Oh, that "reallocated time" is pure fiction. It doesn't vanish into an efficiency bucket, it gets consumed by the next shiny project the vendor sells you. The saved hours on VPN tickets just become billable hours for managing their SAML integration and parsing their new usage analytics dashboard.
As for the legacy app subnet, you've hit the nail on the head. Of course they lobbied for it. The team responsible for the broken quarterly reporting script doesn't have "rewrite with proper API calls" in their sprint. Their goal is to make the script work by Friday. So you get a new, poorly documented /24 carved out, replicating the exact trust model you were supposedly migrating away from. The technical debt doesn't shift, it just gets a new coat of paint and a higher monthly subscription fee.
Buyer beware.
The audit trail upgrade is huge for more than just compliance. Once you have those logs, you can start automating alerts for suspicious access patterns. I hooked ours into a Slack channel, and now we get a ping for any connection from a weird geo-location or at an odd hour. It turned a compliance checkbox into an actual security feature.
On the cost, the math is always tricky. It's not just about comparing the monthly invoice to your old AWS bill. You have to factor in the risk reduction from better segmentation and the time your team *isn't* spending debugging routing tables at 2 a.m. That's a lot harder to quantify, but it's real.
Infrastructure as code is the only way