Only 27% of identity vendors publish a price, and identity governance scores 5 out of 100

Only 79 of the 295 identity vendors on sale in Start with Identity's directory (27%) publish a price for any paid tier, and 158 (54%) are quote-only, according to the Identity Pricing Transparency Index 2026. The index classifies the Pricing section of every vendor profile in a snapshot taken on October 30, 2026, and checks 64 of those vendors against their live pricing pages the same day. On a 0 to 100 Pricing Transparency Score, the identity market scores 38. Identity governance scores 5.

The score runs from 93 to 0

The Pricing Transparency Score gives each vendor 100 points if it publishes a paid price or is simply free, 50 if you can start free but must ask for the paid price, and 0 if it is quote-only or sold only inside a bundle. The category score is the average. Password managers score 93 and secrets management 78. At the other end, identity governance scores 5 and CIEM scores 0: not one of the nine CIEM vendors in the directory shows a price.

For practitioners, the score is a planning number. In a high-scoring category you can shortlist on published figures. In a low-scoring one, budgeting starts with a sales call, and the evaluation has to be designed so that quotes from different vendors can be compared at all.

Governance, privilege and detection almost never show a number

Across IGA, PAM, ITDR and CIEM combined, 55 of 69 vendors (80%) are quote-only. Only four of the 69 publish a paid price: Keeper, ManageEngine PAM360, Nudge Security and Push Security. In IGA, SailPoint, Saviynt and Veza all sent us to sales when we checked.

These are also the categories where implementation services add the most to first-year cost, so the missing list price is only part of the unknown. The IGA and PAM rankings and the SailPoint vs Saviynt comparison cover what separates these vendors besides price.

Who you sell to matters more than what you sell

The strongest predictor in the index is the vendor's target market, not its category. Across all 295 vendors on sale, 55% of vendors that sell to startups or SMBs publish prices, against 9% of enterprise-only vendors.

The gap holds inside a single group of categories. In IAM, IGA, PAM, ITDR, CIEM and zero trust, vendors that also serve SMBs publish 57% of the time and enterprise-only vendors 6% of the time. SMB-facing tools in PAM and zero trust, such as Keeper and Tailscale, behave like CIAM vendors. Enterprise-only CIAM vendors such as Transmit Security behave like IGA vendors. The practical use: if an enterprise vendor also sells to SMBs, ask for that price list. It gives you a floor for the negotiation.

CIAM free tiers range from 5,000 to 1,000,000 users

The index read the free tiers of developer-focused CIAM platforms live on October 30, 2026. They range from 5,000 MAU on SuperTokens' managed cloud to 1,000,000 MAU on WorkOS AuthKit, with a median of 17,750 MAU across 16 MAU-based free tiers. SuperTokens and WorkOS set the two ends; Clerk and Auth0 sit between them.

The headline number is the least useful part of the comparison. The report shows vendors counting "active" users in different ways (retained users, daily actives, tokens, or users plus AI agents), and B2B costs often coming from per-connection SSO and SCIM fees rather than users. Read the definition before comparing two free tiers. The best CIAM for startups ranking and the Auth0 vs Clerk comparison go further.

One in five pricing descriptions had drifted

When we re-checked 64 vendor pricing pages, 12 SWI profiles (19%) needed a pricing correction. The changes ran both ways: three vendors our profiles listed as unpublished now show prices, including Aembit and Strivacity, while six offered less than their profiles said. All twelve profiles were corrected. If roughly one in five pricing descriptions moves within a few months, any pricing claim older than a quarter, ours included, needs a re-check before it goes into a budget.

How we did it

A script pulled the Pricing section from all 297 vendor profiles and classified each into one pricing model: keyword rules made 93 confident calls, which we spot-read, and 140 more were classified by hand from the profile text, with each override and its reason recorded in the script. For the 64 vendors whose live pricing pages we read on October 30, the live page decided the classification (five more checks failed and are marked as unverified), and two products no longer sold (one retired, one now an AI assistant) were excluded from every rate, leaving 295. Limits: rows outside the live sample reflect each profile's last review date, "published" means at least one real paid price rather than the price you will pay at scale, the directory is not a census of every identity vendor, and category sizes differ widely.

For the step-by-step method for getting a comparable quote from a quote-only vendor, see the full report and the RFP builder.

Use the data: download the index as CSV or JSON. It is free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.

Update, November 5, 2026: A re-run of the index after a profile review moved four vendors. Sonrai Security and Uptycs now publish prices, Britive shows prices only on AWS Marketplace, and Perimeter 81, now Check Point SASE, no longer publishes them. 80 of 295 vendors (27%) now publish a paid price and 157 (53%) are quote-only. CIEM scores 28, not 0, so the line above that no CIEM vendor shows a price no longer holds, and zero trust drops from 31 to 23. Across IGA, PAM, ITDR and CIEM, 53 of 69 vendors (77%) are quote-only and six publish a paid price. SMB-facing vendors publish 54% of the time against 10% for enterprise-only vendors; inside the enterprise-security categories the split is 50% against 8%. The overall score is still 38. Adding a profile for Opal Security, a quote-only identity governance vendor, later that day took the count to 80 of 296 vendors publishing (27%) and 158 (53%) quote-only, and IGA, PAM, ITDR and CIEM to 54 of 70 quote-only (still 77%); the other figures in this update are unchanged at the precision shown. A second same-day review of 30 high-demand profiles reclassified HashiCorp Vault (IBM now publishes managed-service rates) and NordPass (a permanent free plan alongside published paid plans), so 81 of 296 vendors (27%) now publish a paid price, machine identity scores 50 instead of 40, and enterprise-only vendors publish 11% of the time; quote-only stays at 158 (53%) and the overall score at 38. A third correction pass that day excluded Passage by 1Password, retired on January 16, 2026, as no longer sold, and reclassified Stack Auth, now Hexclave, as publishing its plan prices. That makes 82 of 295 vendors on sale (28%) publishing a paid price and 158 (54%) quote-only; open-source IAM now scores 83 instead of 80, SMB-facing vendors publish 56% of the time, and the overall score is still 38. Current figures are in the report, which keeps its finding numbers stable.