What privileged access management costs when you build, partner or buy SaaS
The software license is often the smallest line in a privileged access budget. The total depends on edition thresholds, recording storage, gateway hosting, rollout effort for each system and ongoing administration. A security or platform lead who must put administrator, vendor and engineer access behind a gateway should expect the license to be a fraction of the first-year spend once the rest is counted. Three paths are open. You can build in-house on Teleport, JumpServer or Apache Guacamole, using your own staff for deployment and upkeep. You can hire an implementation partner to plan, configure, integrate and document the platform while your team keeps ownership. Or you can buy a commercial PAM product delivered as SaaS or on premises. Each path moves cost between licenses, labor and recurring administration in a different way.
Open-source options carry no per-seat software fee at the community level, but the community tiers have limits you must check before you commit. Teleport's Community Edition builds are available only to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, according to its license, so a larger firm will need a paid edition. JumpServer's Community edition is free for self-hosted standalone deployments up to 5,000 assets, but high availability and features such as Oracle and SQL Server access, password rotation and approval workflows sit in Enterprise tiers priced by quote. Commercial PAM vendors and Teleport's Enterprise tier price by active users and protected resources, and neither publishes a price list for the commercial editions. Ask every vendor and partner for a written scope that names users, assets, protocols, high availability and support level, then compare quotes against that same scope.
Each path also carries costs that do not appear on a license quote. Session recordings grow with the number of hosted sessions and the retention period your regulator or internal policy requires, so ask where recordings are stored, how long they are kept and who pays for the storage. The gateway needs its own servers, backups and patching, and high-availability designs double that footprint. Rollout effort depends on how many systems, protocols and identity sources you connect, and that work repeats for each new system. Ongoing administration covers access reviews, credential rotation and upgrades. Ask any partner to itemize these components in the quote, state which items recur each year, and confirm what the support contract includes.
Which cost components sit with you, the partner or the vendor
This table compares who carries each PAM cost component when you run open source in-house, buy implementation from a partner, or subscribe to a commercial SaaS PAM product. Read each cell as who pays and whether the cost is one-time or recurring, then check the quote against the same rows. The main takeaway is that open source removes most license fees but moves recurring administration and recording storage onto your own budget.
| Cost component | In-house | Implementation partner | Commercial SaaS |
|---|---|---|---|
| Software license or subscription | Open source core has no license fee for the chosen edition; you pay only if you buy an enterprise tier. Recurring if you subscribe to enterprise support. | Partner bills for scoping and build, not the software; the license still follows the edition you choose. One-time for the engagement. | Vendor bills a recurring subscription, typically per active user or protected resource. Confirm the metric in writing. |
| Edition selection | Your team checks license terms, such as Teleport Community limits on employees and revenue, before you deploy. One-time effort, repeated at each major upgrade. | Partner documents the edition decision and the features it gates, such as approvals or Oracle and SQL Server access. One-time, billed in the scope. | Included in the subscription tier. Recurring, and tier changes are often priced by quote. |
| Gateway and compute hosting | You pay your cloud or data center for gateway servers, sized to sessions and assets. Recurring. JumpServer's quickstart asks for at least 4 CPU cores and 8 GB of RAM for a single node. | Partner sizes and deploys the hosts in your environment, billed as one-time setup. Your hosting bill stays recurring and with you. | Vendor hosts the control plane in most cases. You may still pay for in-network connectors or relays, so confirm where traffic terminates. |
| Session recording storage and retention | You buy and run storage, backup and retention. Recurring and grows with session volume and retention period. | Partner designs retention, encryption and storage tiers, billed once. Storage capacity remains a recurring cost you pay. | Vendor may charge for recording retention or storage. Ask how long recordings are kept, where they are stored and how export works. |
| Identity integration (SSO, MFA, directory) | Your staff build and test SSO and MFA connections. One-time build, with recurring upkeep when the identity provider changes. | Partner integrates with your identity provider and directory, billed as one-time work. Ongoing changes need a support retainer. | Some SSO options sit in paid tiers. Confirm which identity providers and MFA methods are included at your tier. |
