https://startwithidentity.com/vendors/iga/saviynt/), [Lumos](https://startwithidentity.com/vendors/iga/lumos/), [Veza](https://startwithidentity.com/vendors/iga/veza/) and [C1](https://startwithidentity.com/vendors/iga/conductorone/) all sent us to sales when we checked. C1 now describes two pricing models on its page (platform pricing by managed identities, and usage-based "Flex" pricing in C1 Tokens) but shows no rates. See the [IGA](https://startwithidentity.com/rankings/best-iga-tools/) and [PAM](https://startwithidentity.com/rankings/best-pam-tools/) rankings and the [SailPoint vs Saviynt](https://startwithidentity.com/compare/sailpoint-vs-saviynt/) and [CyberArk vs Delinea](https://startwithidentity.com/compare/cyberark-vs-delinea/) comparisons for what separates them besides price.

Identity verification is the odd one out. It's a usage-priced, developer-integrated category, and it still scores 16, because most of its 44 vendors sell to banks and governments on volume contracts. The seven that publish are [Didit](https://startwithidentity.com/vendors/identity-verification/didit/), [Veriff](https://startwithidentity.com/vendors/identity-verification/veriff/), [Sumsub](https://startwithidentity.com/vendors/identity-verification/sumsub/), [Persona](https://startwithidentity.com/vendors/identity-verification/persona/), [Stripe Identity](https://startwithidentity.com/vendors/identity-verification/stripe-identity/), [iDenfy](https://startwithidentity.com/vendors/identity-verification/idenfy/) and [SEON](https://startwithidentity.com/vendors/identity-verification/seon/). The [Persona vs Veriff](https://startwithidentity.com/compare/persona-vs-veriff/) comparison covers the two most-compared.

Agentic and non-human identity, the newest category, behaves like enterprise security, not like developer tooling: 11 of 14 vendors are quote-only. [Aembit](https://startwithidentity.com/vendors/ai-identity/aembit/) is the exception. It now lists $20 per workload per month after a free tier of 10 workloads. [P0 Security](https://startwithidentity.com/vendors/ai-identity/p0-security/) has a price only on AWS Marketplace. [Astrix Security](https://startwithidentity.com/vendors/ai-identity/astrix-security/) ended standalone sales of new licenses on June 30, 2026 and now sells through Cisco.

## Finding 3: who you sell to matters more than what you sell

| Target segment | Vendors | Publish a paid price | Quote-only | PTS |
|---|---|---|---|---|
| Serves startups or SMBs | 113 | 55.8% | 12.4% | 76 |
| Enterprise-only | 183 | 9.3% | 78.7% | 14 |

The gap survives a category control. Inside the six enterprise-security categories (IAM, IGA, PAM, ITDR, CIEM, zero trust), the 14 vendors that also target SMBs publish prices **57.1%** of the time, against **5.7%** for the 88 enterprise-only vendors. Inside the developer and self-serve categories (CIAM, open-source IAM, secrets, authorization, password management), the pattern repeats: 66.2% of SMB-facing vendors publish, against 15.8% of enterprise-only ones. In other words, enterprise-only vendors in CIAM ([Transmit Security](https://startwithidentity.com/vendors/ciam/transmit-security/), [SAP Customer Data Cloud](https://startwithidentity.com/vendors/ciam/sap-customer-data-cloud/), [Akamai Identity Cloud](https://startwithidentity.com/vendors/ciam/akamai-identity-cloud/)) behave like IGA vendors. SMB-facing tools in PAM and zero trust ([Keeper](https://startwithidentity.com/vendors/pam/keeper-security/), [Tailscale](https://startwithidentity.com/vendors/zero-trust/tailscale/), [Twingate](https://startwithidentity.com/vendors/zero-trust/twingate/)) behave like CIAM. Pricing transparency follows the sales motion. A product sold by self-serve signup has to show a price. A product sold through a six-month evaluation doesn't.

