What should I check in a Ping Identity access management evaluation?

Decide the deployment model first: Ping sells multi-tenant PingOne SaaS, a dedicated-tenant cloud and self-managed software, and its pricing page says tiers depend on identity count, identity type and that choice. Then map which products you need (PingFederate or PingAM for federation, PingID or PingOne MFA, DaVinci orchestration, PingOne Privilege) because the post-ForgeRock portfolio overlaps. Test a real migration flow in DaVinci and check that your PingFederate and policy-agent patch process covers CVE-2025-20059 and CVE-2025-21085.

How does Ping Identity handle identity lifecycle management?

Lifecycle is not Ping's strongest area, which is why we score it 3.5 of 5. Ping covers provisioning, directory synchronization and DaVinci-driven registration and migration flows, but buyers who need HR-driven joiner, mover and leaver automation plus access certification at scale often pair Ping with a dedicated IGA platform such as SailPoint or Saviynt. In an evaluation, ask Ping to demonstrate a full leaver flow, including deprovisioning downstream SaaS accounts, in the deployment model you plan to buy.

Did Ping Identity acquire Keyless?

Yes. Ping announced a definitive agreement to acquire Keyless, a London-based privacy-preserving biometrics company, on 30 October 2025, subject to closing conditions and regulatory approvals. A Ping release dated 7 January 2026 said the acquisition was complete and that Keyless zero-knowledge biometrics, with re-verification in under 300 milliseconds, were available to customers. Ping did not publish the exact closing date or the price.

Who owns Ping Identity?

Ping Identity is private and owned by Thoma Bravo, which completed its all-cash acquisition on 18 October 2022 at 28.50 dollars per share, about 2.8 billion dollars, and delisted the stock from the NYSE. Thoma Bravo bought ForgeRock in August 2023 and combined it into Ping. Ping has since added Procyon (just-in-time privileged access, launched as PingOne Privilege in 2025) and Keyless (biometrics, completed by January 2026).

How much does Ping Identity cost?

Ping Identity is quote-based. Its pricing page, checked on 5 November 2026, publishes no list prices and asks buyers to contact sales. It says tiers depend on the number and type of identities (workforce or customer), the deployment model (multi-tenant cloud, dedicated-tenant cloud or self-managed software) and add-ons such as MFA, Protect and Verify. Budget separately for professional services on complex federation or ForgeRock migration work.

IAM Platform

Ping Identity

Name: Ping Identity review
Item: Ping Identity
Rating: 4.4
Author: SWI Community Team

Founded 2002Denver, CO, USAPrivate (Thoma Bravo)Score 4.4/5Evaluated 2026-11-05Website ↗

Capability scores

Methodology →

Authentication: 4.5
SSO & Federation: 5.0
Authorization: 4.0
Lifecycle & Provisioning: 3.5
MFA & Passwordless: 4.0
Governance & Audit: 3.5
Developer Experience: 3.5
Deployment Flexibility: 5.0
Pricing Transparency: 2.5
Support & Ecosystem: 4.0

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

Ping Identity is a private, Thoma Bravo-owned enterprise identity vendor and, in 2026, the main alternative to Okta and Entra when a deployment or protocol requirement rules them out. Thoma Bravo completed its take-private on 18 October 2022 for about 2.8 billion dollars, then combined ForgeRock into Ping in August 2023 (see the ForgeRock profile).

Two smaller deals widened the platform. Procyon became PingOne Privilege, a just-in-time privileged access service, in 2025. On 30 October 2025 Ping signed a definitive agreement to acquire Keyless, a London biometric authentication company, and its 7 January 2026 release confirmed the acquisition complete, with zero-knowledge biometric re-verification in under 300 milliseconds. No closing date or price was published.

What it is good at

Federation is the moat: Ping handles SAML, OIDC, OAuth, and older protocols at a depth banks, insurers, and governments depend on, including complex brokering across many identity sources. Its pricing page offers three deployment models, multi-tenant cloud, dedicated-tenant cloud and self-managed software, which is decisive in regulated and air-gapped environments. PingOne DaVinci adds drag-and-drop identity orchestration with what Ping calls hundreds of out-of-the-box integrations, A/B testing of flows, and just-in-time migration of legacy users as they log in. The platform spans workforce and customer identity.

