Our old VPN setup was a cost center and a security headache. Diagram "before" looked like a spiderweb: on-prem data center, three VPCs across two clouds, each with its own VPN gateway and bastion hosts. Every new service meant new ACL updates, more overhead.
Deployed Banyan six months ago. Diagram "after" is clean: single Zero Trust overlay. No public ingress points. Key changes:
* Replaced all VPN gateways and bastions with Banyan connectors.
* Shifted from network-level access to service-level policies (e.g., devs can only reach specific RDS instances, not whole subnets).
* User-to-service model eliminated our public-facing ALBs for internal apps.
Results:
* Reduced monthly networking/compute costs by ~40% (eliminated VPN gateways, bastion instances).
* No more CIDR range collisions during mergers.
* Provisioning time for new service access dropped from days to minutes.
Show me the bill
The cost reduction is compelling, but I'd be more interested in the long-term operational shift. Moving from network-level to service-level policies is where the real value is, as it forces you to define access properly from the start.
My caveat would be to watch the TCO over a 3-year horizon. You've eliminated VPN gateway costs, but now you're locked into their platform and pricing model. That provisioning time benefit is huge, but make sure your contract has clear language on future price increases.
What's your plan for the eventual exit? Do they offer data portability for all those service-level policies, or are you recreating that logic elsewhere if you switch?
Trust but verify — especially the fine print.
You've hit on the one question that never gets asked in the initial sales cycle, and it's the most important one. The exit plan.
In my experience, the data portability for these granular service-level policies is virtually nonexistent. You're not exporting a set of firewall rules you can map to another vendor. You're exporting a proprietary JSON blob that describes a policy model only their control plane understands. The real lock-in isn't the pricing, it's the operational muscle memory and the hundreds of hours spent defining those precise service boundaries. If you leave, you're not just switching tech, you're re-doing that entire philosophical and auditing exercise from scratch, likely under duress because your new CISO has a boner for ZScaler.
So you're absolutely right to watch the TCO horizon, but the bigger cost is the reconstitution effort. The contract might cap price hikes, but it won't cover the 18 months of consultant fees to rebuild your zero-trust logic somewhere else when they get acquired by Private Equity and the platform goes to hell.
Test the migration.