PAM360 Cloud is licensed per privileged user, counted by who signs up and uses it. Pick the slab that matches your count; billing follows the cycle you choose. A 500-user license covers 500 sign-ups from your organization.
Number of users | Licensing fee (Billed monthly) | Licensing fee (Billed annually) |
|---|---|---|
| 10 | $200 | $1,800 |
| 25 | $500 | $4,500 |
| 50 | $1,000 | $9,000 |
| 100 | $1,997 | $17,970 |
| 250 | $4,543 | $40,440 |
| 500 | $7,791 | $70,416 |
| 1000 | $13,289 | $1,18,398 |
| 2000 | $22,287 | $1,96,386 |
| 2500 | $25,787 | $2,29,386 |
All prices are in USD. This is an indicative pricing. For complete pricing details and a custom quote, please contact our sales team.
Feature comparison
| Feature | On-Premises | Cloud |
|---|---|---|
| Centralized, secure repository of privileged passwords | Yes | Yes |
| Auto discovery of IT assets and privileged accounts | Yes (Windows, Linux, VMware, AWS EC2, and Network devices) | Yes (Linux, Network Devices, VMware; Windows, Linux, SQL local account discovery) |
| Web-based access | Yes | Yes |
| Storing and managing shared accounts | Yes | Yes |
| Application-to-Application (A-to-A), Application-to-Database (A-to-DB) password management | Yes | Coming Soon |
| Windows service accounts password management | Yes | Yes |
| Options for A-to-A and A-to-DB password management | RESTful APIs and Command Line (SSH-CLI) | Coming Soon |
| Privileged account management for DevOps tools (CI/CD tools integration) | Yes (Jenkins, Ansible, Chef, Puppet) | Coming Soon |
| Privileged account management for RPA platforms | Yes (Automation Anywhere) | Coming Soon |
| Password encryption | AES-256, dual encryption at application and database levels. FIPS 140-2 compliant. | AES-256 |
| Password ownership | Yes | Yes |
| Selective sharing of passwords | Yes | Yes |
| Fine-grained, role-based permission to view/edit/manage passwords | Yes | Yes |
| Grouping resources / passwords bulk operation | Yes | Yes |
| Storing files, images, digital identities | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Synchronizing passwords of remote resources | Yes | Yes |
| Deploying agents for remote password reset | Yes | Coming Soon |
| Agent-less remote password reset | Yes | Yes, supported via Application Gateway |
| Scheduled, automatic password rotation | Yes | Yes (limited expiry times in beta) |
| Verifying the integrity of passwords in target systems | Yes | Yes |
| Windows service account reset | Yes | Yes |
| Provision for triggering follow-up action after password reset | Yes | Coming Soon |
| Direct connection to remote resources via landing servers (jump servers) | Yes | Yes (via Application Gateway) |
| Native thick-client for RDP and SSH | Yes (PAM360 Remote Connect) | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Windows (local, domain, service accounts) | Yes | Yes |
| Linux, Mac, Solaris, HP Unix, IBM AIX, HP-UX | Yes | Yes |
| Databases (MS SQL, MySQL, Oracle DB, Sybase ASE) | Yes | Yes |
| Cisco devices and network devices | Yes | Yes |
| Directories (LDAP, Novell, Oracle OID, OpenLDAP) | Yes | Yes |
| Cloud environments (AWS, Azure, Google Apps, Salesforce) | Yes | Coming Soon |
| Custom password reset plugins | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Password/SSH key request-release controls | Yes | Yes |
| Dual approval controls | Yes | Yes |
| Time-limited access to passwords | Yes | Yes |
| Just-in-time (JIT) privilege elevation for Windows local accounts | Yes | Yes |
| JIT elevation for Windows domain accounts | Yes | Yes |
| Application control, allow-listing and block-listing | Yes | Coming Soon |
| Command control | Yes | Coming Soon |
| Local admin rights management | Yes | Coming Soon |
| Child and spawning subprocess management | Yes | Coming Soon |
| Self-service privilege elevation | Yes | Coming Soon |
| Privilege elevation for Linux | Yes | Coming Soon |
| Exclusive access to passwords for users | Yes | Coming Soon |
| Notifications/Alerts on check-in, check-out of passwords | Yes | Coming Soon |
| Password/SSH key auto-reset after exclusive use ends | Yes | Coming Soon |
| Task automation | Yes | Coming Soon |
| JIT access via ephemeral roles and accounts | Yes | Coming Soon |