| Protocol and system onboarding | Your engineers onboard each SSH, RDP, Kubernetes, database or web target. Effort scales with the number of systems. | Partner onboards systems in batches under a fixed scope. One-time per system group, with change requests after go-live. | Vendor agent or connector setup is often included, but your team still maps roles and targets. Confirm the protocol list. |
| Credential vaulting and rotation | You run the vault, rotation jobs and their failure handling. Recurring operations work. | Partner configures vaulting and rotation once. Rotation tooling in enterprise editions may carry separate license cost. | Usually a recurring feature of the subscription, but confirm whether rotation for Oracle, SQL Server or custom targets is included. |
| High availability | You pay for a second node, load balancing and database replication. Recurring hosting and admin time. JumpServer's Standard and Pro tiers mention active-standby HA. | Partner designs and tests failover once. Ongoing failover testing is a recurring retainer decision. | Vendor operates availability. Confirm the uptime commitment and any SLA in the contract, since none is set here. |
| Upgrades, patching and ongoing administration | Your team tracks releases, tests and applies upgrades, and handles access reviews. Recurring staff time, usually the largest long-term cost. | Partner can take upgrades and support under a retainer. Recurring and priced by the agreed scope. | Vendor applies platform upgrades. You still own role design, access reviews and recording review, which stay recurring with you. |
What moves the PAM cost up or down
Open-source PAM is free to download, so the cost sits in edition thresholds, the number of assets and protocols, recording storage, high availability and the approval workflows your auditors expect. Each driver below changes whether you build, partner or buy a commercial product, and each one should appear in the written scope and in any quote you request.
Number of assets and protected resources
Asset count decides which tier you can run without paying. JumpServer's pricing page lists a free self-hosted Community edition up to 5,000 assets in a standalone topology, and Teleport charges Enterprise customers for active users and protected resources. Count servers, network devices, database instances, Kubernetes clusters and web apps separately, and include the systems vendors reach through the bastion. Growth in that count, not today's count, should drive the edition decision.
Protocols and target systems
Each protocol adds configuration, testing and sometimes a paid component. SSH and Kubernetes are usually covered in the open-source core, while JumpServer lists Oracle and SQL Server access, plus Linux and database protocol proxies, among its Enterprise features. Teleport's Community edition covers SSH, Kubernetes and several databases, but Windows, Oracle and SQL Server need checking against your edition. Map every protocol to a named owner and a test plan before you estimate the rollout.
Edition thresholds and organization size
The Teleport Community edition license limits distributed builds to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue. Larger organizations need a commercial agreement, so this threshold can turn a no-cost deployment into a license purchase. Check employee count and revenue against the license text before design work starts, and ask any vendor or partner to confirm the edition in writing.
Session recording volume and retention
Recording cost depends on how many sessions you capture, how long you keep them and where they are stored. Storage is your infrastructure cost and recurs every month, and retention periods are often set by the regulator or framework you follow, so the longest requirement sets the size. Ask the vendor or partner to estimate storage per session type, specify the search and playback needs, and confirm where recordings sit. Session playback is included in both Teleport editions, but moderated sessions are Enterprise only.
High availability and gateway infrastructure
A single bastion is cheaper to run but becomes a single point of failure for every administrative session. JumpServer's Enterprise tiers add active-standby high availability at Standard and Pro, and a full HA cluster at Ultimate, so resilience can move you up a paid tier. Price the second node, load balancer, database backend, backup and failover testing as part of the design. Compare the cost of an outage on critical systems with the cost of a standby gateway.
Approval workflow and identity complexity
Just-in-time approvals, password rotation, custom roles, multi-tenancy and SSO are the features that most often move a project from free to paid. Teleport Community limits single sign-on to GitHub and requires roles to be requested through the CLI, while Enterprise adds Okta, Microsoft Entra ID, access requests and reviews. Define how many approvers, which identity provider and how many roles you need before you compare quotes, because each one can change the edition you buy.
How each operating model changes your spend
With an in-house build, your organization pays for the software licenses only if it chooses a paid edition, and pays staff for everything else. Community editions of JumpServer and Apache Guacamole carry no license fee, and Guacamole is released under the Apache License, Version 2.0. Your own engineers do the installation, identity integration, gateway hardening, session recording storage and the rollout system by system. Those labor costs are one-time at the start but recur as staff maintain the platform, apply upgrades and handle access requests.