## Finding 4: ownership is a weaker signal, and a confounded one

| Ownership (from profile) | Vendors | Publish a paid price | Quote-only | PTS |
|---|---|---|---|---|
| Product line of a larger company | 28 | 46.4% | 32.1% | 55 |
| Independent private | 175 | 32.0% | 55.4% | 39 |
| Public company (standalone) | 21 | 19.0% | 76.2% | 19 |
| Acquired or subsidiary | 38 | 10.5% | 52.6% | 24 |
| Private equity | 18 | 11.1% | 83.3% | 14 |
| Acquisition pending | 1 | 0% | 100% | 0 |
| Community or nonprofit | 15 | 6.7% | 0% | 90 |

Acquired vendors publish less often than independent ones (11% against 32%), and private-equity-owned vendors are the group most often quote-only (83%, with 11% publishing). Treat this as a correlation, not a cause. The PE-owned group is dominated by enterprise IGA, PAM and PKI vendors such as [Ping Identity](https://startwithidentity.com/vendors/iam/ping-identity/), [BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) and [Delinea](https://startwithidentity.com/vendors/pam/delinea/), so category and segment explain most of the gap. Acquisitions also tend to remove price lists rather than add them: [StrongDM](https://startwithidentity.com/vendors/pam/strongdm/)'s old pricing page now redirects to Delinea's unpriced bundles page, and [Warrant](https://startwithidentity.com/vendors/authorization/warrant/), [Osirium](https://startwithidentity.com/vendors/pam/osirium/), [Procyon](https://startwithidentity.com/vendors/pam/procyon/) and [Zilla](https://startwithidentity.com/vendors/iga/zilla-security/) are now sold only inside their acquirers' platforms. The hyperscalers push the other way. [Amazon Cognito](https://startwithidentity.com/vendors/ciam/amazon-cognito/), [AWS Secrets Manager](https://startwithidentity.com/vendors/secrets/aws-secrets-manager/), [Google Cloud Secret Manager](https://startwithidentity.com/vendors/secrets/google-cloud-secret-manager/) and [Microsoft Entra](https://startwithidentity.com/vendors/iam/microsoft-entra/) all publish rate cards, which is why "product line of a larger company" ranks highest. Our [acquisitions tracker](https://startwithidentity.com/acquisitions/) has the deal history.

## CIAM and developer-auth free tiers, verified live

Every row below was read from the vendor's own pricing page on **October 30, 2026**. Prices are USD list prices as displayed. "First paid tier" is the lowest published paid option, not what you'll pay at scale.