| Privilege elevation for end-user devices | Yes | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Cloud entitlement discovery and management | Yes | Coming Soon |
| Monitoring cloud environments for excessive permissions, unused accounts, policy violations | Yes | Coming Soon |
| Least privilege access policies for cloud entities | Yes | Coming Soon |
| Shadow admin accounts management | Yes | Coming Soon |
| Real-time usage and risk monitoring | Yes | Coming Soon |
| Real-time mitigation insights | Yes | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Automated SSH/SSL discovery | Yes | Coming Soon |
| Import of keys and certificates | Yes | Coming Soon |
| SSH key pair creation and user association | Yes | Coming Soon |
| SSH keys periodic rotation | Yes | Coming Soon |
| Certificate life cycle management (acquisition, deployment, auto renewal) | Yes | Coming Soon |
| Generate self-signed certificates | Yes | Coming Soon |
| Microsoft CA certificate signing | Yes | Coming Soon |
| Root-based certificate signing | Yes | Coming Soon |
| CSR process management | Yes | Coming Soon |
| SSL certificate deployment & validity tracking | Yes | Coming Soon |
| SSL certificate sharing | Yes | Coming Soon |
| SSL vulnerability scanning | Yes | Coming Soon |
| SSL certificate expiration alerts | Yes | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| AD/LDAP authentication | Yes | Not applicable for cloud |
| RADIUS server authentication | Yes | Not applicable for cloud |
| Azure AD / Entra ID | Yes | Yes (import from Entra ID supported) |
| Native authentication by application | Yes | Yes |
| Smart card / PKI / certificate authentication | Yes | Coming Soon |
| SAML authentication | Yes (Okta, AD FS, OneLogin, Azure AD SSO) | Coming Soon |
| Two-factor authentication | Yes | Yes |
| Options for two-factor authentication | PhoneFactor, RSA SecurID, Google Authenticator, RADIUS, Email OTP, Duo, YubiKey, Microsoft Authenticator, Okta Verify | Zoho OneAuth, third-party authenticator apps, passkeys and security keys |
| Automated policy enforcement | Yes | Coming Soon |
| AI-governed risk remediation policies | Yes | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Importing users from AD/LDAP | Yes | Yes (import from AD, Entra ID) |
| User groups for bulk operations | Yes | Yes |
| Role-based access restrictions | Yes | Yes |
| Custom role creation | Yes | Yes |
| Optional super-admin with access to all managed passwords (break-glass) | Yes | Yes |
| Denying creation of super-admin accounts more than one | Yes | Yes (option removed in cloud) |
| User lock | Yes | Yes |
| Transfer user accountabilities | Yes | Yes |
| Transfer resource ownership | Yes | Yes |
| IP restriction | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Notifications on password retrieval, reset, expiry, ownership change, etc. | Yes | Yes (Email requires account verification) |
| Feature | On-Premises | Cloud |
|---|---|---|
| Pre-built password policies of varying strengths | Yes | Yes |
| Provision for creating custom policies | Yes | Yes |
| Enforcing usage of strong passwords, standard practices | Yes | Yes |
| Checking password for compliance to standards | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Logging all access to passwords — who, what, when | Yes | Yes |
| Complete record of all password, key, and certificate management operations | Yes | Yes |
| Complete record of all user activities | Yes | Yes (user login audit not available in beta) |
| Reports on password inventory, policy compliance, password expiry | Yes | Yes (canned, custom, compliance, query reports) |
| Out-of-the-box compliance reports (PCI-DSS, ISO/IEC-27001, NERC-CIP, GDPR) | Yes | Yes |
| Report scheduling | Yes | Yes |
| Sending reports by email | Yes | Yes |
| Generating reports in PDF | Yes | Yes |
| Custom reports | Yes | Yes |
| Query reports | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Scheduled backup of database | Yes | Not applicable (managed by Zoho) |
| Live backup through data replication | Yes | Not applicable (managed by Zoho) |
| Application Gateway server | Yes | Yes |
| Tools for disaster recovery | Yes | Not applicable (managed by Zoho) |
| Uninterrupted access to data (high availability) | Yes | Yes (managed by Zoho) |
