Identity Pricing Transparency Index 2026

Most identity software has no public price. Of the 296 identity vendors in our directory that are still on sale, only 80 (27%) publish a price for any paid tier, and 158 (53%) are quote-only. Our Pricing Transparency Score for the market is 38 out of 100. The split is sharp: password managers (93), secrets management (78) and CIAM (65) mostly show their prices, while identity governance (5), CIEM (0), ITDR (14) and PAM (16) almost never do. But the clearest predictor isn't category. It's who the vendor sells to. Vendors that sell to startups or SMBs publish prices 56% of the time; enterprise-only vendors do so 9% of the time.

This report covers the whole index: what we counted, how we classified it, the CIAM free tiers we checked live on October 30, 2026, and a practical guide to pricing a quote-only deal. The full dataset is free to download under CC BY 4.0 (links below).

Methodology

Snapshot. October 30, 2026. The population is all 297 vendor profiles in the SWI vendor directory, across 17 categories. One product, Microsoft Entra Permissions Management, is retired and excluded from every rate, leaving 296.

Source text. Every SWI profile has a Pricing section, written to the editorial standard and scored under our methodology. A zero-dependency Node script (scripts/reports/identity-pricing-index.mjs, in the site repository) pulls that section from each profile and classifies it.

Classification scheme. One model per vendor:

Open-core vendors that do publish managed-cloud prices (Supabase, Ory, Infisical, Cerbos and others) count as free-tier+published and carry an open_source_core flag. A free trial is not a free tier.

Rules, then people. Keyword rules classify each Pricing section ("quote-based", "not published", "free tier", dollar amounts and so on, with negations handled). A call counts as confident only when one model fires cleanly. The rules made 93 confident calls, all of them quote-only, which we spot-read. The other 140 were classified by hand from the profile text, and each override sits in the script with its reason. The script won't write the dataset while any low-confidence call lacks an override.

Live verification. We loaded the pricing pages of 69 vendors on October 30, 2026, starting with the most-searched names, and read 64 successfully. For those 64, the live page decides the classification, and the dataset records the URL, the free-tier limit and the first paid price. Five checks failed and are marked verified_live: false. BeyondTrust, Entrust (Onfido) and Persona returned HTTP 403, Stripe served Canadian-dollar prices. Userfront's pricing page now describes a different product. Where a profile turned out to be wrong, we corrected it. That happened 12 times (see "Profiles we corrected" below).

Pricing Transparency Score. For any group of vendors: PTS = the mean of vendor points, on a 0 to 100 scale, using the points column above. A category where every vendor publishes scores 100. A category where every vendor is quote-only scores 0.

Segments and ownership. "Serves SMB/startup" means the profile's target_segments includes Startup, SMB, Personal or Consumer. Everything else is enterprise-only. Ownership buckets come from the profile's ownership field: independent private, private equity, public company, acquired or subsidiary, product line of a larger company, acquisition pending, and community or nonprofit. Ownership reflects the profiles as of October 31, 2026, after that day's acquisitions update; a re-run the same day also picked up Obsidian Security's newly listed free tier.

Limits. Most rows outside the live sample reflect each profile's last review date, which is in the dataset, so a vendor may have changed its pricing since. "Published" means a buyer can see at least one real paid price. It doesn't mean the price you'll pay at scale: almost every published model still ends in an "Enterprise: contact us" tier. The directory isn't a census of every identity vendor, and the category sizes differ (5 machine-identity profiles, 44 identity verification profiles). We don't track discounts, and none appear here.

Finding 1: a quarter of the market shows you a price

Eighty vendors (27.0%) publish at least one paid price. Add the 14 products that are simply free, and you can know the cost of 94 (31.8%) without talking to anyone. Free entry is more common than published pricing: 55 vendors have a permanent free tier, and 36 more are free open source or free outright. In identity, it's often easier to start using a product than to find out what it costs.

Finding 2: the Transparency Score by category

"Any free entry" counts free tiers, free open-source cores and free products. Machine identity scores 40 without a single list price because HashiCorp Vault Community and SPIFFE/SPIRE are free to run and Akeyless has a free tier. Its paid tiers are all quoted.

The hypothesis we started with mostly holds. Developer and self-serve tools publish. Governance, privileged access and detection tools don't. Across IGA, PAM, ITDR and CIEM combined, 55 of 69 vendors (80%) are quote-only, and only four publish a paid price: Keeper (business password plans per user, with KeeperPAM quoted), ManageEngine PAM360 (from $7,995 a year for 10 administrators and 25 keys), Nudge Security ($750 a month up to 150 users, then $5 per user) and Push Security ($5 per user per month up to 500 employees). In IGA, SailPoint, Saviynt, Lumos, Veza and C1 all sent us to sales when we checked. C1 now describes two pricing models on its page (platform pricing by managed identities, and usage-based "Flex" pricing in C1 Tokens) but shows no rates. See the IGA and PAM rankings and the SailPoint vs Saviynt and CyberArk vs Delinea comparisons for what separates them besides price.