- Software: Community editions carry no license fee, but the Teleport Community Edition is limited to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, so check eligibility before you build around it.
- Installation and integration: Internal staff connect the platform to your identity provider, MFA, and SIEM, and they own the work of testing each protocol and resource type.
- Recurring work: Upgrades, certificate rotation, backup of recordings, and access reviews continue every year and must be staffed.
- Storage and infrastructure: Session recordings grow with use, and gateway servers need their own patching and monitoring.
- Hidden cost risk: Features that sit in paid editions, such as SLA-backed support on JumpServer or the identity governance, moderated sessions and dual authorization in Teleport Enterprise, may be needed later and force a re-architecture.
Before committing, ask your team to list every feature your audit requirements need and check each one against the edition matrix.
With an implementation partner, your organization keeps the software license decision in its own hands and pays the partner for scoped work. The partner plans, installs, integrates, hardens, documents and supports the platform inside your own infrastructure. Most engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before work starts. Software cost can stay at zero on community editions or move to an Enterprise subscription, and the partner's fee sits on top.
- Software: You choose and license the edition, and you own the contract with the vendor if you buy an Enterprise tier.
- Installation and integration: The partner's fixed-scope fee typically covers installation, SSO and MFA integration, recording storage design, and rollout by system group. The written scope defines what is included.
- Recurring work: Ongoing support, upgrades and continuous testing can be bought as a retainer, which is a separate recurring fee.
- Knowledge transfer: Documentation and runbooks are deliverables you should require, so that your staff can run the platform after handover.
- Hidden cost risk: Change requests, extra protocols added mid-project, and systems that were not inventoried at the start are the usual sources of overrun. Ask how changes are priced.
Ask for the written scope to list each protocol, system group, and integration, and confirm whether recording storage and vendor access workflows are included.
With a commercial PAM product, the vendor sets the licensing model and usually runs or supports the platform. Teleport's pricing page states that customers pay for active users and protected resources, and that it does not publish prices. JumpServer's Enterprise tiers are priced by quote, with the Basic tier covering 50 assets, Standard 500, Pro 5,000 and Ultimate unlimited. Your spend therefore follows the number of users and assets, and it recurs for as long as you hold the subscription.
- Software: Subscription fees recur and scale with active users, protected resources, or asset counts, as stated by the vendor's pricing terms.
- Installation and integration: The vendor or a reseller may offer deployment services, but the terms, scope and ownership of integration work must be confirmed in the quote.
- Recurring work: Support is included in the subscription at a level that depends on the tier, so ask for the SLA in writing.
- Data location: Session recordings and logs may be stored in your environment or the vendor's, which affects storage cost and evidence handling.
- Hidden cost risk: Renewal uplifts, asset growth, and fees for features in higher tiers, such as Oracle or SQL Server access or password rotation on JumpServer Enterprise, can raise the total over time.
Ask for a quote that shows the unit of charge, the tier thresholds, the renewal terms and the cost of each feature your requirements need.
Where the open source edition stops and the paid edition starts
The first cost question is not price but eligibility. Teleport's Community Edition build is distributed under a modified Apache 2.0 license that is available only to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, with an exception for designated critical security patch versions. A company above either threshold needs a paid license regardless of how little software it runs, so the Community Edition license terms decide whether a commercial organization can use it at all. Read the current terms in the Teleport Community Edition license and confirm with Teleport in writing before you budget for the open source build.
Even within eligibility, the feature gap is material. On Teleport Community, single sign-on is limited to GitHub, roles can only be requested through the CLI, and moderated sessions, dual authorization, Device Trust, HSM support and FIPS binaries are Enterprise features. Identity Governance, which covers just-in-time access requests, access lists, access reviews, locks and SCIM provisioning, is also paid. For JumpServer, the Community edition is free up to 5,000 assets in a standalone topology, but Oracle and SQL Server access, password rotation, ticket and just-in-time approval workflows, custom roles, multi-tenancy, SSO, RADIUS and LDAP high availability sit in Enterprise tiers priced by quote. Map each requirement from your checklist to an edition before you compare vendor quotes.