Where it falls short

Breadth comes with weight. The post-ForgeRock portfolio has overlapping products (PingFederate and PingAM, PingID and PingOne MFA) that take expertise to navigate; expect a real implementation effort and dedicated identity engineers. Lifecycle and governance trail specialist IGA platforms. Self-managed software also means you own patching: CVE-2025-20059, a critical path-traversal flaw in the PingAM Java Policy Agent, and CVE-2025-21085 in PingFederate both needed customer-side upgrades. Developer experience and time-to-first-login trail the cloud-native crowd.

Pricing

Quote-based; no list prices published (checked 2026-11-05, Ping pricing). Tiers depend on identity count and type, deployment model, and add-ons such as MFA, Protect and Verify. No free tier is offered. Budget for professional services on complex federation and migration work.

Best for, and who should look elsewhere

Choose Ping for regulated, federation-heavy enterprises that need self-managed or hybrid deployment and protocol depth. Greenfield cloud-first teams will ship faster on Okta, Auth0, or Entra; Microsoft shops should price Entra first. Compare Okta vs Ping Identity, Microsoft Entra vs Ping Identity and Ping Identity vs OneLogin.

Bottom line

The enterprise federation specialist, strongest where deployment flexibility and protocol depth matter more than speed of setup.

Integrations: see what Ping Identity (PingOne and PingFederate) documents for clouds, HR systems, SaaS apps and legacy directories in the Identity Integration Matrix.

Ping Identity: frequently asked questions

What should I check in a Ping Identity access management evaluation?: Decide the deployment model first: Ping sells multi-tenant PingOne SaaS, a dedicated-tenant cloud and self-managed software, and its pricing page says tiers depend on identity count, identity type and that choice. Then map which products you need (PingFederate or PingAM for federation, PingID or PingOne MFA, DaVinci orchestration, PingOne Privilege) because the post-ForgeRock portfolio overlaps. Test a real migration flow in DaVinci and check that your PingFederate and policy-agent patch process covers CVE-2025-20059 and CVE-2025-21085.
How does Ping Identity handle identity lifecycle management?: Lifecycle is not Ping's strongest area, which is why we score it 3.5 of 5. Ping covers provisioning, directory synchronization and DaVinci-driven registration and migration flows, but buyers who need HR-driven joiner, mover and leaver automation plus access certification at scale often pair Ping with a dedicated IGA platform such as SailPoint or Saviynt. In an evaluation, ask Ping to demonstrate a full leaver flow, including deprovisioning downstream SaaS accounts, in the deployment model you plan to buy.
Did Ping Identity acquire Keyless?: Yes. Ping announced a definitive agreement to acquire Keyless, a London-based privacy-preserving biometrics company, on 30 October 2025, subject to closing conditions and regulatory approvals. A Ping release dated 7 January 2026 said the acquisition was complete and that Keyless zero-knowledge biometrics, with re-verification in under 300 milliseconds, were available to customers. Ping did not publish the exact closing date or the price.
Who owns Ping Identity?: Ping Identity is private and owned by Thoma Bravo, which completed its all-cash acquisition on 18 October 2022 at 28.50 dollars per share, about 2.8 billion dollars, and delisted the stock from the NYSE. Thoma Bravo bought ForgeRock in August 2023 and combined it into Ping. Ping has since added Procyon (just-in-time privileged access, launched as PingOne Privilege in 2025) and Keyless (biometrics, completed by January 2026).
How much does Ping Identity cost?: Ping Identity is quote-based. Its pricing page, checked on 5 November 2026, publishes no list prices and asks buyers to contact sales. It says tiers depend on the number and type of identities (workforce or customer), the deployment model (multi-tenant cloud, dedicated-tenant cloud or self-managed software) and add-ons such as MFA, Protect and Verify. Budget separately for professional services on complex federation or ForgeRock migration work.

Ping Identity comparisons

More IAM Platform vendors

All IAM Platform →

Last reviewed November 5, 2026By SWI Community TeamSuggest a correction How we research

By SWI Community Team · Last evaluated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.