| Fail-over service | Yes | Not applicable (managed by Zoho) |
| Multiple application server instances | Yes | Not applicable (managed by Zoho) |
| Feature | On-Premises | Cloud |
|---|---|---|
| Encryption key hiding | Yes | Yes |
| Session protection | SSL | SSL |
| Data transmission | HTTPS | HTTPS |
| Data storage encryption | AES-256 | AES-256 |
| Dual encryption | Yes (AES-256 at application and database levels) | Yes |
| Provision to prevent cross-site scripting | Yes | Yes |
| FIPS 140-2 compliant mode | Yes | Coming Soon |
| Monitoring failed login attempts | Yes | Yes |
| Termination of inactive user sessions | Yes | Yes |
| Feature | On-Premises | Cloud |
|---|---|---|
| Importing passwords | Yes | Yes |
| Importing passwords from KeePass | Yes | Coming Soon |
| Ticketing system integration | Yes (ServiceNow, ServiceDesk Plus, JIRA) | Yes (ServiceDesk Plus On-Demand, ServiceNow, JIRA) |
| Integration with SIEM tools | Yes (Log360, Splunk, ArcSight, Syslog) | Yes (Loggly,Datadog,Sematext,Coralogix,Microsoft Sentinel) |
| HSM integration | Yes (SafeNet, Entrust nShield) | Coming Soon |
| Secure offline access | Yes | Yes |
| Exporting passwords in various formats | Yes | Yes |
| Password generator | Yes | Yes |
| Password history | Yes | Yes |
| Separate personal password management | Yes | Not applicable for cloud. |
| Client customization | Yes | Coming Soon |
| Mobile support & native apps | Yes (Android, iOS, Windows) | Coming Soon |
| Browser extensions | Yes (Chrome, Firefox, Edge) | Coming Soon |
| Cloud storage integration | Yes (Dropbox, Box, Amazon S3) | Yes (Box, Dropbox, Amazon S3) |
| API support | Yes (RESTful APIs) | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Direct connection to target systems via HTML5 browser sessions | Yes (RDP, VNC, SSH, SQL) | Yes |
| Remote sessions from iPad & tablet devices | Yes | — |
| Options for automatic connection (RDP, VNC, SSH, SQL) | Yes | Yes, for RDP, SSH and VNC |
| Launch remote sessions without disclosing credentials | Yes | Yes |
| RemoteApp support | Yes | Yes |
| Native desktop client (thick client) | Yes (PAM360 Remote Connect) | Coming Soon |
| Command controls | Yes | Yes |
| Bidirectional file transfer | Yes | Coming Soon |
| Privileged session recording & playback | Yes | Coming Soon |
| AI-based session summarization | Yes (via OpenAI integration) | Coming Soon |
| Session events and keystroke logging | Yes | Coming Soon |
| Session shadowing / dual controls | Yes | Yes |
| Session termination upon suspicious activity | Yes | Yes |
| Privileged user behavior analytics | Yes (via Analytics Plus) | Coming Soon |
| Feature | On-Premises | Cloud |
|---|---|---|
| Multi-tenant architecture | Yes | No |
| Feature | On-Premises | Cloud |
|---|---|---|
| Supported platforms for server installation | Windows & Linux (also on AWS, Azure, Hyper V, VMware ESXi, BMC) | Not applicable (Cloud, managed by Zoho) |
| Cloud-ready | Yes (AWS, Azure, VMware ESXi, Hyper V) | Native cloud |
| Licensing model | Based on number of administrator roles. Annual Subscription & Perpetual licensing available. | Based on number of privileged users. Annual and monthly Subscription models. |
| Deployment model | Self-hosted, Public cloud image (AWS, Azure), self-hosted PAM over the WAN | Native Cloud only (delivered by Zoho's cloud infrastructure) |
From faster deployment to smooth implementation, our experts help your team get up to speed quickly.
| Number of sessions | Training only | Onboarding, implementation, and training |
|---|---|---|
| Online Basic: 4 hours | $995 | $2,495 |
| Online Standard: 8 hours | $1,495 | $3,495 |
| Online Advanced: 12 hours | $1,995 | $4,495 |
| Number of sessions | Onboarding, implementation, and training |
|---|---|
| Onsite Basic: 2 days | $4,999 |
| Onsite Standard : 3 days | $6,999 |
| Onsite Advanced: 5 days | $9,999 |
1. All onsite implementations include professional training for up to 5 participants.
2. Basic services include installation, basic setup and configuration.
3. Standard services includes installation, basic setup, product configuration, and out-of--the-box integrations.
4. Advanced services include scoping, architecture design, installation, product configuration, API and integration assistance.