Treat these lines as a checklist for the quote, not a settled fact. Ask the vendor to confirm, in writing and against the version you will deploy, which features are included in each edition, whether the license terms apply to your entity type and headcount, and how support and upgrades differ between tiers. Ask whether a paid license changes the asset or user count basis, since Teleport bills on active users and protected resources. Those answers determine whether the open source route stays inexpensive at your scale or whether the license cost becomes the largest line in the budget.
How to build your own PAM cost estimate
This sequence turns a vague PAM budget into a scoped, comparable estimate. It produces one written scope that you can price across build, partner and commercial or SaaS paths on equal terms.
Inventory systems and protocols in scope
List every server, database, Kubernetes cluster, network device and application that administrators, vendors or engineers reach with elevated rights, and note the protocol each one uses, such as SSH, RDP, Kubernetes API, PostgreSQL or a web console. Owners from infrastructure, database administration and the business application team should sign off the list. The step is done when every protocol has a named owner and a yes or no on whether sessions must be recorded.
Count assets and protected resources per vendor metric
Translate the inventory into the unit each candidate platform charges or limits on, such as assets, protected resources or active users. Vendors define these units differently, so confirm the definition in writing before counting. JumpServer's Community tier, for example, is described in terms of assets, and Teleport's pricing page describes active users and protected resources. The step is done when you have one count per unit and a note on how it will grow over the next planning cycle.
Determine the edition each requirement needs
Mark each requirement that depends on a paid feature, such as moderated sessions, dual authorization, just-in-time request workflows, Oracle or SQL Server access, password rotation, SSO with your identity provider, high availability or support with an SLA. Check the current feature matrix or pricing comparison for each candidate, because edition boundaries change between releases. Also check the Teleport Community Edition license terms against your organization size. The step is done when every requirement is tagged with the lowest edition that meets it.
Size recording storage from session volume and retention
Estimate how many privileged sessions run each month on each protocol, how long each session lasts on average, and how long your policy, contract or regulator requires recordings to be kept. Measure these values from current bastion or jump host logs, change tickets or help desk records rather than assuming them. Multiply through to a storage figure, then add headroom for indexing, backups and a second copy if your evidence rules require one. The step is done when you have a storage estimate with its inputs written down and a named owner for the retention rule.
Plan gateway hosts and HA pairs
Decide how many gateway servers, proxy nodes and database instances the design needs, and whether each one must run as an active-standby pair or a larger cluster. Gateway sizing depends on concurrent sessions and the protocols in use, so take concurrency peaks from the session data in the previous step. Ask each candidate for its minimum hardware or cluster requirements in writing, and cost the cloud or data center capacity, load balancers and backup for each path. The step is done when you have a host list with its role, location and HA design.
Estimate onboarding effort per system type
Group the inventory by system type, such as Linux servers, Windows hosts, databases, Kubernetes clusters and vendor-facing applications, and estimate onboarding work for each group. Include credential handling, network routing, test sessions, runbook updates and user training. Ask partners for their effort model per system type rather than a single lump sum, so that adding systems later can be priced. The step is done when each system group has an effort estimate, a stated assumption list and a note on which work your own staff must perform.
Add identity integration and approval workflow design
Cost the connection to your workforce identity provider, multi-factor authentication policy, group and role mapping, and the approval workflow for production and vendor access, including break-glass procedures. These items often decide the edition and add design work that is easy to underestimate. Confirm with the identity team which directory, SSO protocol and MFA method the gateway must use. The step is done when identity and approval work appears as its own line item with the decisions that drive it documented.
Add ongoing administration hours and upgrade cycles, then request written quotes
Estimate recurring work for patching, upgrades, access reviews, recording review, certificate or key rotation, and support contract renewals. Separate one-time costs (build, onboarding, design) from recurring costs (licenses, subscriptions, hosting, staff time, support). Then send the same written scope to each path: an in-house build, an implementation partner and the commercial or SaaS vendor, asking each to quote every line item and the unit definitions used. DeployOpen prices follow from a written scope, so the same document works for any path. The step is done when every quote covers identical scope and you can compare line by line.