Identity verification is the odd one out. It's a usage-priced, developer-integrated category, and it still scores 16, because most of its 44 vendors sell to banks and governments on volume contracts. The seven that publish are Didit, Veriff, Sumsub, Persona, Stripe Identity, iDenfy and SEON. The Persona vs Veriff comparison covers the two most-compared.

Agentic and non-human identity, the newest category, behaves like enterprise security, not like developer tooling: 11 of 14 vendors are quote-only. Aembit is the exception. It now lists $20 per workload per month after a free tier of 10 workloads. P0 Security has a price only on AWS Marketplace. Astrix Security ended standalone sales of new licenses on June 30, 2026 and now sells through Cisco.

Finding 3: who you sell to matters more than what you sell

The gap survives a category control. Inside the six enterprise-security categories (IAM, IGA, PAM, ITDR, CIEM, zero trust), the 14 vendors that also target SMBs publish prices 57.1% of the time, against 5.7% for the 88 enterprise-only vendors. Inside the developer and self-serve categories (CIAM, open-source IAM, secrets, authorization, password management), the pattern repeats: 66.2% of SMB-facing vendors publish, against 15.8% of enterprise-only ones. In other words, enterprise-only vendors in CIAM (Transmit Security, SAP Customer Data Cloud, Akamai Identity Cloud) behave like IGA vendors. SMB-facing tools in PAM and zero trust (Keeper, Tailscale, Twingate) behave like CIAM. Pricing transparency follows the sales motion. A product sold by self-serve signup has to show a price. A product sold through a six-month evaluation doesn't.

Finding 4: ownership is a weaker signal, and a confounded one

Acquired vendors publish less often than independent ones (11% against 32%), and private-equity-owned vendors are the group most often quote-only (83%, with 11% publishing). Treat this as a correlation, not a cause. The PE-owned group is dominated by enterprise IGA, PAM and PKI vendors such as Ping Identity, BeyondTrust and Delinea, so category and segment explain most of the gap. Acquisitions also tend to remove price lists rather than add them: StrongDM's old pricing page now redirects to Delinea's unpriced bundles page, and Warrant, Osirium, Procyon and Zilla are now sold only inside their acquirers' platforms. The hyperscalers push the other way. Amazon Cognito, AWS Secrets Manager, Google Cloud Secret Manager and Microsoft Entra all publish rate cards, which is why "product line of a larger company" ranks highest. Our acquisitions tracker has the deal history.

CIAM and developer-auth free tiers, verified live

Every row below was read from the vendor's own pricing page on October 30, 2026. Prices are USD list prices as displayed. "First paid tier" is the lowest published paid option, not what you'll pay at scale.

Three things in this table matter more than the headline free-tier number.

"Active user" means different things. Clerk counts retained users (people who come back at least a day after signing up). Zitadel and Ory count daily actives. Logto bills on tokens, not users. Stytch counts AI agents alongside users. A 50,000 "MAU" free tier from one vendor and a 50,000 "MRU" free tier from another don't hold the same traffic. Read the definition before you compare.

B2B costs often come from connections, not users. WorkOS, Stytch and SSOJet all charge per enterprise SSO or SCIM connection. At a dozen enterprise customers, the connection line can exceed the MAU line. SSOJet counts a customer using both SSO and SCIM as two connections. Our SSO and SCIM platforms for B2B SaaS ranking and the WorkOS vs Frontegg and Frontegg vs SSOJet comparisons work through that trade-off.

The free tier isn't the price. The median of the 16 MAU-based free tiers here is 17,750 MAU, and half of them stop at 10,500 or fewer. Model your growth curve with the TCO calculator, and see Auth0 vs Clerk, Clerk vs Kinde and the best CIAM for startups ranking.

Workforce and security tools we verified live the same day, for reference: Okta Workforce Starter $6 and Essentials $17 per user per month with a $1,500 annual minimum; Microsoft Entra ID P1 $7, P2 $10, Entra Suite $12 and ID Governance $7 per user per month paid yearly (Okta vs Microsoft Entra); Duo free for 10 users, then $3, $6 and $9; JumpCloud SSO $11 per user per month annual, with suites quoted and no permanent free tier; 1Password Business $8.99 per user per month billed yearly; Bitwarden Teams $4 and Enterprise $6; Doppler free for 3 users, Team $21 per user; Infisical free for 5 identities, Pro $20 per identity per month annual (Doppler vs Infisical); AWS Secrets Manager $0.40 per secret per month plus $0.05 per 10,000 API calls; Cerbos Hub from $25 a month, priced per monthly active principal, with the open-source engine free.

