Disclosure: I work on Tessera, which is one of the tools in the gap I am describing.
Ask a fifty-person engineering organisation how they control production access and you will hear the same answer with small variations: a bastion host, SSH keys distributed by configuration management, a shared kubeconfig somewhere, and a spreadsheet or a Notion page that is out of date.
Nobody chose that. It is what remains after the alternatives were priced.
How the category got shaped
Privileged access management grew up serving banks, telcos and governments in the 2000s. Those buyers had specific characteristics: thousands of administrators, regulators with written opinions, dedicated security teams, and procurement processes measured in quarters.
Products shaped themselves accordingly. Six-figure entry prices. Deployments measured in months with professional services attached. Feature sets covering every mainframe and network appliance in a bank's estate. Sales motions that start with a discovery call and a mutual NDA.
That was a reasonable fit for those buyers. It is a terrible fit for a company with sixty engineers, no dedicated security team, one person who is security-adjacent, and a procurement process that consists of a founder approving a card payment.
So the mid-market did what people do when a category prices them out: they built the minimum themselves. A bastion is a bastion because it was free and it was Tuesday.
The problem this leaves
The bastion answer works, up to a point, and it is worth being specific about where the point is.
A bastion controls the door. It does not control the room. Once someone is through, there is no per-command record, no way to reduce their privileges while they are working, and no session replay. And keys still have to be distributed and revoked behind it, which means the original problem is intact — it just has a nicer front entrance.
Three things then converge, usually in the same year:
The first enterprise customer. Their security questionnaire asks about privileged access controls, session monitoring and access reviews. You answer honestly and the deal stalls, or you answer optimistically and create a problem for later.
The first audit. SOC 2 or ISO 27001, usually because of the customer above. The auditor asks who could access production on a date in the past. Your bastion cannot answer.
The first contractor at scale. One contractor is manageable. A team of eight from an agency, on a six-month engagement, with three of them rotating off midway, is not manageable with keys and a spreadsheet.
By the time all three arrive, the organisation needs the capability urgently and still cannot buy the enterprise product, because the price and the deployment timeline have not changed.
What changed
Three things, over about five years.
Self-hosting became normal again. Not as an anti-cloud position, but because a single binary plus PostgreSQL genuinely is easy to run, and because customer questionnaires started asking about sub-processors in a way that makes a hosted control plane an expensive answer.
Deployment stopped requiring professional services. Docker Compose, a Helm chart, an apt package. The reason PAM took months to deploy was mostly that it needed agents everywhere and integrations with everything. A proxy that requires no changes to your targets does not have that problem.
Per-seat pricing arrived. This is the one that actually opens the market, and it is worth looking at closely.
The pricing variable
Traditional PAM prices per protected resource — per server, per host, per node. For a bank with a stable estate that is a predictable bill. For a company running autoscaling groups and splitting services, it is a bill that grows every time engineering does its job.
The consequence is not just cost. It is behaviour. Tooling that gets expensive as infrastructure grows is tooling that quietly gets exceptions carved out of it — this cluster is not worth licensing, that legacy box stays outside, this shared account is easier. A control with exceptions is worse than no control, because it also produces a false sense of coverage.
Per-seat pricing tracks the number of people who can reach production, which is the number that actually reflects risk, and which you already forecast because it is headcount. At $15–40 per seat per month, a sixty-engineer organisation is looking at low four figures a year. That is a card payment, not a procurement cycle.
The practical shape of the decision
If you are between fifty and five hundred engineers, the honest position is:
- You need session-level control and audit evidence, and you will need them on a deadline set by a customer or an auditor rather than by you.
- Building it is a quarter of engineering time to reach parity on SSH alone, and internal tools funded by attention rather than budget reliably stall at 80%.
- The enterprise products are not sized for you and never were.
- The self-hostable, per-seat tools are: Teleport, Boundary, and Tessera, which I work on. All three have free tiers you can run this week without talking to anyone.
The specific recommendation matters less than the timing one. Do this before the audit, not during it. Evidence has to cover the audit period, and a system deployed in month eleven gives you one month of evidence and eleven months of explanation.
Tessera is a self-hosted access broker for SSH, Kubernetes, databases and RDP. Per seat, free for a single administrator, nothing installed on your targets. https://tessera.company/pricing/
Top comments (0)