Session recording storage and gateway infrastructure costs
Session recording storage and gateway capacity are the two infrastructure costs that scale with use, and both should be sized from agreed requirements before any platform is chosen. Recording storage grows with the number of privileged sessions, the length of those sessions and the retention period that your sector or framework sets. A bank examiner, a healthcare auditor and a utility compliance team may each expect different look-back periods, so retention and search requirements must be written down first. Ask the platform vendor or implementation partner to state how recordings are compressed, where they are stored, how they are indexed for search, and how the volume estimate changes if you add Kubernetes or database sessions, which can generate different amounts of data than interactive SSH or RDP.
Gateway infrastructure is usually the smaller cost, but it still needs planning. JumpServer's quickstart asks for a clean 64-bit Linux server with at least 4 CPU cores and 8 GB of RAM as a minimum starting point, installed through its quick_start.sh script from the JumpServer GitHub releases. That is a starting point for a lab or small standalone deployment, not a production sizing. Apache Guacamole has a different shape: the Java web application handles the web interface and authentication, while the guacd daemon loads protocol plugins and carries the remote sessions. Each component may need its own capacity planning, and the database behind Guacamole adds another moving part. Teleport is delivered as a single Go binary, so its footprint depends more on the number of protected resources and users than on the binary itself.
Before you commit to a figure, confirm three things in writing: high availability design, backup and restore of both configuration and recordings, and storage sizing at your projected session volume. Ask whether high availability requires a paid edition or a separate cluster, how recordings are replicated between sites, and how long a restore takes in your environment. Your implementation partner should price these items as separate line items in the scope, because recording storage and backup often recur every year while the initial server build is one-time work.
Questions buyers ask about PAM cost and effort
Is open source privileged access management free to run?
The software license is often free, but running it is not. Open source PAM costs come from the infrastructure that hosts the gateway and session recordings, the people who install, configure and patch it, the identity provider integration, and the staff who review access and recordings every day. Community editions have their own limits. Teleport's Community Edition builds are available only to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, with an exception for designated critical security patch versions, so a larger organization needs to confirm its license position before it commits. JumpServer's free Community edition covers up to 5,000 assets in a standalone topology, while its Enterprise tiers add features such as ticket and just-in-time approval workflows, password rotation and high availability, priced by quote. Confirm which of your required features sit in the paid edition before you compare costs.
How long does a PAM rollout take, and what drives the timeline?
The timeline depends on the number of systems, the protocols they use and how much of the access model you change at the same time. Most of the effort is per system: each server, database, Kubernetes cluster or Windows host needs a connection, a role mapping, a test and a cutover from the old access path. Protocol mix matters, since SSH, RDP, Kubernetes and databases each have different setup steps. Other drivers include the identity provider integration, the number of approval workflows, how many shared accounts must be retired, and the change windows your operations team allows. Ask any partner for a fixed-scope plan that lists systems, phases and dependencies in writing, and treat a timeline without that breakdown as an incomplete estimate.
Can our team deploy and run open source PAM without outside help?
A capable platform team can deploy a single-node gateway, but the work that usually takes longer is operational: integrating SSO and MFA, designing roles, moving every privileged path behind the gateway, testing session recording and retention, and documenting evidence for an assessment. Teleport is distributed as a single Go binary and can run as a Linux daemon or a Kubernetes Helm deployment, and JumpServer installs on a clean 64-bit Linux server with at least 4 CPU cores and 8 GB of RAM using its quick_start.sh script. Those facts describe the starting point, not the finished control. Assess whether your team has time to own upgrades and a high availability design alongside its current work, and whether it can maintain the access rules after the project ends.
What does our side need to provide for a PAM project?
The project depends on access and decisions from your own staff. Expect to provide access to your identity provider so the gateway can federate logins and enforce MFA, named owners for each server, database and cluster who approve which roles may reach it, and change windows for cutovers that may briefly interrupt admin paths. Security and compliance staff must agree on recording scope, retention and who may review sessions. Network teams need to confirm the gateway's reachability to target systems and any DMZ or vendor paths. A written scope should list these inputs, their owners and the date each is needed, so delays are visible early.
Which PAM costs are one-time and which recur every year?