Finding 5: pricing pages move, in both directions

Twelve of the 64 vendors we verified (19%) had a profile Pricing section that no longer matched the live page. We fixed all twelve and re-dated them. The changes ran both ways:

• Newly or more transparent: Aembit (now published per workload), Strivacity (a published $17,000 a year starting price), Veriff (self-serve per-verification plans), Akeyless (a documented free tier).
• Less than our profile said: C1 (no starting prices shown), JumpCloud (no permanent free tier, platform suites quoted), Authsignal (trial only, no free tier), Permit.io (only a free Community plan and a quoted Enterprise plan are listed), Keeper (KeeperPAM is custom-priced), Astrix (no longer sold standalone).
• Changed figures: SSOJet's per-connection ladder, and FusionAuth's MAU-sized paid plans.

If roughly one in five price descriptions drifts within a few months, any pricing claim older than a quarter, including ours, deserves a re-check before it goes into a budget. Every row in the dataset carries either a verified_on date or the profile's profile_last_evaluated date for that reason.

How to get a real price from a quote-only identity vendor

Most enterprise identity purchases start with "contact sales". You can still control the process. What follows uses only mechanisms the vendors themselves publish. We don't quote discount percentages because we haven't verified any.

1. Write the scope once, send it to everyone. Quotes differ mostly because the scope differs. Give every shortlisted vendor the same written sheet:

2. Pin down the unit definitions in writing. These definitions do more to set the bill than the headline rate. Published examples show the range. GitGuardian counts a developer as anyone with a commit in the last 90 days. Clerk counts retained users rather than every sign-up. Duo bills per active user in fixed increments. Doppler doesn't charge for non-human identities. Veriff bills on decisions, not retries, and Sumsub only on completed verifications. Ask each quote-only vendor the same questions. Who counts toward the license? Are inactive or deprovisioned identities billed? Do service accounts count as identities? Do test environments cost money? (WorkOS and SSOJet publish that staging and test connections are free.)

3. Ask for unit prices and overage rates, not a total. A single annual number hides how the price grows. Ask for the per-unit price at your current count and at two or three times it. Ask for the overage rate and when it's billed (Authgear and Akeyless, for example, bill overage after the period), and ask whether the next band is priced on the whole volume or only the excess. Auth0's published plans show why this matters: usage between its MAU bands is billed at the next band up.

4. Separate the add-ons. Identity quotes grow by line item. Okta's own page says Customer Identity add-ons are quoted separately. Ping says SSO, MFA, verification and threat protection are priced as separate add-ons. Silverfort's AWS Marketplace listing adds 10% or 20% of the license cost for premium support tiers. For each item ask: is it in the base, an add-on, or a higher tier? Typical candidates are connectors, SMS, session recording, data residency, sandbox environments, premium support and SLA upgrades.

5. Use published anchors. Where a competitor publishes, bring the number. A PAM quote can be compared to ManageEngine PAM360's published editions, a workforce SSO quote to Okta's and Entra's list prices, an NHI quote to Aembit's or Infisical's per-identity rates, and a KYC quote to Veriff's or Sumsub's per-check rates. Cloud marketplaces sometimes show what a vendor's site won't: P0 Security and Silverfort both have AWS Marketplace prices.

6. Negotiate term, not just price. Ask for the renewal cap in writing, whether price holds if counts fall, what the true-up schedule is, and what happens to the rate when the vendor is acquired. Thirty-nine of the vendors in this index are acquired subsidiaries or have an acquisition pending, and acquisitions are often when products get repackaged into bundles. Annual prepay terms are also published by some vendors: Auth0 charges 11 times the monthly price for a year.

7. Model three years, including people. For IGA and PAM, implementation services are a large share of the first-year cost, and our profiles of SailPoint, Saviynt and CyberArk say so. For open source, the license is zero and the cost is engineering time. Put both into the TCO calculator and the build vs buy tool, and use the RFP builder to send the scope sheet in step 1.

What this means for buyers

• For developer and SMB purchases, you can usually shortlist on published numbers. Compare definitions of "active user" and per-connection fees, not the free-tier headline.
• For governance, privileged access and detection, assume you'll get a quote, and plan the evaluation so the quotes are comparable. The scope sheet above does most of the work.
• If a vendor sells to SMBs at all, ask for its SMB price list, even if you're an enterprise. Vendors with self-serve plans publish far more often (Finding 3), and the published plan gives you a floor for the conversation.
• Re-check before you budget. One in five of the pricing descriptions we verified had changed.

About the data

The dataset has one row per vendor profile (297 rows) with: vendor, slug, profile URL, category, pricing model, open-source-core flag, marketplace-price flag, pricing unit and unit family, free-tier limit, published starting price where one exists, transparency points, verified_live, verified_on, pricing URL, a verification note, the classification source (live check, manual review or rule), target segment, ownership bucket and the profile's last review date. Download it as CSV or JSON. It's licensed CC BY 4.0; please link back to this page.

Prices are list prices as displayed on vendor sites on the snapshot date, in USD unless noted. They aren't quotes, and they exclude taxes and promotions. We will re-run the index after the next profile review cycle. If a vendor's row is wrong, tell us through the contact page with a link to the current pricing page and we'll correct it and credit you. For the other numbers behind identity security, see the research hub and the State of Identity 2026 report.