Does self-hosting privacyIDEA cost less than RSA SecurID cost?
Self-hosting privacyIDEA usually trades the SecurID license and appliance spend for server, implementation, authenticator and staff costs, and whether that saves money depends on your own figures. If your RSA renewal or Authentication Manager upgrade is now on the table, build a side-by-side worksheet from your own numbers. RSA does not publish list prices, so this section quotes none. Request a written renewal or upgrade quote that itemizes licenses, token replacements, support and any appliance hardware. privacyIDEA is licensed under AGPLv3, so the software itself carries no license fee, though your legal team should review what the AGPLv3 terms require when you modify or distribute it. The remaining cost sits in the people and infrastructure needed to run it.
Self-hosting costs more in three places. The first is token reissue. privacyIDEA imports SafeNet XML, OATH CSV, Yubikey CSV and PSKC seed files, but confirm with the import documentation whether your existing SecurID tokens can be carried over, because many organizations end up issuing new authenticators. The second is implementation: installing on Ubuntu or a RHEL-family system, connecting user ID resolvers to your LDAP or Active Directory, and wiring RADIUS clients and PAM are paid engineering work. The third is in-house skill. Someone must own patching, backups and upgrades, and privacyIDEA v3.14 was published on October 7, 2026, so plan a recurring upgrade cycle. Self-hosting costs less in the subscription line and the appliance refresh cycle, which no longer appear in the budget.
Before you compare totals, gather three written inputs. Ask RSA for a quote that separates software licenses, hardware tokens, appliance hardware and support. Ask NetKnights, which offers the privacyIDEA Enterprise Edition, what support costs and what it covers, then confirm whether your team can run the community edition without it. Then price your own staff time, server capacity and token replacement for your user count, and run both options over the same period. Inventory your current token types and check which ones can be imported and which must be reissued, since that decision can change the result significantly. The privacyIDEA releases page shows the release history to plan upgrades against.
RSA SecurID cost components, side by side
This table sets each cost component of RSA SecurID against its counterpart in a self-hosted privacyIDEA deployment, and marks whether it is paid once or recurs. Read it as a checklist for your quote requests: RSA does not publish list prices, so the commercial column names the components to ask for rather than amounts. The main takeaway is that most of the recurring cost sits in subscriptions, appliance refresh and internal operations, and that the self-hosted side moves that spend onto staff time and optional support.
| Cost component | RSA SecurID (commercial side) | Self-hosted privacyIDEA | One-time or recurring |
|---|---|---|---|
| SecurID licenses and maintenance | Authentication Manager licenses and annual maintenance, quoted by RSA or a reseller; ask which tiers and user counts are included | No license fee for the AGPLv3 software; cost is the servers and staff that run it | Commercial: recurring. Self-hosted: none for software |
| Hardware tokens | Physical SecurID tokens bought per user and replaced as batteries or devices fail; confirm replacement terms | Software tokens (TOTP, HOTP, push, FIDO2) on user devices; hardware keys only where policy requires them | Commercial: one-time per token plus replacements. Self-hosted: optional, one-time |
| Authentication Manager appliances or servers | Hardware or virtual appliances, their hosting, and the support contract that covers them | Linux servers or VMs for privacyIDEA, a database and a RADIUS or web tier, sized in your own environment | Both: one-time hardware plus recurring hosting |
| Upgrade work | Major version moves and operating system changes that may need vendor services or internal change windows | Planned privacyIDEA upgrades from release notes, with internal testing time for each version | Both: recurring effort |
| privacyIDEA software | Not applicable | Free to download and use under AGPLv3; the project publishes releases on GitHub | Self-hosted: none for software |
| Optional NetKnights Enterprise Edition support | Not applicable | Available from NetKnights if you want vendor support or Enterprise features; quote from NetKnights | Self-hosted: optional, recurring if chosen |
| New authenticators | Replacement hardware tokens and any reissue campaign for users | Enrollment of new software or FIDO2 authenticators, plus a reissue plan for existing token seeds | Both: one-time per user, plus ongoing replacements |
| Migration effort | Staff time and possible vendor services to run both systems during enrollment | Design, RADIUS client repointing, agent replacement and parallel running, usually delivered by internal staff or a partner | Both: one-time |
| Operations | Monitoring, patching and support of the SecurID stack under the existing contract | Monitoring, backup, patching and on-call for privacyIDEA and its database | Both: recurring |
| Internal skills | Administrators familiar with Authentication Manager and its agents | Staff able to run Linux, PostgreSQL, RADIUS and the privacyIDEA configuration model, or a retained partner | Both: ongoing training and hiring |
What moves RSA SecurID cost comparisons most
Six variables decide whether a self-hosted privacyIDEA deployment costs more or less than the RSA SecurID estate it replaces. Most of them are facts about your environment that you should measure before requesting any quote. Each card names the direction the variable pushes the comparison and what to check.
