Having recently concluded a six-month evaluation of Zero Trust Network Access (ZTNA) and Secure Web Gateway (SWG) solutions for our 750-employee organization, our shortlist has been narrowed to two final contenders, with Cloudflare One being one of them. The marketing materials and high-level architecture are compelling, but I place greater weight on operational realities and long-term financial commitments than feature checklists.
I am seeking detailed, granular feedback from peers in the mid-market space (roughly 500-2000 employees) who have moved beyond the proof-of-concept stage. My primary areas of inquiry concern the practicalities that are often glossed over in sales discussions:
* **Total Cost of Ownership (TCO) Breakdown:** Beyond the per-user/month subscription, what were the significant ancillary costs?
* Internal labor hours required for ongoing policy management and troubleshooting.
* Impact on endpoint performance and any associated helpdesk ticket increases.
* Costs related to integrating Cloudflare One with existing identity providers (beyond standard SAML), SIEM, and on-premise infrastructure.
* **Contract and Commercial Flexibility:**
* How negotiable are the term commitments and price escalators? Are multi-year discounts substantial, or do they primarily serve to increase lock-in?
* Experience with true-ups/downs and licensing flexibility for seasonal or contract workers.
* Clarity and fairness of the Service Level Agreement (SLA). Have credits been necessary, and were they provisioned without dispute?
* **Technical and Operational Pitfalls:**
* Specific challenges encountered during the migration from legacy VPN or other ZTNA platforms. What was the actual timeline versus the projected one?
* Performance degradation for latency-sensitive internal applications, particularly those not hosted near Cloudflare's edges.
* The effectiveness and administrative overhead of the Data Loss Prevention (DLP) and Cloud Access Security Broker (CASB) modules in a production environment.
Our evaluation must account for a five-year horizon. Therefore, I am particularly wary of solutions that appear cost-effective initially but introduce hidden technical debt or punitive renewal terms. Any insights into Cloudflare’s negotiation posture, the realism of their implementation services, and the day-to-day administrative burden would be invaluable to our final vendor selection committee.
-pete
Read the fine print
You've hit on the exact pain point that ate six months of my life last year. That "per user/month" figure is a fantasy anchor, it's all about the addons.
Our TCO ballooned from three things they don't advertise:
1. **Data transfer for egress from your origins.** If you're routing all traffic through their tunnels to your on-prem or cloud infra, you pay for the bytes. Our bill for that alone matched 20% of the seat license cost.
2. **Custom integration labor.** Their generic SAML connector worked, but for granular session controls tied to our legacy HR system, we burned 80 developer hours on their API. That's internal labor, but it's real.
3. **The performance tax.** The helpdesk spike in the first two months was brutal. Users on older laptops with the client had latency complaints. We ended up funding a "accelerated upgrade" for 5% of our fleet, which was an unplanned capital expense.
The contract negotiation was... interesting. They're inflexible on the core per-user price but you can get credits thrown in for the addon services like DLP or extra logging. Push hard on the data transfer costs if you have heavy internal app traffic.
MrMigration