CyberArk vs BeyondTrust vs Delinea: what privileged access costs per admin seat

The rebrand is the event, and it lands on the renewal

CyberArk's identity security platform is being introduced as Idira, built on CyberArk's legacy and powered by Palo Alto Networks. The vendor's own answer to existing customers is that they can continue to use the platform as they always have and will notice a new logo and design, with cross-platform capabilities across the Palo Alto Networks portfolio available over time. For a team holding a CyberArk contract, that is a procurement question before it is a technical one: what the renewal is now buying, and from whom.

The same page frames the pitch around a change in who holds privilege. Legacy identity tools were built when elevated privileges were reserved for a select few, the argument runs, and now all identities need broad privileges. The vendor cites its 2026 Identity Security Landscape report, drawn from 2,930 global IT and security leaders, for the risk and readiness picture. Whether or not a buyer accepts the framing, it explains why the licensing conversation has moved from a handful of administrators to a much larger population of machine and agent identities.

That shift is what makes a per-seat comparison awkward this quarter. The three vendors a buyer would shortlist, CyberArk, BeyondTrust and Delinea, all sell privileged access management, but the unit they meter is not the same, and only one of the three has a pricing page in front of us. The rest of this piece works from what is published and marks plainly where a number is missing.

What the published pricing actually says

CyberArk's pricing page does not publish a per-admin-seat price, a per-vault price or a tier table. It is a product and positioning page that routes an interested buyer to a contact form, with fields for company, job level, role, phone and country, and a note that a Palo Alto Networks specialist will reach out. There is no list price to quote and no entry tier to compare against.

That absence is a finding rather than a gap. A buyer pricing 200 admin accounts against 2,000 cannot start from the vendor's own page, because the page carries no number at any volume. The same is true of the BeyondTrust and Delinea pages, which are not part of the material here; nothing in the supplied pages states their price model, their term or what their entry tier bundles.

What the CyberArk page does describe is scope. The platform is sold as securing every identity, human, machine and agentic, with discovery, risk analytics, secrets management including governance and reporting across vaults and workloads, remediation for unmanaged secrets, and integration with CI/CD pipelines. It also claims over 300 out-of-the-box integrations and over 200 alliance partners. Those are capabilities, not prices, and a buyer should treat them as the list of things to confirm are inside the quoted tier rather than sold above it.

The seat count that moves the quote is admin accounts

The vendor's own framing separates administrators from everyone else. It describes extending privileged-grade protection beyond administrators to every identity that matters, and lists modern PAM as discovery, dynamic privileged access that removes always-on standing privileges, and a unified command centre. A quote built on administrator seats and a quote built on all identities are different products at different prices, and the page does not say which unit it meters.

This is where the 200-versus-2,000 question bites. At 200 admin accounts, a per-seat model is a modest line and the tier boundary matters less than the modules included. At 2,000, the same model is ten times the line, and any per-identity or per-machine charge stacked on top changes the shape of the deal rather than its size. The page's emphasis on machine and agentic identities suggests the second population is in scope, but it publishes no unit for it.

A buyer should ask each vendor for the metered unit in writing: administrator accounts, all human identities, machine identities, or vaults. Ask where the tier boundary sits in that unit, and what is bundled above the entry tier rather than sold as an add-on. The CyberArk page names secrets management, certificate management and agentic identity controls as parts of the platform, which is exactly the list to confirm sits inside the quoted tier.

Where the platform breaks, and what the page does not answer

The page is candid about one limit: the cross-platform capabilities across the Palo Alto Networks portfolio arrive over time. An existing CyberArk customer renewing now is buying the platform as it stands plus a roadmap, not the integrated portfolio on day one. A buyer who needs the integration to justify the deal should ask for the sequence and the date, because the page gives neither.

The agentic identity capability is described concretely enough to test. Idira Secure AI Agents scans SaaS, cloud and developer environments to identify active agents and enrich them with ownership and permission levels, then enforces controls such as granting an agent access only for the duration of a specific task, with auditability of agent actions. That is a scoped claim about discovery and time-bound access, not a claim about containing a misbehaving agent, and the page does not describe one.

The governance answer is thinner. Asked whether the platform supports identity governance and administration, the page says it unifies visibility, automates access decisions and reduces identity risk across human and machine identities through their lifecycle. There is no statement of certification against a named framework, no audit report and no evidence pack on the page. A regulated buyer should ask for the current SOC 2 or ISO 27001 report and the date it covers before treating the governance line as satisfied.

What to put in front of procurement

Three documents decide this comparison, and none of them is on the pricing page. The first is a written quote at two volumes, 200 and 2,000 admin accounts, with the metered unit named. The second is the tier sheet showing what sits above the entry tier, specifically secrets management, certificate management and the agentic identity controls, since the page presents them as platform capabilities without saying which tier carries them.

The third is the renewal paper for an existing CyberArk customer. The vendor states that current customers continue to use the platform as before and will see a new logo and design, with portfolio capabilities over time. A buyer should get the contract term, the price protection and the migration path to Idira in writing, because the page describes the transition in product terms and not in commercial ones.

For BeyondTrust and Delinea, the same three documents apply and the supplied material does not describe their price model, term or bundled scope. That is not a mark against either vendor; it means the comparison cannot be settled from published pages and has to be run as a three-way quote at the same two seat counts, with the same questions asked in the same order.

The decision rule

Choose CyberArk, now Idira, if the estate already runs it and the renewal can be written with price protection and a dated path to the Palo Alto Networks portfolio, because continuity is worth more than a marginal seat discount and the platform's scope already covers human, machine and agentic identities. Ask for the tier sheet and the audit report before signing, since the page publishes neither.

Shortlist BeyondTrust or Delinea if the deciding factor is a published, predictable per-seat number at 2,000 admin accounts, and treat the absence of a published figure from any of the three as a reason to run the quote rather than to eliminate a vendor. Wait on the portfolio integration if the business case depends on it, because the page says those capabilities arrive over time and gives no date.

At 200 admin accounts the tier boundary matters more than the unit price, so ask what is bundled above entry before comparing totals. At 2,000 the metered unit decides the deal, so get the definition of an admin account in writing and price the machine and agent identities separately if the vendor meters them.