CyberArk Conjur Pricing in 2026: Open Source vs Enterprise Costs Explained

Conjur Open Source (Conjur OSS) is a fully functional secrets management server available under the Apache 2.0 license. It is the foundation that both the community and CyberArk's enterprise product are built on, which means it is not a stripped-down free tier. It is the actual engine.

Conjur OSS supports RBAC-based access policies, machine identity authentication for workloads and pipelines, a REST API for programmatic secret retrieval, native Kubernetes Authenticator support for pod-level secrets access, and integration with CI/CD tools including Jenkins, GitHub Actions, and GitLab. Secrets are stored encrypted at rest and access is governed by policy files written in a declarative YAML format.

What Conjur OSS does not include is vendor support. There are no SLAs, no CyberArk support tickets, and no professional services included. Deployment, configuration, scaling, and ongoing maintenance are entirely the responsibility of your team. For organizations with strong DevOps and security engineering capability, that tradeoff is acceptable. For enterprises with compliance requirements around vendor support contracts, it typically is not.

Conjur OSS also does not include the credential rotation, threat analytics, session recording, and privileged access workflow features that come with the CyberArk PAM suite. It is a secrets vault, not a full PAM solution.

Conjur Cloud is the enterprise edition of Conjur, delivered as a SaaS offering within the CyberArk Identity Security Platform. CyberArk does not publish list prices for Conjur Cloud. Pricing is negotiated through the CyberArk sales team and varies based on workload count, deployment scope, and whether Conjur is being purchased as a standalone product or bundled with CyberArk Privilege Cloud or other CyberArk PAM components.

Based on typical enterprise deal structures reported by practitioners and analysts, Conjur Cloud pricing runs approximately $15 to $40 per workload per month in 2026. A workload is a unique authenticating entity: a VM, container, serverless function, or CI/CD pipeline node that retrieves secrets via the Conjur API.

At the low end of that range, an organization with 500 workloads would pay roughly $7,500 to $20,000 per month ($90,000 to $240,000 annually). At the high end, with professional services, multi-region deployment, and premium support included, costs for large enterprises can exceed $500,000 annually.

Organizations that already license CyberArk Privilege Cloud typically receive Conjur Cloud at a bundled discount. If you are an existing CyberArk PAM customer, the incremental cost of adding Conjur is substantially lower than purchasing Conjur as a standalone product. This bundling is one of the strongest economic arguments for Conjur over alternatives for organizations already in the CyberArk ecosystem.

Three variables determine what you will actually pay for Conjur Cloud.

Authenticating workload count is the primary cost driver. Every unique workload that authenticates to Conjur to retrieve secrets counts toward your license. In containerized environments, workload counts grow quickly: a Kubernetes cluster running 50 microservices across 10 namespaces can easily generate hundreds of authenticating identities depending on how granularly you scope your Conjur policies.

Deployment model affects cost and operational responsibility. Conjur Cloud is CyberArk-managed SaaS. Self-managed Conjur Enterprise (the on-premises enterprise edition) carries different licensing terms and requires infrastructure you own and operate. Organizations in regulated industries with data residency requirements often have no choice but to run self-managed, which adds infrastructure costs outside the Conjur license itself.

CyberArk PAM bundle status is the biggest pricing lever available to buyers. If your organization already uses CyberArk Privilege Cloud for privileged access management, adding Conjur to that contract almost always produces a meaningful discount compared to purchasing Conjur standalone. Negotiate Conjur as part of a broader CyberArk renewal rather than as a new standalone purchase if you have any existing CyberArk investment to leverage.

HashiCorp Vault is the most direct competitor to Conjur for enterprise secrets management. The pricing model is structurally different, which affects total cost depending on your deployment scale.

Vault Community Edition is free and open source, comparable to Conjur OSS in scope: self-hosted, no vendor support, full secrets engine and policy capability.

Vault Enterprise is licensed at approximately $0.24 to $0.35 per cluster per hour, which translates to roughly $2,100 to $3,060 per cluster per month. For an organization running three Vault clusters (primary plus two replicas in a high-availability configuration), that is $6,300 to $9,180 per month or $75,600 to $110,160 per year.

Conjur's per-workload pricing model means Conjur tends to cost more than Vault at equivalent feature levels for organizations with large workload counts and modest cluster footprints. HashiCorp's cluster-based pricing is more predictable at scale because adding workloads does not directly add license cost once you have provisioned sufficient cluster capacity.

Vault also has a broader secrets engine ecosystem out of the box: native database credential rotation, PKI certificate management, AWS/Azure/GCP dynamic credentials, and SSH certificate signing are all included. Conjur OSS covers the core secrets vault use case well but requires additional CyberArk platform components to match Vault's built-in rotation and dynamic secret generation capabilities.

Akeyless is a cloud-native secrets management SaaS built on a gateway model: the Akeyless SaaS handles key management and policy enforcement, while self-hosted gateways serve secrets to workloads without sending secret values to Akeyless cloud infrastructure.

Akeyless publishes tiered pricing. The SMB plan starts at approximately $1,000 per month for smaller teams, covering core secrets management, dynamic secrets, and API gateway access. Enterprise pricing is negotiated based on gateway count and secret consumption volume.

For teams with fewer than 200 workloads that do not already have CyberArk infrastructure, Akeyless is typically cheaper than Conjur Cloud. Akeyless also has a faster deployment path because the SaaS control plane eliminates the need to provision and manage your own Conjur server infrastructure.

Conjur's advantage over Akeyless is depth of CyberArk integration. Organizations using CyberArk Privilege Cloud, CyberArk Endpoint Privilege Manager, or CyberArk Identity get native policy synchronization and audit correlation between PAM and secrets management layers that Akeyless cannot replicate.

Conjur is the right choice in three specific scenarios.

First, if your organization already uses CyberArk PAM products, specifically CyberArk Privilege Cloud or the legacy PAS suite, adding Conjur extends your existing investment rather than introducing a new vendor relationship. The bundled pricing, unified audit trail, and native integration between Conjur and CyberArk PAM policies create operational efficiency that justifies the cost premium over alternatives.

Second, for large enterprises with complex machine identity requirements across hybrid and multi-cloud environments, Conjur OSS provides a stable, well-documented open source foundation that engineering teams can deploy and operate without vendor dependency. The CyberArk community and documentation are mature compared to some newer alternatives.

Third, if your compliance framework requires a SOC 2 Type II-audited enterprise vendor for secrets management with contractual SLA guarantees, Conjur Cloud provides that. Conjur OSS does not.

Conjur Cloud is expensive relative to alternatives for organizations that do not already have CyberArk in their environment. Acquiring Conjur without existing CyberArk PAM licenses means paying full per-workload pricing with no bundle offset and taking on a new enterprise vendor relationship.

If your team is smaller than 50 engineers, your workload count is under 200, or you do not already use CyberArk products, HashiCorp Vault Enterprise or Akeyless will typically deliver equivalent secrets management capability at lower total cost. Vault Enterprise's cluster-based pricing is more predictable at scale, and Akeyless's SaaS model eliminates infrastructure management overhead.

Conjur OSS remains a strong choice for cost-sensitive organizations with engineering capacity to self-host, regardless of CyberArk footprint. It is a production-grade secrets vault, not a toy, and organizations running it successfully at scale do exist. The tradeoff is accepting that all operational responsibility sits with your team.