In short
Zero trust network access cost depends on the licensing unit (per user or per device), the tier, add-ons such as static IPs or dedicated gateways, the contract term and the deployment and migration effort. Against that, you can often retire VPN appliances, RDP gateways and some firewall subscriptions. Pricing is quoted per organisation, so ask us for a quote.
Get a quote for zero trust network access
Ask us for a quote and we will reply by email with options priced for your organisation.
What you are paying for
Every ZTNA quote is built from the same handful of drivers:
- Licensing unit: most vendors license per user; some license per device; a few combine both, with a per-user licence covering several devices
- Tier or edition: entry tiers cover core private access; higher tiers add web and SaaS security, cloud firewall, device posture enforcement, data loss prevention or agentless access
- Add-ons: dedicated gateways or servers, static IP addresses, site tunnels, sandboxing, browser isolation
- Term: monthly, annual or multi-year terms change both the price and your flexibility to reduce numbers
- Deployment and migration: the professional services to design policy, roll out clients and move applications off the VPN
- Ongoing management: who maintains policy, reviews logs and handles joiners and leavers
None of these can be priced sensibly in isolation, which is why we quote rather than publish figures. The rest of this page explains how each vendor we supply approaches them.
Licensing units by product
| Product | Licensing unit | Notes |
|---|---|---|
| NordLayer | Per user, from five users; each licence covers up to six devices | Lite, Core and Premium; dedicated servers for private gateways and a fixed IP are licensed separately; Enterprise offer from 200 users |
| Exium SASE | Per user, covering up to five devices | Essentials and Pro; Cyber Gateway for offices is licensed per site |
| Todyl SASE | Per device, billed monthly | Todyl describes SASE as offered with no annual contracts, though a minimum monthly commitment can apply; static IPs are per tenant; SASE Tunnel per tunnel |
| Cisco Secure Access | Per user, on 12, 36 or 60-month terms | Secure Internet Access and Secure Private Access in Essentials or Advantage; a bandwidth-based site option exists for Secure Internet Access Essentials |
| Check Point SASE (formerly Harmony SASE) | Per user; monthly or fixed terms | Internet Access Essentials, Premium or Complete (on-device or hybrid); Private Access Complete |
| Trend Micro ZTSA | Per user under TrendAI Flex | Private Access, Internet Access and AI Secure Access; Outbound Static IP add-on sized by bandwidth |
| Island Enterprise Browser | Per user | Island Browser Professional plus the per-user Zero Trust add-on for Island Private Access |
| Zero Networks Connect | Per Connect licence, monthly | Can be combined with Network Segmentation and Identity Segmentation |
| TruGrid SecureRDP | Per user, monthly or annual | Basic, Business and Enterprise; Business has a minimum user count and Enterprise is a site licence |
For detailed licensing on each product, see NordLayer licensing, Exium SASE licensing, Todyl SASE licensing, Cisco Secure Access licensing, Check Point SASE licensing, Trend Micro Zero Trust Secure Access licensing, Island Enterprise Browser licensing, Zero Networks Connect licensing and TruGrid SecureRDP licensing.
Not sure which licence fits? Ask us
We will match the right licence to your requirements and quote for it.
Per user or per device: which is cheaper?
Neither is cheaper in general; it depends on your ratio of people to devices.
- Per-user licensing (NordLayer, Exium, Cisco Secure Access, Check Point SASE, Trend Micro ZTSA) suits staff with a laptop, phone and perhaps a tablet. Check how many devices each licence covers: NordLayer states up to six, Exium up to five.
- Per-device licensing (Todyl) suits shared devices, servers and firms where each person has one device. It also makes it easy to protect a server or kiosk that has no named user.
Also check how licences are counted when people leave, whether you can reduce numbers mid-term, and whether mobile devices are included or licensed separately. These details often matter more than the headline unit.
