IAM costs $3 to $17 a user a month. The breach still starts at the password

01What IAM costs: $3 to $17 a seat, and the $7 you may already own

Six vendors publish or are reported at a list price; one does not. Okta’s Workforce Identity page lists a Starter suite at $6 a user a month with single sign-on, MFA and Universal Directory, a Core Essentials suite at $14, and an Essentials suite at $17 that adds Adaptive MFA, Lifecycle Management and Access Governance, all billed annually under a $1,500 annual contract minimum; the Professional and Enterprise suites are quote-only.¹ Microsoft lists Entra ID P1 at $7.00 and P2 at $10.00 a user a month, paid yearly, and states that Microsoft 365 E3 and Business Premium include P1 and E5 includes P2.² JumpCloud lists its SSO package, which bundles the directory, SSO, MFA, a password manager and lifecycle, at $11 on annual billing, and sells every component à la carte at $3.³ Cisco Duo lists Essentials at $3, Advantage at $6 and Premier at $9, with FIDO2 passwordless in every paid tier.⁴ OneLogin’s own pricing page could not be read when we checked; a March 2026 third-party comparison reports Basic at $3, Essentials at $6 and Business at $10.⁵ Ping Identity publishes no per-user price and routes every workforce buyer to sales.⁶

Two things about this chart are not visible in it. First, the cheapest bar and the most complete bar are not comparable products: Duo at $3 is MFA and SSO in front of what you already have, with no directory lifecycle; Okta at $17 replaces the directory, provisions accounts and runs access reviews. Second, the highlighted bar is often free at the margin. A company on Microsoft 365 Business Premium already pays for Entra ID P1, which carries conditional access, the policy that can demand a phishing-resistant factor at every login that matters. The question for that company is not whether to buy an identity platform but whether anyone has switched on the one it owns.

02Where breaches start: a credential, 39% of the time

Verizon’s 2026 Data Breach Investigations Report, covering incidents between 1 November 2024 and 31 October 2025, made headlines because vulnerability exploitation overtook stolen credentials as the most common first step into a victim, at 31% of breaches, for the first time in the report’s nineteen years.⁷ Read the next paragraph of the report and the headline weakens. Credential abuse as the first step fell from 22% to 13%, but the report added pretexting as a tracked initial vector this year and pretexting usually ends in a credential; measured the way last year’s report measured it, credential abuse would have been 16%. Counted anywhere in the attack chain rather than only at the door, credentials appear in 39% of breaches.⁷

Microsoft’s report, published on 16 October 2025, is written from the other side of the login prompt. It records that identity-based attacks rose 32% in the first half of 2025, that more than 97% of them are password attacks, and that multi-factor authentication can block more than 99% of identity-based attacks, with phishing-resistant MFA stopping the attacker even when the username and password are correct.⁸ Verizon adds the uncomfortable detail: 37% of organisations had an administrator account on an infrastructure-as-a-service platform with MFA disabled, 73% of ransomware victims had an infostealer infection or credential leak in the preceding year, and only 23% of third-party organisations fully fixed missing or badly configured MFA on their cloud accounts.⁷

03The mechanism: provider, policy, factor, session

Every product in the category does some part of four jobs, and the tier you buy decides which. The identity provider holds the accounts and signs people into applications. A policy engine decides, per login, what the context demands: this device, this country, this risk score. A factor proves the person is present, and factors divide cleanly into those an attacker can relay in real time (passwords, one-time codes, push approvals) and those bound to the site and the device (FIDO2 keys and passkeys), which cannot be phished by a fake login page. Then a session begins, and its token lives for hours or days unless something revokes it, which is why session review, access review and logs belong in the same box.

Map the price list onto the mechanism and the pattern is consistent across vendors. Step one is in every tier because it is what the customer asks for in the demo. Step four is where the margin is, because access certifications and governance are what large enterprises are audited on. Step three, the factor, is either included and un-enforced, or an add-on. Okta’s own pricing page describes Adaptive MFA’s purpose as phishing-resistant authentication, and lists it as an add-on at Starter and included from Core Essentials.¹ JumpCloud includes passkeys in its $3 MFA product but sells the device-aware policy that would make them mandatory as a separate $3 line.³ Nobody is hiding anything; the structure simply rewards buying the connectors and the reviews, and leaves the factor as a configuration decision the buyer has to make on purpose.

04What companies buy against where breaches happen

Put the two lists side by side. The left column is what an identity invoice itemises and what a vendor’s sales deck leads with. The right column is what the 2026 DBIR and Microsoft’s 2025 report say actually went wrong. The overlap is one line, and it is the line most invoices treat as a feature rather than a purchase.

This is also where the vendor list from the original piece needs correcting. CyberArk, which it described as the privileged-access specialist to shortlist, is no longer an independent company: Palo Alto Networks completed its roughly $25 billion acquisition in February 2026 and relaunched the portfolio as the Idira Identity Security Platform on 12 May 2026, so quotes and support portals now say Idira.¹⁵ SailPoint remains the governance specialist, and governance is step four. Neither changes the argument. A privileged-access product controls and records what an administrator does once in; it does not replace the factor that decides whether the attacker is the administrator.

What we would do with a fixed budget, in order. Find out what you own: a Microsoft 365 E3 or Business Premium tenant already includes Entra ID P1, and its conditional access is where a factor is made mandatory.² Make the factor mandatory for every administrator this quarter, on whatever platform you have, using FIDO2 keys or passkeys rather than push. Then, and only then, price the suite question, because by then it is a question about connectors, lifecycle and reviews, which is the question the price list was built to answer.