| Vendor | Free tier | First paid tier (published) | Billing unit | Source |
|---|---|---|---|---|
| [WorkOS](https://startwithidentity.com/vendors/ciam/workos/) (AuthKit) | 1,000,000 MAU | $2,500/month per additional 1M MAU; SSO and Directory Sync $125 per connection (1 to 15) | MAU; per connection | [pricing](https://workos.com/pricing) |
| [Clerk](https://startwithidentity.com/vendors/ciam/clerk/) | 50,000 monthly retained users per app | Pro $25/month ($20 annual); $0.02 per user from 50,001 | Monthly retained user | [pricing](https://clerk.com/pricing) |
| [Firebase Auth / Google Identity Platform](https://startwithidentity.com/vendors/ciam/google-identity/) | 50,000 MAU (50 for SAML/OIDC) | Google Cloud rate above 50,000 (not read; page truncated) | MAU | [pricing](https://firebase.google.com/pricing) |
| [Supabase Auth](https://startwithidentity.com/vendors/open-source/supabase-auth/) | 50,000 MAU | Pro from $25/month with 100,000 MAU; $0.00325 per MAU above | MAU | [pricing](https://supabase.com/pricing) |
| [Logto](https://startwithidentity.com/vendors/open-source/logto/) | 50,000 MAU | Pro from $24/month; $0.08 per 100 extra tokens | Access tokens | [pricing](https://logto.io/pricing) |
| [Microsoft Entra External ID](https://startwithidentity.com/vendors/ciam/microsoft-entra-external-id/) | 50,000 MAU | Pay-as-you-go; rate not shown on the Entra pricing page | MAU | [pricing](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) |
| [Auth0](https://startwithidentity.com/vendors/ciam/auth0/) | 25,000 MAU | Essentials from $35/month (B2C) or $150/month (B2B) | Flat MAU bands | [pricing](https://auth0.com/pricing) |
| [MojoAuth](https://startwithidentity.com/vendors/ciam/mojoauth/) | 25,000 MAU | Business Pro $150/month at 2,500 MAU; $0.06 per MAU above tier | MAU tiers | [pricing](https://mojoauth.com/pricing) |
| [Kinde](https://startwithidentity.com/vendors/ciam/kinde/) | 10,500 MAU | Pro $25/month; $0.0175 per MAU above 10,500 | MAU | [pricing](https://kinde.com/pricing/) |
| [Stytch](https://startwithidentity.com/vendors/ciam/stytch/) | 10,000 MAU (users and AI agents) | Pay as you go; per-MAU rate not shown; SSO/SCIM $125 per connection beyond 5 | MAU | [pricing](https://stytch.com/pricing) |
| [Amazon Cognito](https://startwithidentity.com/vendors/ciam/amazon-cognito/) | 10,000 MAU (Lite and Essentials) | Essentials $0.015 per MAU; Lite $0.0055 per MAU | MAU | [pricing](https://aws.amazon.com/cognito/pricing/) |
| [PropelAuth](https://startwithidentity.com/vendors/ciam/propelauth/) | 10,000 MAU | Growth $150/month; $0.05 per MAU above 10,000 | MAU | [pricing](https://www.propelauth.com/pricing) |
| [Hanko](https://startwithidentity.com/vendors/open-source/hanko/) | 10,000 MAU | Pro $29/month; $0.01 per MAU above 10,000 | MAU | [pricing](https://www.hanko.io/pricing) |
| [Descope](https://startwithidentity.com/vendors/ciam/descope/) | 7,500 MAU, 10 tenants, 3 SSO connections | Pro from $249/month billed annually (10,000 MAU) | Plan allowance | [pricing](https://www.descope.com/pricing) |
| [Frontegg](https://startwithidentity.com/vendors/ciam/frontegg/) | 7,500 MAU, 5 SSO/SCIM connections | Usage rates not shown; Enterprise custom | Usage | [pricing](https://frontegg.com/pricing) |
| [SuperTokens](https://startwithidentity.com/vendors/ciam/supertokens/) | 5,000 MAU managed; unlimited self-hosted | $0.02 per MAU | MAU | [pricing](https://supertokens.com/pricing) |
| [Zitadel](https://startwithidentity.com/vendors/open-source/zitadel/) | 100 daily active users | Pro $100/month with 25,000 DAU | Daily active user | [pricing](https://zitadel.com/pricing) |
| [Ory](https://startwithidentity.com/vendors/open-source/ory/) | Developer plan (not for production) | Production $770/year; $0.14 per aDAU per month | Average daily active user | [pricing](https://www.ory.com/pricing) |
| [SSOJet](https://startwithidentity.com/vendors/ciam/ssojet/) | Unlimited users and MAU, no enterprise SSO/SCIM | $59 per connection per month annual ($79 monthly), two-connection minimum | Per SSO or SCIM connection | [pricing](https://ssojet.com/pricing) |
| [FusionAuth](https://startwithidentity.com/vendors/ciam/fusionauth/) | Community edition, self-hosted, unlimited | Starter from $162/month billed annually | Per month, sized by MAU | [pricing](https://fusionauth.io/pricing) |
| [Authgear](https://startwithidentity.com/vendors/ciam/authgear/) | Free plan | Developers $50/month; Business $500/month with 25,000 MAU | Plan, MAU blocks | [pricing](https://www.authgear.com/pricing) |
| [Authsignal](https://startwithidentity.com/vendors/ciam/authsignal/) | None (30-day trial) | From $0.05 per MAU per month, annual | MAU | [pricing](https://www.authsignal.com/pricing) |
| [Strivacity](https://startwithidentity.com/vendors/ciam/strivacity/) | None | From $17,000/year | MAU licence size | [pricing](https://www.strivacity.com/pricing) |

Three things in this table matter more than the headline free-tier number.

**"Active user" means different things.** Clerk counts retained users (people who come back at least a day after signing up). Zitadel and Ory count daily actives. Logto bills on tokens, not users. Stytch counts AI agents alongside users. A 50,000 "MAU" free tier from one vendor and a 50,000 "MRU" free tier from another don't hold the same traffic. Read the definition before you compare.

**B2B costs often come from connections, not users.** WorkOS, Stytch and SSOJet all charge per enterprise SSO or SCIM connection. At a dozen enterprise customers, the connection line can exceed the MAU line. SSOJet counts a customer using both SSO and SCIM as two connections. Our [SSO and SCIM platforms for B2B SaaS](https://startwithidentity.com/rankings/best-sso-scim-platforms-b2b-saas/) ranking and the [WorkOS vs Frontegg](https://startwithidentity.com/compare/workos-vs-frontegg/) and [Frontegg vs SSOJet](https://startwithidentity.com/compare/frontegg-vs-ssojet/) comparisons work through that trade-off.

