Neither vendor publishes a price list, so "better value" depends on your own privileged-account count, deployment model and contract term, not a headline figure. Independent buyer-contract benchmarking puts enterprise BeyondTrust deals (1,000+ users, several modules) at $250,000 to $500,000 or more a year, a band CyberArk has not published. CyberArk's PAM product is also now owned by Palo Alto Networks, following an acquisition that completed on 11 February 2026. Get itemised three-year quotes from both before you decide.
Key pointers
- CyberArk is no longer independent. Its acquisition completed on 11 February 2026 and its PAM product now sits under the new owner's "Idira" brand (see Fast Facts for the live domain check), so check who you are actually contracting with before you sign a three-year term.
- BeyondTrust remains a standalone specialist, which makes the real question "platform consolidation risk from Idira" versus "sole-focus PAM depth from BeyondTrust", not just a line-item price comparison.
- Build your own privileged-account count first. Both vendors license per account or per endpoint, and neither will give you a meaningful quote without it.
- Budget self-hosted maintenance at 17 to 22% of licence cost a year for either platform, on top of whatever the licence itself costs.
- Ask for implementation as a separate line. Independent buyer-contract benchmarking suggests 20 to 40% of first-year licence cost for CyberArk; BeyondTrust's professional services typically run $10,000 to $100,000-plus depending on scope.
- A real UK government contract shows the scale involved: the Department for Work and Pensions' CyberArk PAM licences carry a contract value of up to £6.03 million across a 1+1+1 (up to three-year) term.
- Both vendors typically discount 15 to 30% for three-year commitments versus annual contracts, so ask for the annual and multi-year price separately and compare the effective rate.
- Confirm currency and VAT treatment before comparing any two quotes: US benchmarking figures are in dollars, and UK enterprise software contracts are usually quoted net of the 20% VAT.
What Standardising Privileged Access Means for a UK Enterprise
Privileged access management vaults the passwords, keys and session rights that let an administrator, a service account or a piece of automation reach a critical system, then rotates and audits them so a compromised login cannot be reused. For an identity and access security lead at a UK enterprise, "standardising" usually means replacing scattered local admin accounts, shared spreadsheets of passwords and ad hoc SSH keys with one vault, one approval workflow and one audit trail across on-premises, cloud and DevOps systems.
The decision is not just which software to buy. It is who signs the three-year contract, who runs the vault day to day, how many privileged accounts actually exist across the estate (usually more than IT expects once service accounts and application credentials are counted), and what happens if the chosen vendor is acquired, re-platformed or re-priced mid-contract, which is exactly what has just happened to CyberArk.
How CyberArk's PAM and BeyondTrust's Password Safe Are Structured
Both products work on the same basic model: a hardened vault stores privileged credentials, a broker mediates and records every session that uses them, and policy controls who can check out which credential and for how long. CyberArk's PAM capability, now sold under the Idira platform, describes this as vaulting, "zero standing privileges" (ephemeral access created only when a task starts and destroyed when it ends) and session isolation, extended to infrastructure and cloud access (brokered, just-in-time access to AWS, Azure, GCP and Kubernetes), workforce endpoints (removing standing local admin rights) and third-party or vendor access.
BeyondTrust's Password Safe combines privileged account and session management to discover, manage and audit privileged account and credential activity, with automated discovery and onboarding, credential and password rotation, session recording and an extensible API for integration with ticketing and SIEM tools. Where CyberArk's roadmap is now being folded into a wider identity-security platform spanning human, machine and AI-agent identities under Idira, BeyondTrust sells Password Safe as one module in its own family (alongside Privilege Management for endpoints and Privileged Remote Access), without a parent platform pulling it in a different direction.
Pricing and Cost Model
Neither vendor publishes a price list. Both are sold on request, scaled by the number of privileged accounts, endpoints or users you register, the deployment model, and which modules you add on top of the core vault.
Assumptions. Figures below in US dollars come from Vendr's anonymised buyer-contract dataset, not from either vendor's own price book, and are not a substitute for a quote against your own account count. Figures in pounds come from awarded UK government contracts recorded on Contracts Finder. All prices are treated as excluding UK VAT (20%) unless the source states otherwise, since neither dataset states a VAT treatment.
