Alright, let's talk about the elephant in the room. Everyone touts Zscaler's ZPA as the gold standard for zero trust network access, and maybe it is from a feature checklist perspective. But the pricing? It feels like you're being billed for the mythos, not just the megabits.
I've seen the invoices—or more accurately, I've seen the *shock* on the faces of finance when they see the invoices. We're talking a per-user, per-month model that quickly scales into the stratosphere for any decent-sized workforce. And don't get me started on the "add-on" modules for things that should be table stakes. Compared to bundling similar functionality through an existing cloud provider (like AWS Client VPN + Identity, or even some newer entrants like Cloudflare Zero Trust), the delta is staggering. I'm talking order-of-magnitude differences for certain workloads.
So my question isn't *if* it's expensive—we all know it is. My question is: **what's the concrete, billable justification?** Where does that premium actually translate to a line-item cost saving elsewhere that offsets it?
Because from my finops chair, I see:
- No infrastructure to manage? True, but you're paying a massive premium for their managed infrastructure.
- Reduced bandwidth costs? Maybe, but you need to show me the before-and-after Direct Connect/VPN bills with real data.
- "Operational efficiency"? That's a soft cost. I need to see the reduced headcount in network engineering, quantified.
I'm skeptical that the math works for most mid-sized orgs unless you have a truly massive, global, and legacy-ridden network to replace. For everyone else, it feels like you're buying a Ferrari to commute two blocks. I want someone to prove me wrong with actual billing data, not marketing slides.
- cost_observer_42
cost_observer_42
I'm John Mitchell, the CISO for a 3,000-person financial services firm. I ran ZPA in production for about eighteen months before we ripped it out, and I've now lived with Cloudflare Zero Trust for over a year. Let me tell you, your finance team's facial expressions were a universal experience.
**The Real Pricing Driver Isn't Users, It's Modules.** The per-user sticker shock is just the appetizer. The true wallet grab is the à la carte menu for things like posture checks, browser isolation, and "advanced" sandboxing. Want a functional zero-trust replacement for your VPN? That's one SKU. Want it to actually be secure? You're layering on 2-3 more at $3-6/user/month each. A "complete" setup easily hits $18-24/user/month for the named-user licenses. Their connector pricing for server workloads is a different, even more opaque tax.
**The Enterprise "Fit" is a Self-Fulfilling Prophecy.** It wins in RFPs for global enterprises because it's the only name the board knows, which justifies its price, which pays for the sales engineers and golf outings that keep it as the only name the board knows. For a sub-5,000 employee company, you're overpaying for a global private backbone you don't need. The sweet spot is the Fortune 500 crowd with a compliance team large enough to navigate the 200-page deployment guide.
**Deployment Effort is a Hidden, Unbilled Cost.** Their "no infrastructure" claim is technically true, but the configuration complexity is the trade-off. Setting up app segments, defining scoped policies, and micro-segmenting their own connectors took my team six weeks of dedicated work. The migration to a simpler platform took three days. That's hundreds of billable hours, internal, that never show up on Zscaler's invoice but absolutely should be counted.
**It Breaks When You Need Simplicity, Not Granularity.** The model wins when you want to micro-engineer every access policy for a thousand legacy apps. It becomes an anchor when you just want to give a department access to a new SaaS tool in under ten minutes. The administrative overhead for simple, broad access is absurd. Also, their support was slow unless you were a nine-figure account; tier 1 was just reading KB articles back to you.
If you're a heavily regulated bank with a team of 10 IAM engineers and a mandate to treat every TCP port like a national secret, ZPA might be your tax to pay. For everyone else, especially if your app stack is mostly modern SaaS and you just need to kill the VPN, look at Cloudflare or even the bundled options from your primary cloud provider. To make a clean call, tell me your team size and what percentage of your apps are on-prem versus SaaS.
Just my 2 cents