User count and enrollment volume
Headcount drives the number of tokens to buy or issue, the number of enrollments to run, and the help desk load during rollout. Because privacyIDEA reads users from LDAP, Active Directory, SQL, SCIM or HTTP sources, the number of identities itself costs little, while the number of physical tokens and enrollment hours scale directly with users. Ask your team how many active users hold a SecurID token today and how many have a second factor they already use.
Mix of token types
Hardware OTP fobs carry a recurring replacement cost, while push, FIDO2 and passkeys, and smartcards move cost toward devices users already own or toward PIV issuance you may already run. privacyIDEA imports SafeNet XML and OATH CSV seed files, but SecurID seeds are not among its import formats, so any SecurID fobs you keep must be re-issued. Inventory each token type, its expiry or replacement cycle, and whether users can carry standard TOTP apps.
RADIUS clients and agents to repoint
Every VPN concentrator, firewall, SSH bastion or application that authenticates against Authentication Manager needs a RADIUS configuration change, and any agent you retire needs a replacement plan. privacyIDEA covers RADIUS for common VPNs and a PAM module for Linux, but Windows logon and web server integration follow different paths. Count each client and agent, record its owner, and estimate change windows and testing effort with your integrator before comparing totals.
Availability and disaster recovery design
A single privacyIDEA server is cheaper to run than a clustered estate, but authentication outages stop logins across every connected system. Redundant servers, database replication, backup testing and a documented restore path add infrastructure and staff time that recur every year. Decide the required recovery objectives first, then price the components that meet them, including load balancers, database high availability and off-site copies held in your own environment.
Level of vendor support required
privacyIDEA is AGPLv3 licensed and runs without a support contract, but the project's own site notes that a single company is currently involved and that an Enterprise Edition is available from NetKnights. RSA sells maintenance on a recurring basis. Decide whether your organization needs contractual response times, a named escalation path, or only community support with an internal or partner team. Ask any vendor or integrator to put support tiers, response commitments and renewal terms in writing.
Skills already on staff
Operating privacyIDEA means running Linux servers, a database, Python packages or RPM installs, TLS certificates and RADIUS. Teams that already run these services for other systems spend less on training and outside help than teams that depend on RSA appliance administration alone. Map who would own installation, upgrades, token lifecycle and incident response, and decide whether to train staff, hire, or buy a fixed-scope implementation from an outside partner.
Why existing SecurID tokens may force a reissue
For many teams the largest one-time cost in a move from RSA SecurID to privacyIDEA is not the software but the authenticators. Every hardware or software token that a user carries holds a seed, and whether that seed can move to a new system decides whether you pay for reuse or for reissue. privacyIDEA imports hardware token seed files in SafeNet XML, OATH CSV, Yubikey CSV and PSKC formats, and its OATH CSV format covers HOTP, TOTP, OCRA and TAN tokens. The sibling migration guidance treats SecurID seeds as outside those formats, so the default assumption should be that SecurID tokens will be reissued unless your RSA administrator can show a supported export path.
Start by asking your RSA administrator whether Authentication Manager can export token seeds in any form, and under what conditions, and ask the privacyIDEA project whether that export format can be mapped to one of its supported imports. Record the answer per token type, because a fleet of hardware fobs, software tokens and tokens already issued to contractors may not share the same answer. Do not assume that a file which looks like an OATH CSV is usable until a test import has confirmed it.
Model both paths in the cost worksheet. The reuse path carries the effort of export, a test import, and a parallel run to confirm each token still produces valid codes. The reissue path carries the purchase of new authenticators, the cost of distributing and enrolling them, helpdesk time for lost or swapped devices, and the cost of disposing of retired fobs. Ask for the reissue price per device in any quote and, for hardware, the lead time and minimum order quantity. Reissue usually recurs for tokens that expire or are lost, so count it as a continuing line as well as a one-time one.
Reuse, import or reissue: which token path changes the cost
This path keeps hardware or software tokens that privacyIDEA can already use, so users carry on with the device they have. It only works for token types and seed formats that privacyIDEA imports, and the import is a one-time task run through the Token, Import function. The main cost is the engineering and testing to confirm each token type authenticates correctly, not new hardware.