| Cost component | CyberArk PAM (Idira) | BeyondTrust Password Safe |
|---|---|---|
| Licence basis | Per privileged account, self-hosted (perpetual plus maintenance) or Privilege Cloud SaaS subscription | Per managed account or privileged user, cloud subscription or on-premises perpetual plus maintenance |
| Published price list | None, quote-only | None, quote-only |
| Overall median contract, all buyer sizes (USD) | $32,018 a year | $17,795 a year |
| Small deployment band, 50-200 users (USD) | Not segmented in published data | $30,000 to $80,000 a year |
| Mid-market band, 200-1,000 users (USD) | Not segmented in published data | $80,000 to $250,000 a year |
| Enterprise band, 1,000+ users (USD) | Not segmented in published data | $250,000 to $500,000-plus a year |
| Self-hosted/on-premises annual maintenance | 17 to 22% of licence cost, rising 3 to 5% a year | 17 to 22% of licence cost, rising 3 to 5% a year |
| Implementation and professional services | 20 to 40% of first-year licence cost | $10,000 to $100,000-plus, scope-dependent |
| Self-hosted/on-premises infrastructure | 15 to 25% of first-year total cost | 15 to 30% of multi-year TCO |
| Three-year commitment discount | 15 to 30% versus annual pricing | 15 to 30% versus annual pricing |
| UK government contract evidence | DWP: £6,027,058.30 total awarded value (estimated range £1,600,142.70 to £6,027,058.30), 1+1+1 term | UKHSA: £30,065.06 for one year, Remote Support module only |
The DWP and UKHSA figures are not directly comparable: DWP's contract covers PAM licensing across a large central government department's estate over a term that can run to three years, while UKHSA's covers only the smaller Remote Support module for one year. Treat them as scale references, not a like-for-like price comparison, and ask your own reseller to itemise licence, maintenance, implementation and infrastructure separately so you can build a genuine three-year figure for your own account count.
Vendor and Option Comparison
| Criterion | CyberArk PAM (Idira) | BeyondTrust Password Safe |
|---|---|---|
| Ownership and roadmap risk | Now part of Palo Alto Networks; the deal completed 11 February 2026 and CyberArk says it "will continue to be available as a standalone platform" while integration into the wider Idira platform is underway | Independent specialist; product decisions are not tied to a wider security-platform consolidation strategy |
| Deployment options | Self-hosted (perpetual licence) or Privilege Cloud (SaaS) | On-premises (perpetual or subscription) or cloud SaaS |
| Licensing unit | Per privileged account | Per managed account or privileged user |
| UK buying channel | Available through UK value-added resellers, including the reseller named on the DWP contract below | Available through the same class of UK reseller, plus a separate listing on the UK government's G-Cloud digital marketplace |
| Cost signal available today | A real UK enterprise contract (DWP, up to £6.03 million, 1+1+1 term) for whole-estate PAM licensing | A US enterprise cost band ($250,000 to $500,000-plus a year) plus a smaller UK module-only contract (UKHSA, £30,065.06 a year) |
| Support and admin overhead | Roughly one full-time administrator per 1,000 to 2,000 privileged accounts, per independent benchmarking | No published staffing ratio; running several modules (Password Safe, Privileged Remote Access, Privilege Management) adds administrative surface as you expand |
| Who should not choose it | An organisation that wants to avoid its identity security roadmap being set by a much larger platform vendor's integration priorities | An organisation that has already standardised its wider security stack on CyberArk's new owner and wants one vendor relationship across network, cloud and identity |
Neither platform is a universal winner. CyberArk's Idira positioning suits an enterprise planning to extend privilege controls to machine and AI-agent identities as part of a broader platform estate; BeyondTrust suits one that wants PAM depth from a specialist without inheriting a parent company's wider platform bets. Ask each vendor directly how the CyberArk acquisition, or BeyondTrust's independent status, affects support continuity and pricing on your specific renewal date.
Editorial Analysis
The most material change since this decision was last worth writing about is not a price rise but an ownership change: CyberArk stopped being an independent PAM vendor on 11 February 2026. That matters for a three-year TCO comparison because the number on today's quote is only half the question; the other half is whether the roadmap, support model and pricing discipline you are buying into in year one still look the same in year three, once CyberArk's PAM has finished being folded into Idira. BeyondTrust carries less of that integration risk simply by remaining a single-product specialist, but it also cannot offer the same one-vendor consolidation story if your organisation is already standardising its wider security stack on CyberArk's new owner.
On raw cost, the independent benchmarking data available does not show BeyondTrust as reliably cheaper at enterprise scale: its own enterprise band ($250,000 to $500,000-plus a year) sits well above CyberArk's published overall median ($32,018 a year, across all buyer sizes, not enterprise-specific). The DWP contract shows CyberArk PAM licensing can run into the millions of pounds at large-estate scale. The honest answer to "which delivers better value" is that value here is decided by your own privileged-account count, module selection and negotiated multi-year discount, not by a vendor-level price difference that either company's published data can currently settle.
Sources
- Password Safe Pricing, BeyondTrust
- CyberArk (PAM), Award Notice, UK Contracts Finder (Department for Work and Pensions)
- BeyondTrust Remote Support 26-27, Award Notice, UK Contracts Finder (UK Health Security Agency)
- BeyondTrust Password Safe Cloud, UK Government Digital Marketplace
- Identity & Access Management Providers, IT Services Directory, Compare the Cloud
