We're finally replacing our legacy VPN concentrators and are evaluating ZPA and Cloudflare One Tunnels. The core use case is straightforward: secure access to internal apps (mostly web-based) for about 300 users across 20 branch offices and remote workers. No split tunneling—everything goes through the tunnel.
I’ve run PoCs for both and the functional outcomes are similar, but the operational and financial models are worlds apart.
My initial takeaways:
* **ZPA:** The "App Segment" and "Private Service Edge" logic is powerful, but it feels like we're buying a whole city when we just need a few roads. The per-user, per-month pricing adds up fast, and I'm already bracing for the annual uplift.
* **Cloudflare One:** The tunnel setup (`cloudflared`) was dead simple. Pricing based on egress bytes and connected seats is intriguing for our pattern, where many users are connected but idle for chunks of the day. The big question is predictability.
Has anyone else made this switch, particularly at our scale? I'm less interested in "which is better" and more in:
* Real-world bandwidth costs under Cloudflare's model for similar remote access patterns.
* The negotiation levers you found with either vendor. Is there flexibility on the ZPA user minimums?
* Operational overhead for managing 20+ tunnel endpoints long-term.
Our procurement team is already sharpening their pencils, but I want to ground their discussions in actual deployment experience, not just list prices.
I'm a Head of Security at a 350-person SaaS company. We migrated from traditional VPN to ZPA two years ago, but I run Cloudflare Tunnels for a subset of non-user-facing services.
The difference isn't just price, it's architectural DNA:
1. **Real pricing & predictability:** ZPA is $6-12/user/month with a hard 12-month commit. Cloudflare One was ~$3.50/seat + ~$0.085/GB egress for us last quarter. Our bill fluctuates +/- 15% month-to-month.
2. **Deployment/control plane:** ZPA's browser-based admin is slow but exhaustive. Cloudflare's API-first config is faster, but you'll live in Terraform. Migrating 20 sites with `cloudflared` took us 3 days; ZPA took 3 weeks of tuning app segments.
3. **Hidden limitation:** Cloudflare's tunnel stability is superb until you need L7 inspection *inside* the tunnel for compliance (e.g., DLP). You'll need their Gateway add-on. ZPA's App Segments are inspection-ready by design.
4. **Breakage mode:** ZPA fails closed. If the connector service dies, access stops. Cloudflare tunnels can fail open if misconfigured (e.g., `ingress { service: https://localhost:443, originRequest: { noTLSVerify: true } }` is a dangerous default).
For 20 sites and 300 users where cost matters and your apps are mostly web-based, I'd pick Cloudflare One. The bandwidth model will likely save you money if users are idle often. But if you need deep audit logs per-app or are in a heavily regulated industry, go ZPA. Tell us your compliance requirements and whether you'll need to inspect internal HTTP traffic.
Trust but verify, then don't trust.
That pricing model is really intriguing, but I'm worried about the variable cost. I can budget for a set per-user fee, but fluctuating bandwidth makes forecasting tough, especially if we start hosting more internal video or large files later.
You mentioned many users are idle during the day. Did your PoC give you any sense of what the baseline "heartbeat" traffic looks like for Cloudflare, just from keeping the tunnel alive? Even a small per-GB cost could surprise us over 300 seats.
Also, did you get any clarity on what they consider a "connected seat"? Is it an authenticated user per day, or a concurrently active tunnel? That distinction feels like it could swing the cost a lot.