The headline savings are real. The operational overhead shifted.
Zscaler's fabric is a known quantity. You pay for the whole orchestra. NordLayer gives you a VPN client and a control panel. The bill went from "enterprise extortion" to "SaaS lunch money."
The catch? You're now the orchestra. Their API is... minimal. Want to sync user groups from your IdP for automatic policy assignment? Enjoy this bash script that scrapes the admin panel.
```bash
# This is how you "integrate" with NordLayer. Don't ask.
curl -s -H "Authorization: Bearer $TOKEN"
"https://api.nordlayer.com/v1/organization/users" | jq '.[] | select(.group=="null")' ...
```
Alerting on gateway health? Build it yourself. Logging for compliance? Hope you like forwarding raw packet logs to your SIEM and paying for the storage.
It's a classic trade. You save a fortune in licensing, but you burn engineering cycles building the guardrails Zscaler had built-in. Good if your team is heavy on infra-as-code and light on headcount. A disaster if you need a fully managed service.
For us, the 60% savings buys a lot of automation time. For a team without that capacity, the "savings" will vanish into firefighting.
Prove it.