- One-time work: Confirm which token records can be exported in a supported format, run test imports, and check that a sample of logins succeeds before any user relies on the imported token.
- Recurring hardware or license implications: Existing hardware tokens stay in service with no new purchase, and no SecurID license applies to privacyIDEA itself, but you still need to plan for token replacement when batteries or devices fail.
- Users affected: Only users whose tokens import cleanly, so the group is usually smaller than the full population.
- Caution: SecurID seeds are not among privacyIDEA's listed import formats, so confirm with the vendor and your own export tooling before you plan around this path.
Before committing, ask a privacyIDEA partner or the project to confirm the exact format of your token export and test one token end to end.
This path moves seed material into privacyIDEA from a file, which is more work than keeping tokens in place because seeds have to be handled securely. privacyIDEA imports SafeNet XML, OATH CSV, Yubikey CSV and PSKC files, and can import GPG-encrypted seed files with its own GPG key. The OATH CSV format covers HOTP, TOTP, OCRA and TAN tokens. Seed handling needs a documented chain of custody.
- One-time work: Prepare files in a supported format, encrypt them with the GPG key, import them, and remove plaintext copies from every system and backup.
- Recurring hardware or license implications: Hardware tokens are still physical assets to track, and the seed import itself adds no recurring license fee for privacyIDEA.
- Users affected: Users on hardware OTP tokens whose seeds you can export in a supported format, which you should confirm token by token.
- Control evidence: Record who handled seed files, when they were imported and where the originals were destroyed, because auditors will ask for it.
- Ownership: Ask any implementation partner to state in the written scope which seed files are in scope and who performs the destruction step.
Check that your seed export format matches a supported import format before you assume this path saves money, since an unsupported format turns it into a reissue.
This path issues new credentials to users rather than moving old ones. Standard TOTP and HOTP users can keep apps such as Google Authenticator, while push notifications need the privacyIDEA Authenticator app. Passkeys and hardware keys supported through FIDO2 and WebAuthn, and PIV or x509 smartcards, are other options. Reissue usually adds the most user effort but removes dependence on legacy tokens.
- One-time work: Enroll each user, define which token types each group receives, and build help desk steps for lost devices and recovery.
- Recurring hardware or license implications: Passkeys and standard apps add no hardware cost for most users, while any hardware keys or smartcards you buy are a recurring line item over their lifetime.
- Users affected: Every user who must enroll, which is the largest group, so plan for support volume at the cutover.
- Parallel running: Keep SecurID working during enrollment so users who have not yet switched can still sign in.
- Push: Confirm that the privacyIDEA Authenticator app is approved for your managed devices before promising push to users.
Ask for a written enrollment plan that states the expected number of users per token type, because that count, not the software, sets most of this path's cost.
How to build your own RSA SecurID cost model
This sequence turns RSA SecurID spending and a privacyIDEA replacement into one comparable model, with each external cost sourced from a written quote and each internal cost tied to a named role.
Inventory current contracts, tokens and appliances
Finance and the IT asset owner list every RSA agreement with its term, renewal date and what it covers, including Authentication Manager licenses, support, and any cloud service subscription. Next, count the hardware and software tokens in use, note the token types, and record each appliance or server with its hardware age and operating system. The step is done when every line in the model traces to an invoice, contract or asset record, and nothing is estimated from memory.
List every RADIUS client, agent and integration
The network and application teams list each RADIUS client, such as VPNs and firewalls, along with each Windows or web server agent and any login flow that calls the SecurID service. For each item, record the owner, the protocol, and whether the change requires a configuration edit, a vendor module or new development. The step is done when the list is complete enough that the platform team can confirm which items need replacement work and which need only a repointed server address.
Choose the target token mix
Security and identity leads decide which user groups move to which authenticators, such as FIDO2 keys, push through the privacyIDEA Authenticator app, TOTP in standard apps, or smartcards for privileged staff. Each choice changes the cost, because hardware keys and cards are purchased per user while app-based options usually add little hardware spend. Confirm with privacyIDEA's documentation which token types each target group needs. The step is done when every user group has a named authenticator and an estimated count.
