Hey everyone, I've been tasked with helping evaluate our move to a SASE model, and we're looking specifically at Palo Alto's offerings. We're a company of about 500 users, mostly remote, and I'm trying to wrap my head around the real-world differences between Prisma Access and a VM-Series deployment.
From what I understand, Prisma Access is the fully managed SASE service, while VM-Series would be us running our own NGFW virtual appliances in the cloud (likely Azure/AWS) and building out the secure access parts ourselves. The sales pitch for Prisma Access is obvious—less management overhead. But I'm really digging into the cost and performance implications at our scale.
On the cost side, I've heard the licensing models are completely different. Is Prisma Access primarily a per-user, per-month subscription? And for VM-Series, is it more about the VM instance size, bandwidth, and the traditional Panorama/licensing? For 500 users, which direction tends to be more cost-effective, assuming we have some in-house skills to manage the VMs?
Performance-wise, I'm curious about latency for remote users. With Prisma Access, they connect to the nearest PoP. With a VM-Series design, would we be routing all traffic back to a couple of centralized cloud regions? That seems like it could add hops. Has anyone measured the actual user experience difference?
```sql
-- This is the kind of simple log analysis I'm used to!
-- But managing global gateways is a whole other level.
SELECT user_id, endpoint, avg(latency_ms)
FROM network_logs
WHERE date > CURRENT_DATE - 7
GROUP BY user_id, endpoint;
```
Any insights from those who've gone through this comparison would be super helpful. Did you start with VM-Series and migrate to Prisma Access, or the other way around? What were the big "aha" moments in terms of either hidden costs or performance bottlenecks?
I'm a cloud security lead at a 350-person SaaS company where we support a fully remote workforce, and I've managed both a multi-region AWS VM-Series deployment for two years and migrated to Prisma Access six months ago.
* **Total Cost Ownership (TCO) at 500 users:** For Prisma Access, you're looking at roughly $110-140 per user, per year for their full Secure Access stack, so about $55k-70k annually. The VM-Series cost is more variable; with two HA pairs in different regions (on c5n.4xlarge instances), plus Panorama, Threat Prevention, and DNS Security licenses, plus cloud data egress, we were at about $85k/year before operations labor. The management labor is the hidden tax.
* **Performance and Latency:** Prisma Access consistently shaved 15-25ms off latency for our remote users because they hit a nearby PoP. Our previous VM-Series design in us-east-2 and us-west-2 added that extra hop across the public internet to our cloud VPCs. For 500 users, throughput wasn't the bottleneck; location was.
* **Deployment and Management Footprint:** Going from zero to a basic VM-Series HA pair with templates and security profiles took us about 3 weeks. Prisma Access was usable in an afternoon. The ongoing gap is massive - we spent maybe 15 hours a week on VM-Series upkeep (updates, scaling, troubleshooting). With Prisma, it's under 2 hours for policy tuning.
* **Where VM-Series Still Has an Edge:** If you have deep custom inspection needs, like running your own custom apps in the data path or requiring direct access to packet captures for complex forensics, the VM-Series gives you that raw control. Prisma abstracts a lot of that away for the sake of simplicity.
My pick is Prisma Access for your specific scenario of 500 remote users, unless you have a compliance or technical requirement for full packet-level custody. To make it 100% clear, tell us if your team has a dedicated network security person to manage the VMs, and if you have any custom Layer 7 applications that must be inspected inline.
Keep automating!
Your VM-Series TCO breakdown lines up with what I've seen. The real kicker is the hidden operational cost you mentioned, which people often ignore until they're building deployment templates and troubleshooting HA failovers at 2 a.m.
At your scale, the latency win from hitting a nearby Prisma Access PoP is significant. That 15-25ms is the difference between users complaining and not noticing anything.
One caveat on Prisma Access: its feature parity with the full NGFW suite can lag, especially for new App-ID or SSL decryption features. You're trading direct control for that managed service benefit. If your team has deep PAN-OS expertise, that loss can sting.
Prove it with a benchmark.
That feature lag is real. We almost hit a snag with a new SaaS app because its custom app signature wasn't in Prisma's library yet, while it was already available in the PAN-OS update for our on-prem firewalls. Had to use a custom app-ID policy as a temporary fix.
It's a real trade-off for the 2 a.m. HA failover peace of mind. How do you handle the roadmap gap? Do you just accept it, or do you have a process to pressure your Palo Alto rep for updates?
Benchmarking my way to better decisions