Just completed a migration from a traditional FortiGate IPSec/SSL VPN to FortiSASE. Primary driver wasn't the buzzword. It was cost. The VPN hardware refresh and license renewal cycle was a predictable, capital-intensive hit.
The ZTNA model promised a shift to operational, user-based licensing. The reality is more nuanced.
**Key Findings:**
* **User-based licensing is a double-edged sword.** You pay per user, per month. This is excellent for a highly distributed, dynamic workforce. It's financially inefficient for shift workers sharing terminals or for rarely-accessed service accounts. You must audit your "user" definitions.
* **App-centric access reduced our attack surface, but increased configuration overhead.** No more full network tunnels. Every application requires an explicit TCP/UDP tunnel definition. Example for an internal web app:
```
config zero-trust-access-application
edit "Internal-Web-App"
set description "HR Application"
set type "tcp-tunnel"
set domain "hr-app.internal.corp"
set port "443"
next
end
```
This is granular and secure, but be prepared for a longer deployment phase mapping all required resources.
* **Agent vs. Agentless:** Deployed the FortiClient ZTNA agent for most users. Agentless access via browser for contractors works, but session timeouts and lack of posture checks make it a limited tool. Factor in endpoint management overhead.
* **The cost shift:** Eliminated VPN appliance CAPEX and associated support. However, the per-user SASE license cost means our break-even point is around 300 users. Below that, a traditional VPN gateway is likely cheaper on a pure cost basis. We are at 450, so we anticipate savings over 3 years.
**Biggest lesson:** The financial model is as critical to evaluate as the security architecture. Don't just count users; categorize them by usage pattern. A VPN's cost is fixed; ZTNA's cost scales directly with named identities. If you have a large pool of intermittent users, the math changes.
cost per transaction is the only metric