**The free tier isn't the price.** The median of the 16 MAU-based free tiers here is 17,750 MAU, and half of them stop at 10,500 or fewer. Model your growth curve with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/), and see [Auth0 vs Clerk](https://startwithidentity.com/compare/auth0-vs-clerk/), [Clerk vs Kinde](https://startwithidentity.com/compare/clerk-vs-kinde/) and the [best CIAM for startups](https://startwithidentity.com/rankings/best-ciam-for-startups/) ranking.

Workforce and security tools we verified live the same day, for reference: [Okta](https://startwithidentity.com/vendors/iam/okta/) Workforce Starter $6 and Essentials $17 per user per month with a $1,500 annual minimum; Microsoft Entra ID P1 $7, P2 $10, Entra Suite $12 and ID Governance $7 per user per month paid yearly ([Okta vs Microsoft Entra](https://startwithidentity.com/compare/okta-vs-microsoft-entra/)); [Duo](https://startwithidentity.com/vendors/mfa/duo/) free for 10 users, then $3, $6 and $9; [JumpCloud](https://startwithidentity.com/vendors/iam/jumpcloud/) SSO $11 per user per month annual, with suites quoted and no permanent free tier; [1Password](https://startwithidentity.com/vendors/password-management/1password/) Business $8.99 per user per month billed yearly; [Bitwarden](https://startwithidentity.com/vendors/password-management/bitwarden/) Teams $4 and Enterprise $6; [Doppler](https://startwithidentity.com/vendors/secrets/doppler/) free for 3 users, Team $21 per user; [Infisical](https://startwithidentity.com/vendors/secrets/infisical/) free for 5 identities, Pro $20 per identity per month annual ([Doppler vs Infisical](https://startwithidentity.com/compare/doppler-vs-infisical/)); AWS Secrets Manager $0.40 per secret per month plus $0.05 per 10,000 API calls; [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) Hub from $25 a month, priced per monthly active principal, with the open-source engine free.

## Finding 5: pricing pages move, in both directions

Twelve of the 64 vendors we verified (19%) had a profile Pricing section that no longer matched the live page. We fixed all twelve and re-dated them. The changes ran both ways:

- **Newly or more transparent:** Aembit (now published per workload), Strivacity (a published $17,000 a year starting price), Veriff (self-serve per-verification plans), Akeyless (a documented free tier).
- **Less than our profile said:** C1 (no starting prices shown), JumpCloud (no permanent free tier, platform suites quoted), Authsignal (trial only, no free tier), [Permit.io](https://startwithidentity.com/vendors/authorization/permit-io/) (only a free Community plan and a quoted Enterprise plan are listed), Keeper (KeeperPAM is custom-priced), Astrix (no longer sold standalone).
- **Changed figures:** SSOJet's per-connection ladder, and FusionAuth's MAU-sized paid plans.

If roughly one in five price descriptions drifts within a few months, any pricing claim older than a quarter, including ours, deserves a re-check before it goes into a budget. Every row in the dataset carries either a `verified_on` date or the profile's `profile_last_evaluated` date for that reason.

## How to get a real price from a quote-only identity vendor

Most enterprise identity purchases start with "contact sales". You can still control the process. What follows uses only mechanisms the vendors themselves publish. We don't quote discount percentages because we haven't verified any.

**1. Write the scope once, send it to everyone.** Quotes differ mostly because the scope differs. Give every shortlisted vendor the same written sheet:

| Category | What drives the price | What to put in your scope |
|---|---|---|
| IGA | Managed identities (employees, contractors, sometimes machine accounts), connected applications, modules (access reviews, lifecycle, SoD, analytics) | Identity count by type; list of target apps and whether each needs a full connector or a flat-file feed; modules in year one versus later |
| PAM | Privileged users, vaulted accounts, servers and endpoints, session recording, remote vendor access | Counts for each; whether sessions are recorded and retained; SaaS or self-hosted |
| CIAM | Active users (and the vendor's definition of "active"), enterprise SSO/SCIM connections, MFA and SMS volume, environments | Peak monthly actives, B2B customer count, SMS volume by country, number of non-production tenants |
| NHI and secrets | Machine identities, workloads or "clients", secrets stored, API calls, developers | Workload and service-account inventory; secret count and read frequency; active committers |
| ITDR | Users or employee headcount, directories and identity providers covered | Headcount, AD forests, IdPs, cloud tenants |
| Identity verification | Completed verifications, check types, countries, monthly minimums | Monthly volume by check type and country; retry rate |

**2. Pin down the unit definitions in writing.** These definitions do more to set the bill than the headline rate. Published examples show the range. GitGuardian counts a developer as anyone with a commit in the last 90 days. Clerk counts retained users rather than every sign-up. Duo bills per active user in fixed increments. Doppler doesn't charge for non-human identities. Veriff bills on decisions, not retries, and Sumsub only on completed verifications. Ask each quote-only vendor the same questions. Who counts toward the license? Are inactive or deprovisioned identities billed? Do service accounts count as identities? Do test environments cost money? (WorkOS and SSOJet publish that staging and test connections are free.)

