After running Appgate SDP in production for just over a year to secure access to our Kubernetes admin interfaces and internal tools, I can share some concrete data. Our initial driver was replacing a legacy VPN that couldn't handle our zero-trust model for a distributed engineering team. The per-user pricing was a significant factor in our evaluation.
From an operational standpoint, Appgate delivers on its core promise. The policy engine is robust, and integrating with our existing IdP (Okta) was straightforward. The micro-tunnels and least-privilege access work as advertised, which tightened our security posture considerably. We've had no critical outages.
However, the cost-benefit analysis gets nuanced. Here’s our breakdown for a team of ~150 engineers:
* **The Good:** Operational overhead is lower than maintaining open-source alternatives. The administrative API allowed us to automate policy updates via GitOps, which was a win.
* **The Caveats:** The per-user model becomes a pressure point. You pay for every human identity, including contractors and occasional users. For us, this meant budgeting for peak headcount, not average.
* **Hidden "Cost":** While not monetary, the learning curve for fine-grained policy design is real. A poorly structured policy tree can lead to performance hiccups.
A snippet of how we automate condition updates using their API, which helped justify the tooling cost:
```bash
# Example: Update a condition's resolve script via API (simplified)
CONDITION_ID=$(curl -s -H "Authorization: Bearer $TOKEN"
"$AGG/api/conditions" | jq -r '.[] | select(.name=="k8s-cluster-match").id')
curl -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json"
-d '{"resolveScript": "return claim.team == "platform";"}'
"$AGG/api/conditions/$CONDITION_ID"
```
So, is it worth it? It depends heavily on two factors: your team's size volatility and your willingness to operationalize the policy model. For a stable, security-mature team where the alternative is building and maintaining custom tooling, the pricing can be justified. For a rapidly scaling startup or a team with highly fluctuating contractor numbers, the per-user cost might be a significant hurdle. The real value for us was in the reduced blast radius and the enforceable segmentation, which offset the licensing fee.