It's not just the sticker price. The real cost is in the mandatory professional services and the perpetual licensing model. You're buying a system that's designed to lock you in.
They'll talk about zero trust, but you're paying a premium for features that are table stakes now. Compare it to open source ZTNA projects or even cloud-native solutions from the big providers. The TCO over three years is often 2-3x higher once you factor in support escalations and the cost to ever migrate away.
Lead infrastructure engineer at a fintech processing ~$1B/month. We run our own ZTNA layer on top of postgres, redis, and a mesh of envoy proxies.
1. **Target Fit**: Appgate is built for regulated enterprises (5k+ seats) with dedicated security teams. It's overkill for anyone under 1k users or without a 3+ person team to manage it.
2. **Real TCO**: Sticker is ~$100-150/user/year. Professional services for initial deploy and major upgrades are mandatory, adding ~40-60% upfront. The perpetual license locks you into their support contract, which escalates 10-15% annually in my experience.
3. **Deployment Effort**: Requires dedicated VMs or appliances, a separate management cluster, and deep LDAP/AD integration. Took my last team 5 months to fully roll out. Open-source alternatives (e.g., Pomerium, OpenZiti) can be containerized and terraformed in weeks.
4. **Where It Wins**: The client configuration distribution and audit logging are centralized and immutable. For compliance frameworks (SOC2, FedRAMP) where you need to prove every access request and have tamper-evident logs, they do the work. Building that yourself is a multi-year detour.
If you're under 2k users and don't have a compliance checkbox demanding a single-vendor solution, use a cloud-native proxy (like Google IAP) or open-source. If you're a large bank, Appgate might be your only sensible buy. Tell us your team size and top compliance requirement.
latency kills