**3. Ask for unit prices and overage rates, not a total.** A single annual number hides how the price grows. Ask for the per-unit price at your current count and at two or three times it. Ask for the overage rate and when it's billed (Authgear and Akeyless, for example, bill overage after the period), and ask whether the next band is priced on the whole volume or only the excess. Auth0's published plans show why this matters: usage between its MAU bands is billed at the next band up.

**4. Separate the add-ons.** Identity quotes grow by line item. Okta's own page says Customer Identity add-ons are quoted separately. Ping says SSO, MFA, verification and threat protection are priced as separate add-ons. Silverfort's AWS Marketplace listing adds 10% or 20% of the license cost for premium support tiers. For each item ask: is it in the base, an add-on, or a higher tier? Typical candidates are connectors, SMS, session recording, data residency, sandbox environments, premium support and SLA upgrades.

**5. Use published anchors.** Where a competitor publishes, bring the number. A PAM quote can be compared to ManageEngine PAM360's published editions, a workforce SSO quote to Okta's and Entra's list prices, an NHI quote to Aembit's or Infisical's per-identity rates, and a KYC quote to Veriff's or Sumsub's per-check rates. Cloud marketplaces sometimes show what a vendor's site won't: P0 Security and Silverfort both have AWS Marketplace prices.

**6. Negotiate term, not just price.** Ask for the renewal cap in writing, whether price holds if counts fall, what the true-up schedule is, and what happens to the rate when the vendor is acquired. Thirty-nine of the vendors in this index are acquired subsidiaries or have an acquisition pending, and acquisitions are often when products get repackaged into bundles. Annual prepay terms are also published by some vendors: Auth0 charges 11 times the monthly price for a year.

**7. Model three years, including people.** For IGA and PAM, implementation services are a large share of the first-year cost, and our profiles of SailPoint, Saviynt and CyberArk say so. For open source, the license is zero and the cost is engineering time. Put both into the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/) and the [build vs buy](https://startwithidentity.com/tools/build-vs-buy/) tool, and use the [RFP builder](https://startwithidentity.com/tools/rfp-builder/) to send the scope sheet in step 1.

## What this means for buyers

- **For developer and SMB purchases**, you can usually shortlist on published numbers. Compare definitions of "active user" and per-connection fees, not the free-tier headline.
- **For governance, privileged access and detection**, assume you'll get a quote, and plan the evaluation so the quotes are comparable. The scope sheet above does most of the work.
- **If a vendor sells to SMBs at all, ask for its SMB price list,** even if you're an enterprise. Vendors with self-serve plans publish far more often (Finding 3), and the published plan gives you a floor for the conversation.
- **Re-check before you budget.** One in five of the pricing descriptions we verified had changed.

## About the data

The dataset has one row per vendor profile (297 rows) with: vendor, slug, profile URL, category, pricing model, open-source-core flag, marketplace-price flag, pricing unit and unit family, free-tier limit, published starting price where one exists, transparency points, `verified_live`, `verified_on`, pricing URL, a verification note, the classification source (live check, manual review or rule), target segment, ownership bucket and the profile's last review date. Download it as [CSV](https://startwithidentity.com/data/reports/identity-pricing-index-2026.csv) or [JSON](https://startwithidentity.com/data/reports/identity-pricing-index-2026.json). It's licensed CC BY 4.0; please link back to this page.

Prices are list prices as displayed on vendor sites on the snapshot date, in USD unless noted. They aren't quotes, and they exclude taxes and promotions. We will re-run the index after the next profile review cycle. If a vendor's row is wrong, tell us through the [contact page](https://startwithidentity.com/contact/) with a link to the current pricing page and we'll correct it and credit you. For the other numbers behind identity security, see the [research hub](https://startwithidentity.com/research/) and the [State of Identity 2026](https://startwithidentity.com/reports/state-of-identity-2026/) report.