Alright, let’s get straight to it. I’ve been seeing a lot of marketing around Zero Trust Network Access that talks about “simplification” and “cost savings,” but I rarely see hard numbers from real deployments. Since we just wrapped up our annual renewal for our ZTNA platform, I figured I’d share our actual invoice (sanitized, of course).
We’re a 300-person company, fully remote, in the SaaS space. Our stack is pretty typical: a mix of corporate apps (HR, finance, internal wikis), a few legacy on-prem systems we’re migrating off, and a ton of SaaS tools. We switched from a traditional VPN + VLAN segmentation model about 18 months ago.
Here’s the breakdown of our annual commitment:
* **User-based licensing (300 named users):** $42,000
* **Add-on for advanced identity provider integrations (beyond basic SAML):** $6,000
* **Add-on for data loss prevention (DLP) scanning for SaaS apps:** $9,000
* **Add-on for “high availability” across multiple cloud providers:** $4,500
* **Support & Maintenance (24% of software subtotal):** $14,760
* **Total Annual Bill:** **$76,260**
That comes out to **$254.20 per user, per year**, or about **$21.18 per user, per month**.
Some immediate reactions from our team:
* The per-user cost was higher than the initial “entry-level” quotes we got during the POC, which were around $12-15/user/month. The core features we needed (like logging, reasonable performance, and basic access controls) required stepping up to a higher tier.
* The add-ons are where it gets you. DLP and advanced IdP integration felt non-negotiable for our security posture, but they added ~36% to the base license cost.
* The support fee being a percentage of the total feels like a tax that scales with your own investment. Ouch.
Now, I’m not saying it’s not worth it. The operational benefits are real—no more VPN complaints, cleaner access logs, and far better posture for audits. But when I see vendors positioning this as a direct, dollar-for-dollar replacement for a VPN, the math doesn’t always line up unless you had a massive, complex VPN infrastructure.
I’m curious: For those of you who’ve moved to ZTNA at a similar scale, does this align with your experience? Are you seeing a similar “add-on creep,” or did you manage to keep it lean? More importantly, how are you measuring the ROI beyond just the security win? I’m especially interested in the operational overhead comparisons—we saved on VPN server management but now spend more on identity governance.
TIL the list price is just the starting point for the conversation.
Pipeline is king.
Thank you for posting these concrete figures; they're invaluable for grounding the conversation in actual operational costs. Your total of ~$254 per user per year aligns with what I've seen for mid-market deployments with a similar feature set.
A significant factor often overlooked in these calculations is the operational burden shift. While your VPN+VLAN model likely had lower direct licensing costs, the administrative overhead for managing network rules and troubleshooting reachability issues can be substantial. The real question becomes whether the ZTNA premium buys you enough reduction in that overhead and in meantime-to-resolution for access issues to justify its cost. For some orgs, the math works if they factor in those soft costs.
Could you share any internal metrics on reduction in access-related support tickets or time spent on network segmentation changes since the switch? That would help complete the TCO picture.
brianh
Interesting you think that's a mid-market price. For 300 users, you're paying enterprise rates for a feature set you're probably not fully utilizing. The $6k for "advanced IdP integration" is a red flag. That's a core component of any modern ZTNA, not an add-on. If your vendor is upcharging for basic integration, you're getting taken for a ride.
Then there's the support cost. Twenty-four percent for maintenance on what is essentially a proxy service is steep. What's breaking that often? A properly configured ZTNA setup should be relatively static after deployment. You're likely paying for their profit margin disguised as a support fee.
The real surprise here isn't the total, it's the line items.
— geo