What It Actually Costs

PAM business cases are built on licence cost and then surprised by everything else.

The visible cost

Licensing, usually per managed account, per target system, or per administrator, and the model matters enormously at scale.

Check how service accounts are counted, because they outnumber humans and can dominate the bill under a per-account model.

Check how the count grows, since estates grow and the licence should be modelled against the projection rather than the current number.

The costs that surprise

Storage for recordings, which is the largest recurring surprise and is modelled from your own session volume rather than from a vendor estimate.

Implementation effort, which is mostly your own people's time and is the largest first-year cost in most deployments.

Dependency mapping for service accounts, which is months of work and appears in no proposal.

Onboarding each system, which is not uniform: the first of each class is slow and the rest are fast.

Infrastructure for high availability, across sites.

Operational running: someone owns this, permanently.

Administrator time lost to friction, which is real, measurable and never counted.

Modelling the storage

Your session count per day.

Average duration.

Capture mode per tier, with video far larger than text.

Retention period.

Multiply, add growth, and check the number before choosing the retention policy rather than after. The result frequently changes the design.

Reducing it

Tier the capture. Video where it is justified, text everywhere else, metadata universally.

Suppress idle time.

Shorten retention to what is justified rather than to what feels safe. Excess retention of monitoring data is itself a compliance problem in several jurisdictions.

Deploy native platform capabilities for everything they cover, and buy for the remainder.

Sequence the rollout so value arrives before the full cost does.

The value side

Do not build the case on prevented breaches, which is an unfalsifiable number that damages credibility.

Build it on what is defensible:

Audit findings closed, which is concrete where an audit driver exists.

Rotation capability, measured as recovery time in a drill. An organisation that can rotate in a day is in a materially different position from one that takes weeks, and that is a number an executive understands.

Exposure reduction, stated as standing privileged accounts and paths to tier zero, before and after.

Attribution, which is a compliance requirement in many frameworks and is simply absent with shared accounts.

The friction cost

Real, measurable, and absent from every business case.

Time added per privileged session, multiplied by sessions per day, multiplied by administrator cost.

The number is frequently large and it is the honest counterweight to the security benefit.

Report it, because a programme that pretends it is free loses credibility with the people paying it in time.

Then reduce it, treating latency as a defect.

Track it over time. A falling friction cost alongside falling exposure is a much stronger position than exposure alone.

What to commit to

Not a risk reduction percentage, which is unfalsifiable and damages credibility when questioned.

A specific change in a specific measure, with a date and the same measurement method afterwards.

"Standing tier zero accounts from forty to under ten within two quarters."

"Rotation of the tier zero population demonstrated in under four hours by the end of the year."

"Brokered proportion of privileged sessions from thirty to eighty percent, measured against target-side logs."

Checkable, which is uncomfortable and is precisely what makes it credible to the people deciding whether to fund the next phase.