Size privacyIDEA servers and database with the platform team
The platform team sizes the privacyIDEA servers, the database backend and the load balancing for expected login volume, high availability targets and backup windows, using the installation guidance for the Linux package path they plan to use. Ask the team to state the virtual machines, storage and monitoring in their own units, then price each against their existing hosting contracts. The step is done when the platform team signs off on a sizing sheet that lists every server, its role and its recurring hosting cost.
Cost implementation, migration and parallel running separately
Price external work as separate lines: integrator fees for design, configuration and testing, token purchases, token issuance, and the period when SecurID and privacyIDEA run side by side. Parallel running is often the largest hidden line, because both licenses and both server sets remain active until enrollment finishes. Request a fixed-scope written quote for each line from each provider, and ask what is one-time and what recurs. The step is done when each line has a quote, an owner and a start and end condition.
Add internal staff time for operations and support
The identity, help desk and security operations managers estimate the hours their own staff spend on enrollment, token replacement requests, lost-token handling, patching, monitoring and audit evidence. Convert those hours to cost using internal rates set by finance, and separate recurring operations from one-time migration effort. Include the cost of training administrators on privacyIDEA. The step is done when every role with a time commitment appears in the model with its recurring and one-time hours.
Compare one-time and recurring totals over the finance period
Finance places all one-time and recurring lines on the same timeline, using the period its planning cycle uses, and compares the SecurID renewal path, including any appliance refresh or upgrade work, with the privacyIDEA path. Test the model against a stated sensitivity, such as a higher user count or a different support tier, so the reader sees which inputs drive the result. Keep the workbook in a spreadsheet the organization owns, with every input cell sourced to a quote or record. The step is done when the comparison is reproducible by someone outside the project team.
What privacyIDEA operations cost after go-live
Once privacyIDEA is live, the largest recurring cost is the staff time spent keeping it running, and that work is easy to underestimate when the project is scoped only as an installation. Plan for four recurring streams: patching the operating system and privacyIDEA packages, monitoring the service and its user store connections, backing up the database and configuration, and handling token lifecycle tasks such as enrollment, resyncs, lost-token replacement and retirement of unused tokens. Each stream has a named owner in the operating model, and each should appear as a line item in your run budget. The installation path matters for that workload. The project documents installation with pip and on Ubuntu and CentOS or RHEL-family systems, so the patch cadence, package sources and base images you already maintain for other Linux services will largely decide how much effort each upgrade takes. Confirm with the privacyIDEA documentation which installation method your team will standardize on, and whether your configuration management can track it. Ask the reader's own engineers how long a patch window takes today for a comparable service, because that figure, not a generic estimate, should drive the staffing decision.
The choice between internal staff and a vendor support contract is the central operations decision. privacyIDEA.org states that the Enterprise Edition is available from NetKnights, so one option is a paid support line from NetKnights alongside the open-source platform. Treat that as a separate line item to quote, not as a default. Before comparing it with the SecurID maintenance you pay today, ask NetKnights what each support tier includes: response times, severity definitions, upgrade and patch assistance, access to the Enterprise Edition features you need, help with incidents involving your user store or RADIUS clients, and whether hours are covered outside business time. Ask for the terms in writing. Also ask which costs stay with your team under either option, such as the on-call rota, testing upgrades against your RADIUS clients and the quarterly token lifecycle review that keeps the enrolled base accurate. A support contract reduces some of this work but rarely removes it, so compare the two options on the same list of tasks.
Questions buyers ask about SecurID cost and privacyIDEA effort
How much effort does a SecurID to privacyIDEA migration usually need?
The effort depends mainly on how many users and tokens you move, how many systems authenticate against RSA today, and how many of those systems need a new integration. The largest items are usually the RADIUS clients (VPNs, firewalls, remote access gateways), the Windows and web server agents that must be replaced, and the user enrollment campaign. Token types matter too: privacyIDEA's import formats do not include SecurID seed files, so existing SecurID hardware fobs generally cannot be carried over and new tokens must be issued. Ask the implementation partner to inventory every RADIUS client, agent and integration before agreeing a number, because that inventory drives most of the work.
Can our own team migrate from SecurID to privacyIDEA without outside help?
A team with Linux administration, RADIUS and LDAP experience can install privacyIDEA itself, since the project documents installation with pip and on Ubuntu and CentOS or RHEL-family systems. The harder parts are integration and cutover: repointing every RADIUS client, replacing agents, designing a dual-running period, and proving the result to auditors. Many teams split the work, keeping routine operations in house and bringing in a specialist for the integration and hardening phases. DeployOpen plans, implements and documents these systems in your environment under a fixed scope agreed in writing, so you can decide which parts to keep internal.