One-time costs usually include discovery of privileged paths, design of roles and approvals, integration with identity and SIEM, the per-system onboarding work, and initial testing and documentation. Recurring costs include gateway and recording storage that grows with session volume, hosting and backup, patching and version upgrades, licenses or subscriptions where an edition requires them, and the continuing administration of accounts, roles and reviews. Teleport states that its pricing depends on active users and protected resources, so growth in either drives the recurring line. JumpServer Enterprise tiers are sized by assets and priced by quote. Ask a vendor or partner to split its proposal into these two groups so you can budget for both years.
What should we ask a partner to include in a PAM quote?
Ask for a written scope that names the platform, edition, protocols and the exact list of systems to onboard. Request the deliverables, including configuration, runbooks, role design, recording and retention setup, and test results. The quote should state the assumptions it depends on, such as the identity provider version and the number of target systems, and the change process for scope additions. Ask how upgrades, patching and support are handled after handover, and whether ongoing support is a separate retainer. Confirm which licenses the partner expects you to buy and who pays them. Finally, ask what your own staff must provide and what happens if those inputs arrive late.
Does building PAM in-house cost less than a commercial product?
It depends on which costs you count. An in-house build avoids a commercial license fee where the open source edition meets your needs, but it moves the cost to staff time, testing, upgrades, and evidence production. A commercial product can reduce some of that work with vendor support and built-in features, but it introduces license fees that scale with users or resources. Compare the three options on the same list: edition features you need, recording storage, gateway hosting, rollout effort per system, ongoing administration and support. Include the cost of an outside partner for the project phase if you need one. A comparison that leaves out ongoing administration usually understates the true cost of any option.
What to confirm with vendors and partners before you commit
Before you commit to any option, get written answers on the points the public facts do not settle. The first is licensing eligibility: the Teleport Community Edition license is limited to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, so ask Teleport in writing whether your organization qualifies, and whether the critical security patch exception covers the versions you would run. For JumpServer, confirm which features your deployment needs (Oracle or SQL Server access, password rotation, ticket or just-in-time approval, SSO, LDAP HA) sit in Enterprise, and ask for current pricing for each tier against your asset count, since no prices are published. For Apache Guacamole, confirm which extensions you need, because the Apache License covers the software but not any commercial support you buy from a third party.
Next, pin down what the quote includes. Ask whether session recording storage, search, indexing and retention are priced separately, and who holds the recordings after an engagement ends. Ask who applies upgrades and security patches, on what cadence, and who tests them against your systems before they reach production. Ask what support terms apply, including response expectations, named contacts and what happens when a release is no longer maintained. Then compare quotes on identical scope: the same number of protected servers, databases, Kubernetes clusters and active users, the same high availability design, the same identity provider integration and the same recording retention period. A quote that omits one of these lines is not comparable with the others, and the gap usually surfaces as a change order later.
How DeployOpen scopes and delivers a fixed-scope PAM implementation
DeployOpen helps organizations compare build, partner and SaaS options for privileged access by turning the decision into a written scope with named systems, editions and recurring costs. Each engagement is fixed-scope, so the quote follows from the agreed deliverables for your environment.
How we scope
- Inventory the protocols, servers, databases and Kubernetes clusters that need privileged access and count them as assets or users.
- Map which features your edition choice depends on, such as just-in-time requests, dual authorization and SSO.
- Agree in writing the recording retention, storage location and gateway topology before any build work starts.
How we build
- Deploy the chosen open-source gateway inside your own cloud accounts, data centers or air-gapped network.
- Connect the identity provider, MFA and recording storage, and test each protocol path against your systems.
- Document the sizing assumptions, licence terms and per-system onboarding steps so cost drivers stay visible.
How we hand over
- Deliver runbooks for onboarding systems, approving access, reviewing recordings and rotating credentials.
- Provide a cost model listing one-time work, recurring infrastructure and edition fees for your scope.
- Walk your administrators through the handover and confirm which recurring tasks stay with your team.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover.
- Plan version upgrades and edition changes against the scope so cost changes are visible before they happen.
- Confirm with your vendor or partner which support tier and response terms apply to your chosen edition.
