Privileged Access Management: 6 licensing criteria

When looking for a Privileged Access Management (PAM) solution, most teams compare features first and price second. However, the real cost risk lies in between: in the licensing and operating model. Whether you pay for created accounts or simultaneously active users, whether sessions cost extra, and whether the solution runs in the cloud or on your own infrastructure – these factors determine your actual costs for years to come and how much control you retain.

This guide provides you with six concrete criteria for evaluating an on-prem subscription for Privileged Access Management . If you need the basics first, we explain the difference between PAM, PIM, and IAM. At the end, you will see how these criteria can be tested in practice and how to identify a predictable model.

Why the licensing model matters more than the list price

Two solutions with identical feature sets can differ significantly in total cost—solely due to the licensing structure. The reason lies in the nature of privileged access: in addition to your own administrators, external service providers, vendors, and support teams also require access, often only sporadically and rarely all at the same time. If you pay for every account created, you are primarily paying for access that remains dormant.

The following six criteria turn the gut feeling that "this seems expensive" into a verifiable decision. Reviewing them before making a selection helps you avoid typical hidden costs—and ensures you choose a model that grows with your team instead of holding it back.

1. Licensing logic: Concurrent users instead of named users

The first question is: What are you paying for—every account created (named user) or the number of users actually active at the same time (concurrent user)? The difference is significant. In a typical environment with 50 simultaneous access points, there may be hundreds of accounts: internal admins, rotating service providers, and vendor support. A named-user model charges for every one of these accounts. A concurrent-user model only charges for the peak number of simultaneously active sessions.

VISULOX is licensed based on concurrent users—you pay for the number of simultaneously active users, not the total number of accounts created. This makes costs predictable and avoids additional fees, especially when dealing with many external service providers who only access the system occasionally. During the selection process, verify which user definition the provider uses—and get it in writing.

2. Session counting: Are sessions charged separately?

Closely related to licensing logic, but often overlooked: does the provider count individual sessions? Some models charge for every parallel connection a user makes as a separate license. In practice, however, an administrator often opens multiple sessions simultaneously—to different target systems, in four-eyes mode, or with parallel documentation.

With VISULOX, the license is based on the maximum number of simultaneously logged-in users—expressly independent of the number of sessions required. A user running five parallel sessions consumes one license, not five. For teams with intensive, parallel usage, this is a noticeable cost factor. Ask specifically: "Does an additional parallel session count against our license?"

3. Operating model: On-premises keeps data in-house

A PAM system sees more of your IT than almost any other system—it knows the privileged access to your most critical servers, databases, and applications, including session recordings. Where this data resides and who can legally access it is therefore not just a technical question.

On-premises means the platform runs entirely on your own infrastructure; access and recording data never leave your premises. This is exactly what the VISULOX on-premises subscription is designed for—the subscription model changes the cost structure, not the operating location. For organizations with sovereignty and compliance requirements, this is the decisive difference compared to cloud-based offerings. Why the provider's legal jurisdiction matters just as much as the server location is explored in our Guide to Sovereign PAM Selection.

4. Cost structure: Subscription or purchase—choose wisely

On-premises subscriptions and perpetual purchases are not mutually exclusive; they suit different situations. A subscription is billed monthly and based on usage, is scalable at any time, and—depending on the maintenance contract—includes ongoing updates and support. This results in predictable, transparent costs and is well-suited for growing or fluctuating teams. A purchase is a one-time investment and pays off for stable, long-term use.

VISULOX offers both models, and both run on-premises; the only difference is the cost model. The on-premises subscription starts at around 20 US dollars per user per month. The decisive factor for your choice is your planning horizon: if you want to scale flexibly and smooth out costs, a subscription is the better choice; if you operate a fixed, long-term infrastructure, a purchase may be more cost-effective. Both options can be explored in just a few minutes using our Price and License Calculator .

5. Authentication: MFA per access and linked to your own identities

Multi-factor authentication is a must-have today, not just an optional extra – it is one of the ten minimum measures required under Section 30 of the BSIG (NIS-2). However, when evaluating it, what matters is not just whether MFA is present, but how flexibly it can be applied: Is MFA enforced for every access? Can it be tightened for critical systems? And does it link to your existing identities via SAML or OAuth instead of forcing you to manage yet another isolated user directory?

With VISULOX, MFA is an add-on module that is enforced per access and uniquely assigns every session to a natural person – eliminating anonymous shared and maintenance accounts. Integration with central identities via SAML/OAuth is built into the architecture. This allows authentication to adapt to the protection requirements of the target system rather than setting the same rigid hurdle for all access.

6. Scalability and deployment: grow without project overhead

The best licensing model is of little use if every expansion triggers a new implementation project. Therefore, check how quickly the solution is ready for use and how it scales. Agentless architectures have an advantage here: there is no need to roll out clients to target devices or endpoints, which significantly streamlines deployment and maintenance.

VISULOX is agentless, typically ready for use in under two days, and designed for enterprise operations – multi-tenant, highly available, and proven for over 1,000 concurrent users. The subscription allows you to adjust the number of users flexibly without new license agreements. Companies like Vodafone, Merck, and Thyssengas use VISULOX in production. You can see what enterprise operation looks like in the Product Overview.

‍

When choosing a PAM solution, you are not just buying features; you are investing in a cost and operational model that will support you for years to come. The six criteria—licensing logic, session counting, operating model, cost structure, authentication, and scalability/deployment—provide a framework for an objective decision. An on-premises subscription with concurrent user licensing combines predictable costs, full data sovereignty, and the flexibility to scale. Evaluate your preferred model against these six points—or run your scenario directly in our price and license calculator .