Zscaler vs Netskope vs Prisma Access: what SSE costs at 1,000 users

The market is growing, the price list is not

The SASE market reached $3.5 billion in the second quarter of 2026 and grew more than 20 percent year over year for a fifth consecutive quarter, Dell'Oro Group reports. Growth like that usually comes with discounting, but none of the three vendors a 500 to 2,000 user estate would shortlist publishes a per-user rate. Zscaler, Netskope and Palo Alto Networks all quote per user per year, and all three price the same subscription differently depending on which bundle, module or licence tier the buyer is pushed into.

That is the decision at this size. The headline rate is negotiable and largely converges, while the bundle decides whether zero-trust access, data loss prevention and inline inspection are included or appear as a second purchase.

What each bundle gates

Zscaler sells two platform bundles. Essentials pairs Secure Internet Access, its secure web gateway, with ZPA Standard, and adds standard versions of digital experience, data security in alert-only mode, sandbox, firewall and isolation. The limit sits in the ZPA line: Zscaler's pricing page says ZPA is included in Essentials for 5 percent of users, so an estate that wants zero-trust access for every employee is buying Zscaler Platform, which adds full ZPA and inline data security across web and apps; the advanced modules are add-ons on top of either bundle.

Netskope sells modules rather than a single bundle. Vendr's transaction data puts CASB-only contracts at $15 to $35 per user a month, secure web gateway at $20 to $45, and ZTNA at $25 to $50, with a full SASE bundle at $40 to $75. Palo Alto describes Prisma Access as one cloud-delivered product covering ZTNA, secure web gateway, CASB, remote browser isolation and firewall as a service, and its documentation says service connections to internal resources are available only if the licence includes them.

The per-user band at 1,000 seats

Vendr's 2026 data, drawn from anonymised contracts, gives a usable per-user band: $35 to $70 a month for Zscaler, $40 to $75 for Netskope and $45 to $80 for Prisma Access. Applied to a 1,000-user estate, the annual subscription runs from $420,000 to $840,000 for Zscaler, $480,000 to $900,000 for Netskope, and $540,000 to $960,000 for Prisma Access. Across three years the same arithmetic runs from $1.26 million to $2.88 million across the three vendors before any multi-year discount, which Vendr reports at 20 to 35 percent below initial quotes when buyers run a competitive evaluation.

That band is not the invoice. Vendr puts the contract floor at $50,000 a year for Zscaler, $75,000 for Netskope and $100,000 for Prisma Access, and the median Netskope contract in its dataset is $96,815 a year across deals of every size, a number that says more about the small end of the market than about a 1,000-seat estate. Renewal uplift is the other line: Vendr reports 5 to 10 percent annual increases as standard in Netskope renewals unless the cap is negotiated at signature.

Where the traffic goes, and what pointing it costs

The traffic path is the part of the decision an architecture review will not let go. Palo Alto documents Prisma Access as terminating mobile users at mobile user security processing nodes and remote networks at remote network security processing nodes, then reaching internal resources through IPsec service connections when the licence includes them. Netskope runs the platform on NewEdge, which it describes as one of the world's largest private security cloud networks, with a single agent footprint on the device. Zscaler sells the platform as one subscription and does not put the connector and tunnel design in the per-user price, so that work appears in the services quote.

That matters at 500 to 2,000 users because each site needs a path to the vendor cloud and each private application needs a route back. An estate with twelve branch offices and a data centre is buying twelve tunnels or a client rollout, plus the policy that decides which application each user reaches. The vendor calls it onboarding. The invoice calls it professional services.

The migration cost nobody quotes

Every per-user figure above excludes implementation. Vendr's comparison puts professional services at $20,000 to $125,000 for Zscaler, $25,000 to $150,000 for Netskope and $30,000 to $200,000 for Prisma Access, depending on how much policy has to be rebuilt. For a 1,000-user estate that range is often the difference between two otherwise similar quotes, and it is the line a procurement team forgets to put beside the subscription.

The work behind the number is policy translation. A legacy web gateway carries years of URL categories, exceptions and firewall rules that have to be recreated in a different policy engine, and the identity provider integration has to be tested before the first user is cut over. Ask for the services line as a fixed price with the policy count and the number of sites named, because a rate card built on user count says nothing about how many rules have to move.

The decision rule

Choose Zscaler if the estate needs a secure web gateway and zero-trust access for everyone and the team wants one bundle to buy; price Zscaler Platform rather than Essentials, because the 5 percent ZPA allowance will not cover 2,000 users. Choose Netskope if the estate is data-heavy and the CASB and DLP modules are the reason for the project, and negotiate those modules as one package rather than a menu. Choose Prisma Access if Palo Alto firewalls are already in place, because the service-connection model and the policy language are the ones the team already runs.

Whoever wins, ask for three numbers in writing at the exact user count: the three-year subscription, the professional services to migrate policy, and the annual uplift after year one. A per-user rate without those three is not a quote, and it is the reason two 1,000-user estates can report costs that differ by a factor of two.