I've been reading a lot here about ZTNA principles and the shift from VPNs. It makes sense for our small team, especially with people working from different locations.
We're a 20-person B2B SaaS company. Our stack is Google Workspace for identity and Zoom for meetings. Everything else is in the cloud (a few web apps, our own platform, and a basic PostgreSQL database we sometimes query). We don't have a dedicated IT person, so it needs to be manageable.
Our budget is firm at under $5k for the first year. I'm trying to map the architectural concepts I've read about to this reality.
My main questions are:
1. Given our size and Google Workspace, does an agent-based or agentless approach make more sense? I've read about the trade-offs for managed vs. unmanaged devices, but most of our team uses company laptops.
2. Are there practical options in this budget that handle the core use case of securing access to our internal web tools and maybe the database? Or is this number unrealistic for 20 users?
3. How deep does the identity integration usually go? Is it just SSO with Google, or are there other considerations for policy?
I'm less interested in vendor names and more in understanding what's actually feasible to implement ourselves with this constraint.
That's a solid, practical breakdown of your situation. Since you're already on Google Workspace and use company laptops, an agent-based approach is likely the more straightforward path. It gives you more context for device health in your policies, which you'll want for database access.
Your budget is realistic for the core use case. Many services price per user per month, and 20 seats at under $5k annually gives you a few good options. The key is to see if they treat the database connector as a core feature or a costly add-on.
For identity, look beyond simple SSO. The useful integration is pulling groups from Google Workspace directly into your access policies. That way, you can manage access by team in Google, and it reflects automatically in your ZTNA rules, which is crucial for maintainability without dedicated IT.
- GG
Great questions. Since your team mostly uses company laptops, I'd lean agent-based too. It simplifies those database access policies by adding device posture as a factor, which you'll want. Just be ready for that initial rollout. It's usually smooth, but you'll need a clear communication plan for your team.
Your budget is totally workable for 20 seats at that price point. The trick, as user436 hinted, is that database connector. Some providers include it, others have a separate "gateway" fee. When you look at options, get a clear yes/no on whether Postgres connectivity is part of the quoted per-user price.
On identity, look for group sync, not just SSO. A good integration lets you build ZTNA rules using Google Workspace groups (like "engineering" or "sales"). That's how you keep it manageable without a dedicated IT person - you manage team membership in one familiar place.
Absolutely agree on the group sync point, that's the linchpin for a small team. One thing I'd watch out for is the group membership update latency. Some integrations are near real-time, others might sync on a schedule. That delay can be a gotcha if you're immediately revoking access.
For the Postgres connector, also check if it's a simple TCP tunnel or if it does protocol-aware inspection. The latter is safer but can sometimes be picky about client drivers. Might be worth a quick test with whatever tool your team uses, like pgAdmin or DBeaver.