Pricing

Three prices, published. Nothing hidden.

An Okta Workflows assessment is priced on how many workflows your console lists — a number you can check before you contact us. Larger or multi-environment estates are quoted on scope.

How we count

You pay for the workflows your console lists.
We assess the ones it doesn’t.

Your band is set by a number you can read off the Okta Workflows console before you talk to us. Nothing Assay finds can move you into a higher band — the discovery is the value, not the invoice.

Counted
  • Every workflow in the console, across every folder in the export.
  • Helper flows called by other flows. They are workflows, they appear in the console list, and they are counted.
Not counted — assessed anyway
  • Loop bodies and inline error handlers. These are logic embedded inside a card. They execute in production, they are not listed separately in the console, and you are not charged for them.
  • Tables and connections. Read for context; not workflows, not counted.

On our 125-package reference corpus the consoles list 560 workflows. Assay assesses 867 — 307 pieces of embedded logic the console does not show as separate entries. Every assessment prints Declared and Discovered side by side, so the basis of your invoice is on the deliverable and checkable against your own console.

Re-runs are re-banded

A re-assessment is priced on the console count at the time it runs. If the estate has grown past a band boundary the new band applies; if it has shrunk, so does the price. Retiring dead workflows can lower what you pay next time — the improvement register lists the candidates.

Partial exports

We price what you send. If you export one folder, you are banded on that folder. The report states which packages it read.

Disputes

The export is the record. If our count and yours differ, the declared figure on the report is the one to check — it is the console’s own number, not ours.

Reading
Free
One per estate · no commitment
  • Complete flow inventory
  • Every flow as readable code
  • Call graph of the estate
  • Robustness score
  • Core control set, with reasoning
  • Delivered as a document
  • Core control set. The signed report runs the full library.
Request a reading
Most engagements
Baseline signed report
$2,500 +
≤25 flows $2,500 · 26–100 $4,500 · 101–300 $7,500 · above by quote
  • Everything in Reading, plus the full control library
  • Dated, hashed signed report
  • End-to-end operation traces
  • Prioritised improvement register
  • Methodology stated in full
  • Delivered within five working days
Book a baseline
Continuous
Scoped annually
Quarterly re-signed report · sized to your estate
  • Everything in Baseline
  • Drift diff against last signed report
  • Score tracked over time
  • Evidence chain for auditors
  • Priority turnaround
Plan regular re-runs
Multi-platform
Scoped to your estate
Two or more supported identity platforms
  • One method across platforms
  • Cross-platform executive summary
  • Platform-specific controls and evidence
  • Quarterly re-runs
  • API / structured evidence options
Scope an enterprise estate

MSPs and delivery partners. Partner plans are scoped to tenant count, platform mix, white-label requirements, API access and support needs. One method applied consistently across the tenants you manage. Ask about partner plans.

What is included, and what is not

Included in every engagement

  • Analysis of every folder export you supply, at no per-file charge within your band
  • The full signed report document, in HTML and PDF
  • A structured JSON export of all findings, for your own systems
  • One walkthrough call to go through the findings
  • Re-issue at no charge if we make an error

Not included, deliberately

  • Remediation. Assay reports and does not fix. Scoring an estate and then selling the fix for it would compromise the independence the signed report rests on. We refer to implementation partners and re-attest afterwards.
  • Tenant access. We do not connect to your Okta tenant, and we will decline if asked.
  • Certification. An signed report states configuration facts as of a date. It is not a security certification and does not assess runtime behaviour.

Practical terms

  • Published baseline prices are in US dollars and exclude any taxes that apply in your jurisdiction.
  • Continuous, partner, multi-platform and enterprise engagements are scoped to the estate and agreed before work begins. Baselines are invoiced on delivery; recurring engagements annually in advance.
  • The first five baseline engagements are offered at no charge selectively, in exchange for a findings conversation and permission to publish anonymised aggregate statistics. No logo, no named reference.

Not sure which path fits your estate?

Run the free Okta reading first. It shows the estate size and gives you a concrete starting point. Standardised baseline work is priced publicly; larger estates are scoped to your environment.

Request a reading Ask a question