Tiers and add-ons that change the price
Tier names differ by vendor, but the pattern is consistent: the entry tier covers private access, and higher tiers add the wider security service edge.
| Vendor | Tiers | What higher tiers typically add |
|---|---|---|
| Cisco Secure Access | Essentials, Advantage | Layer 7 firewalling with IPS, remote browser isolation, multimode DLP, unlimited sandboxing |
| NordLayer | Lite, Core, Premium | Private gateways and fixed IP (Core), cloud firewall, device posture enforcement and site-to-site connector (Premium) |
| Exium SASE | Essentials, Pro | Agentless access, SaaS conditional access, geo-fencing, SSO/MFA, SCIM and SIEM integrations |
| Check Point SASE Internet Access | Essentials, Premium, Complete | Greater depth of protection and control, on-device or hybrid |
Common add-ons are static or dedicated IP addresses (for allowlisting on SaaS and supplier systems), dedicated gateways or servers, site tunnels to connect offices, sandboxing for downloads and remote browser isolation. Decide which ones you genuinely need before comparing quotes; it is easy to compare one vendor's entry tier with another's top tier by mistake.
Want a price for your organisation?
Tell us your users, sites and timescales and we will come back with a clear quote.
Deployment, migration and what you can retire
Licences are only part of the cost. A realistic budget also includes:
- Design: inventorying applications, writing per-app policy and deciding how contractors and personal devices will be handled
- Identity and device work: enforcing MFA and bringing devices under management, if not already done
- Rollout: deploying clients and connectors, piloting and moving users in groups
- Migration: moving applications off the VPN one by one and resolving the awkward ones
On the other side of the ledger, ZTNA often lets you retire or downsize:
- VPN appliances or concentrators, and their support contracts
- RDP gateways and the servers that run them
- Some branch firewall subscriptions, where an SSE or SASE platform takes over web filtering (many organisations keep site firewalls; see SASE vs firewall)
- Separate web filtering tools, if the platform includes a secure web gateway
- Time spent on emergency VPN patching and remote access support
ZTNA vs keeping a VPN: total cost compared
| Cost area | Keeping a remote access VPN | Moving to ZTNA |
|---|---|---|
| Licences | Firewall or VPN subscription, often bundled with the appliance | Per-user or per-device subscription |
| Hardware | Appliance refresh on a hardware cycle | Usually none; software connectors on existing servers or cloud |
| Patching effort | Urgent patching of an internet-facing gateway | Vendor maintains the cloud service; you maintain clients and connectors |
| Security exposure | Internet-facing gateway and broad network access | Private apps sit behind outbound-only connectors or a hardened broker; per-app access |
| Contractor access | Extra accounts and rules, hard to restrict | Per-app, often clientless |
| Migration | None | One-off design and migration effort |
| Flexibility | Capacity tied to the appliance | Add or remove users or devices as needed, subject to term |
The comparison is qualitative on purpose: the numbers depend on your current contracts, estate and how many applications need to move. We can build a like-for-like comparison from your actual renewals.
Getting an accurate quote
To quote properly we need: the number of users and devices, which applications people reach and how, whether you also want web and SaaS protection, any need for fixed IP addresses or site connectivity, your preferred term and your current VPN and firewall renewal dates. With that, we can price two or three suitable options side by side, including deployment, so you are comparing like with like.
For small firms, our ZTNA for small business page covers the options that need no hardware. If you are buying a conventional business VPN rather than ZTNA, our software licensing site covers that. Pricing is tailored to you, so ask us for a quote. Contact us to get one.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
How much does ZTNA cost per user?
It depends on the vendor, tier, add-ons and term, so there is no single figure. Most ZTNA services are licensed per user per month or year, some per device. We quote rather than publish prices: ask us for a quote and we will compare suitable options side by side.
Is ZTNA more expensive than a VPN?
It depends on your estate. A ZTNA subscription can cost more than a VPN feature bundled with a firewall, but a fair comparison also counts appliance refreshes, emergency patching, RDP gateways and the exposure of an internet-facing VPN. We can compare both from your actual renewals.
Is ZTNA licensed per user or per device?
Most vendors license per user, often with several devices included: NordLayer states up to six devices per licence and Exium up to five. Todyl licenses SASE per device. We confirm the unit for each product on your quote.
Are there hidden costs with ZTNA?
The common extras are dedicated gateways or servers, static IP addresses, site tunnels, higher tiers for features such as cloud firewall or DLP, and the one-off effort to design policy and migrate applications. A good quote lists these line by line.
Can we pay for ZTNA monthly?
Often, yes. Monthly terms are available for several options, including Check Point SASE, Todyl SASE, Zero Networks Connect and TruGrid SecureRDP, while Cisco Secure Access is normally sold on 12, 36 or 60-month terms. Minimums and the rules for reducing numbers vary, so we confirm the term options for each product when we quote.
Still have a question about zero trust network access?
Ask us and a member of our team will reply by email.