Identity is arguably the new perimeter in today's rapidly evolving security landscape. Organizations are moving away from traditional network-centric security models to adopt identity-driven frameworks. Single Sign-On (SSO) has become the de facto standard for enterprises to streamline authentication and enforce Multi-Factor Authentication (MFA).

Yet, despite its critical importance, some companies treat SSO as a premium feature, locking it behind exorbitant paywalls—a practice known as the "SSO tax." It's time to call this out for what it is: an outdated and counterproductive approach to cybersecurity.

SSO: More Than Convenience, It's Essential Security

SSO allows users to authenticate once and access multiple applications and systems without repeatedly entering credentials. Beyond the convenience, SSO delivers security benefits that are essential for today's threat landscape:

  1. Reduced Attack Surface: SSO minimizes the number of credentials users need to manage, reducing the likelihood of password fatigue and insecure practices like reuse or weak passwords.
  2. Centralized Authentication: It enables enforcement of strong authentication protocols (e.g., MFA) at a single entry point, simplifying policy enforcement and monitoring.
  3. Streamlined Revocation: If an account is compromised, revoking access at the SSO provider cascades across all linked applications, minimizing damage.

These benefits aren't luxuries—they're necessities in an era when phishing, credential stuffing, and account takeovers are among the top attack vectors.

The SSO Tax: A Greedy Barrier to Security

Despite the importance of SSO, some companies choose to monetize it as a premium feature, making it accessible only to organizations willing to pay a higher license price. This "SSO tax" is problematic for several reasons:

  • Disincentivizing Security: Vendors force organizations to choose between better security and budget constraints by putting an essential security feature behind a paywall. Smaller organizations must go for the cheaper option, increasing their inherent risk.
  • Short-Term Gains, Long-Term Risk: Vendors who charge for SSO prioritize profit over partnership, ignoring the long-term trust and loyalty from empowering customers with secure solutions.
  • Charging for the Wrong Feature: The development efforts enabling SSO are comparatively small compared to the SSO tax. This practice reminds me of how gas stations now charge for air (when looking to inflate your tires).

The SSO Tax in Action: Dropbox's Pricing Model

To understand the impact of the SSO tax, let's examine Dropbox, a widely used tool in businesses globally. Dropbox's Standard Business Plan costs $15 per user per month, while its Advanced Business Plan—which includes SSO support—jumps to $24 per user per month. That's a staggering 60% price increase to enable a feature that should be a baseline offering for enterprise security.

Dropbox might justify this jump by highlighting that the Advanced Plan includes additional features like:

  • More storage: This is perhaps the one feature that will justify a price hike. I use Dropbox to easily share files over the cloud, not as my primary storage provider.
  • Enhanced content protection: Dropbox adds security-adjacent features like ransomware detection and recovery. Without more details about the level of scanning done behind the scenes, it does seem a minor addition—leveraging VirusTotal can probably yield a deeper analysis.
  • More advanced team management and audit features: Aside from SSO, the other "security-oriented" features seem relatively minor.
  • Password-protected and branded transfers: If branding matters, it might justify the tax.

The commentary I provided above on the added feature is somewhat cynical. That said, it goes through my mind as I evaluate DropBox. It boils down to the realization that DropBox is looking for me to pay 60% more for a feature other vendors give me at no additional cost. Other CIOs may feel these extras add value, but none are as universally essential as SSO. Features like expanded storage, content protection, advanced team management features, or branding cater to specific situational needs and don't justify bundling SSO behind a paywall.

I should apologize to Dropbox. They are not the problem. I reviewed our various Software as a Service (SaaS) subscription costs and evaluated any service needing to leverage our SSO infrastructure. DropBox is just one service that drew my attention and subsequent ire. The problem extends far beyond Dropbox. They are just one example among many vendors employing similar tactics. The SSO Tax Wall of Shame documents numerous companies, including well-known names in the tech world, who are guilty of charging extra for SSO.

The SSO tax is a troubling industry behavior. Vendors withholding foundational security features unless organizations agree to pay significantly more stands in sharp contrast to the Secure-by-Design and Secure-by-Default advocated by the Cybersecurity & Infrastructure Security Agency (CISA).

This reality creates a frustrating dilemma for businesses prioritizing cybersecurity. Accept the added cost or compromise security. It's a lose-lose situation that disproportionately impacts smaller companies and startups with tighter budgets and reduces cybersecurity for all of us.

Built-In SSO: A Win-Win for Vendors and Customers

Vendors charging an SSO tax often frame it as a way to offset the added complexity of supporting external authentication systems. However, this narrative ignores a critical reality: SSO reduces operational overhead and support costs in the long run.

When a vendor builds SSO into their platform by default, they:

  1. Offload Authentication Complexity: By relying on established identity providers (e.g., Azure AD, Okta, Google Workspace), vendors avoid the need to build, maintain, and secure their authentication systems. Using tried-and-tested authentication services reduces development costs and minimizes the risk of vulnerabilities inherent to proprietary login mechanisms.
  2. Simplify Support: Authentication issues are among the most common customer support tickets. When leveraging SSO, vendors transfer the support cost for these issues back to the customer, significantly reducing their per-customer support costs.
  3. Streamline Authentication: SSO allows the company to adhere to a better security posture by using a uniform authentication policy enforcing MFA where needed. It also makes provisioning and revoking access much more straightforward.

By adopting SSO as a default standard, vendors save time, money, and resources. Customers get secure and seamless authentication. It is a win-win scenario. At SafeBreach, for example, our platform comes with built-in SSO support, and we recommend that our customers use it. The companies that charge an SSO tax choose short-term profits over long-term efficiency and loyalty.

Call to Action: Advocate for Security, Demand Built-In SSO

The stakes are too high to tolerate practices that compromise security for profit or cost savings. As leaders responsible for protecting their organizations, CIOs, and CISOs must oppose vendors that treat essential security features like SSO as a luxury.

Here's what we can all do to affect change:

  1. Make SSO Non-Negotiable: When evaluating vendors, insist on built-in SSO support as a baseline requirement. If a vendor charges extra for it, challenge their reasoning and explore alternatives. Make it clear that some of these alternatives include other vendors.
  2. Leverage Collective Influence: Collaborate with peers in your industry to amplify demands for secure, cost-effective solutions. Vendors listen when entire industry sectors speak out.
  3. Invest in Security-First Partners: Reward vendors who commit to security by integrating SSO and other essential features into their core offerings. This approach is especially relevant when these vendors commit to Security-by-Design and Security-by-Default principles.

At my company, I mandated that not only do new information systems support SSO, but that, if there is an SSO tax, budget owners include it in their budget request.

I wrote this blog not to suggest boycotting companies but to drive accountability and progress in the technology ecosystem. By choosing vendors that prioritize security, we send a message that we value security over profit games.

For those who know me, I like to illustrate a point using examples outside our day-to-day cybersecurity reality. For this - Car Airbags. Did you know that car airbags came out around 1980? They were sold as optional safety equipment for almost 18 years when in 1998, the Intermodal Surface Transportation Efficiency Act of 1991 went into effect. It mandated front-side airbags for all cars and light trucks. Would you consider buying a new car today without airbags? SSO functionality is no longer a nice-to-have feature. It is a foundational requirement of current cybersecurity practices. We should all demand that built-in SSO be the standard and ensure that security becomes a universal priority, not a premium add-on.