What skills and staff time will the migration require from our team?
Expect a small core group rather than a large project team. Typical roles are a Linux administrator for the privacyIDEA servers and database, a network engineer who owns the RADIUS and VPN configuration, a directory administrator for the LDAP or Active Directory user resolvers, and a service desk lead who runs enrollment and support. Security or compliance staff should review the design and collect evidence. Confirm with the vendor or partner how many hours each role will commit over the project, and ask who approves changes and who signs off cutover.
How long does a migration take, and what changes the timeline?
No fixed duration applies to every environment, so treat any single number with caution. The timeline grows with the number of integrations, the number of user populations and directories, the complexity of enrollment policies, and the length of the period where SecurID and privacyIDEA run side by side. Compliance evidence and change approval windows can extend it further. Ask for a schedule that lists phases, dependencies and exit criteria for each phase, and confirm which of your existing SecurID renewal dates or support end dates set the deadline.
Can we import our existing SecurID or other hardware tokens into privacyIDEA?
Not SecurID seeds. privacyIDEA imports hardware token seed files in SafeNet XML, OATH CSV, Yubikey CSV and PSKC formats, and it can import GPG-encrypted seed files. Its OATH CSV format covers HOTP, TOTP, OCRA and TAN tokens. Whether a particular hardware token can be imported depends on the seed file your vendor can export, so ask RSA and the token vendor for seed exports in a supported format before you plan around reuse. In most SecurID cases, plan to issue new tokens or authenticators to users.
What does privacyIDEA cost to license?
privacyIDEA is licensed under AGPLv3, so the software itself carries no license fee. Your costs are the servers or virtual machines, the database, staff time, token and authenticator hardware if you buy it, and any support contract you choose. Under AGPLv3 you should confirm with counsel what your obligations are if you modify the software and make it available to users over a network. Ask any partner to separate one-time costs (installation, integration, migration, token purchases) from recurring costs (infrastructure, support, upgrades, operations).
What does NetKnights Enterprise Edition support add?
privacyIDEA.org states that the privacyIDEA Enterprise Edition is available from NetKnights, and that only one company is currently involved in the project. Enterprise support is an optional commercial layer over the open-source core, so it is a line item to price separately. Ask NetKnights what its support covers, including response commitments, upgrade assistance, enterprise features and whether the Enterprise Edition changes the license terms. Compare that with what your own team or DeployOpen would provide under a retainer, and decide which obligations you want from a vendor in writing.
What should we request in a written quote for this migration?
Ask for a quote built from a written scope, not a per-seat figure. It should list the systems in scope, the RADIUS clients, agents and integrations to be replaced, the user populations and directories, the token types and quantities, the dual-running period, and the cutover and rollback plan. Request separate line items for one-time work (design, implementation, integration, migration, testing, documentation) and recurring work (support, upgrades, backups, monitoring). Also ask for the acceptance criteria, the assumptions behind each line, the change requests process and any exclusions. DeployOpen does not publish a price list, and a quote follows from that written scope.
How DeployOpen scopes a fixed-price privacyIDEA implementation
DeployOpen plans and implements self-hosted privacyIDEA inside your own infrastructure, from the cost comparison through to handover. Engagements are fixed-scope, so the components, deliverables and timelines behind RSA SecurID cost vs self-hosted privacyIDEA are agreed in writing before work starts.
How we scope
- Inventory your current SecurID licenses, token counts, appliances and RADIUS or agent integrations before any quote.
- Agree in writing which user stores, token types and VPN or logon systems the privacyIDEA scope covers.
- Confirm with you which optional NetKnights Enterprise Edition support items, if any, sit inside or outside the scope.
How we build
- Install privacyIDEA on your chosen platform, using the documented pip or Linux package routes.
- Connect existing directories through the LDAP, SQL or SCIM user ID resolvers agreed in the scope.
- Test token enrollment, RADIUS clients and PAM or logon integrations in a staging environment before cutover.
How we hand over
- Document the configuration, resolver settings, policies and enrollment steps your administrators will maintain.
- Deliver runbooks for backup, restore and upgrades, including how to verify a restore before relying on it.
- Walk your operations and helpdesk staff through enrollment, token replacement and troubleshooting procedures.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope work closes.
- Plan privacyIDEA version upgrades against the release notes and your change windows, agreed in advance.
- Prepare control evidence for your compliance assessors, while independent auditors issue any audit reports.
