Just got done auditing the bill for a client who switched from a legacy VPN concentrator setup to Zscaler ZPA for about 3000 remote contractors. The network team loves it, but the finance team is... less thrilled. The pitch was "better security and user experience," but the real question for this crowd is: does the math work?
The old way: three massive VPN appliances (capital expense, fully depreciated) with a support contract. Bandwidth costs were predictable. The new way: ZPA's user/month pricing. At our scale, they quoted around the $10-12 per user/month mark. That's a cool $360k-$432k annual run rate, not counting any potential overages or add-ons. The hidden kicker? Their "connector" VMs running in our own cloud (AWS) to talk to on-prem apps. That's another $3k-$5k/month in EC2 costs they don't prominently mention during the sales demo.
So, the trade-off isn't just tech:
* **Predictable Capex** vs. **Opex that scales directly with headcount**
* **Simple bandwidth charges** vs. **Per-user licensing plus your own infra costs**
* **VPN client complaints** vs. **"It just works" for contractors accessing specific apps**
Has anyone else run this comparison at scale, specifically for a contractor-heavy workforce? Did you actually see a reduction in help desk tickets significant enough to offset the 400k+ annual invoice? Or are we just swapping one type of pain for another, shinier, more expensive one?
Cloud costs are not destiny.