Replacing a VPN with ZTNA: what the per-user licence buys at 1,000 staff

The renewal that puts a per-user number on the table

A VPN concentrator that has served a 1,000-person estate for years comes up for renewal, and the quote in front of the team is now a per-user subscription rather than an appliance and a support contract. Zscaler frames the replacement case in risk terms: it states that VPNs are exposed to the public internet for remote access by design, creating an attack surface, and that they give users direct network access, which allows lateral movement when implemented without complex segmentation rules. The same page reports that organisations are concerned VPNs compromise their security and that organisations suffered one or more VPN-related attacks in 2023-2024, without printing the percentages in the text supplied.

What changes for the buyer is the unit. An appliance is a capital purchase with a fixed concurrent-user ceiling; ZTNA is a subscription counted in named users, and the connector and policy tiers sit on top. That moves the decision from the network team's capital budget to a recurring line the finance business partner will question, and it makes the user count the first number to settle before any vendor call.

The second change is architectural. ZPA brokers direct, one-to-one connections between authorised users and specific apps, so users never access the corporate network and apps are never exposed to the public internet. Cloudflare makes the same promise in its own words: identity-first, quantum-safe access to internal apps with granular zero trust rules. Neither is a drop-in for a concentrator that also routes branch traffic, which is why the comparison below is about what the seat includes, not about which tunnel is faster.

What the per-user licence actually includes

Zscaler positions ZPA as one service inside a unified platform built on the Zero Trust Exchange, alongside Secure Internet Access for browsing and SaaS, Zero Trust Branch, Zero Trust Cloud and Digital Experience. The ZPA page describes AI-powered user-to-app segmentation, context-aware policies, full inline inspection of private app traffic with data loss prevention, and clientless remote access to RDP, SSH and VNC production systems. It also describes lightweight, infrastructure-agnostic software connectors and browser access, plus a business continuity option for policy-enforced access during connectivity outages.

Cloudflare sells the equivalent capability as a per-seat SASE and Zero Trust tier. Its page states a single per-seat price for remote, hybrid and branch users, no bandwidth charges for managed devices, unlimited software connectors and private interconnects at no extra cost, and full CASB coverage for data at rest and in transit included alongside unlimited API integrations. It also claims full SASE from 335+ cities, more than three times other SASE vendors, and post-quantum encryption across the full stack.

The practical difference at 1,000 staff is what the seat bundles. A Zscaler buyer can take ZPA alone or the wider platform, and the page does not state which of the adjacent services are included in a ZPA subscription versus sold separately. A Cloudflare buyer is quoted a seat that the page presents as carrying remote access, branch networking, email security, DNS filtering and CASB together. Ask both vendors for a line-item quote that names every service in the seat, because that list is what makes two per-user prices comparable.

Where the per-user model breaks

Per-user pricing punishes the estate that has more identities than staff. Contractors, third parties and business partners all need access to specific apps, and Zscaler explicitly targets third-party access and B2B access to partner and vendor applications hosted in their networks. Every one of those identities is a seat unless the contract says otherwise, so a 1,000-staff company with 300 regular contractors is pricing 1,300 users, not 1,000. Cloudflare's per-seat model has the same exposure, and its page does not describe a separate contractor tier.

The connector side is where the two quotes diverge most. ZPA depends on lightweight software connectors paired with browser access, and the page does not publish a connector limit or a connector price. Cloudflare states unlimited software connectors and private interconnects at no extra cost. If the estate runs dozens of app segments across two data centres and three clouds, the connector line is the one to put in writing, because it is the line a ZPA quote may carry and a Cloudflare quote will not.

Neither page publishes a price for 1,000 users. Zscaler's ZPA page carries a request-a-demo call to action and no figure; Cloudflare's page describes a single per-seat price and points to contact sales for the SASE and Zero Trust tier. That absence is the finding: the only number a buyer can act on this quarter is the one in the vendor's written quote, and the questions that move it are the user count including contractors, the connector count, the app count and whether the seat bundles internet and SaaS security or sells it separately.

How the shortlist compares

Two options are worth shortlisting for a 1,000-staff replacement, and they are sold on different units. Zscaler Private Access is a per-user subscription to a named ZTNA service inside a larger platform, with the adjacent services priced as part of the platform rather than stated on the ZPA page. Cloudflare's SASE and Zero Trust tier is a single per-seat price that the page presents as bundling remote access with branch networking, email security, DNS filtering and CASB, with no bandwidth charges for managed devices.

The table below sets out what each page states and where it is silent. Read the silent cells as questions for the vendor, not as gaps in the product: a figure that is not published is a figure the buyer has to request in writing before the renewal date, and the answer belongs in the contract rather than in a slide.

What it costs, and what the VPN already covers

The honest starting point is that the existing VPN costs nothing per user beyond the support contract already paid. ZTNA adds a recurring per-user line for every identity, so the business case has to be built on what the VPN cannot do: clientless access to production systems over RDP, SSH and VNC without a client, per-app segmentation that stops lateral movement, inline inspection of private app traffic with data loss prevention, and access for third parties who should never touch the corporate network. Zscaler's page describes each of these; Cloudflare's describes the segmentation and the granular rules.

The second cost driver is consolidation. If the seat also replaces a secure web gateway, a CASB and an email security subscription, the per-user price is offset against three renewals rather than one. Cloudflare's page states that CASB, email security, DNS filtering and branch networking sit in the same per-seat tier, which makes the offset visible in a single quote. Zscaler's platform page lists Secure Internet Access, Zero Trust Branch and Zero Trust Cloud as separate services, so a ZPA-only quote will not show that offset and the buyer has to ask for the platform quote to compare like with like.

The third is the migration itself. Zscaler states that ZPA can replace legacy tools like VPNs and VDI in just hours, which is a vendor claim about deployment time rather than a costed plan. Cloudflare states that its capabilities roll out in hours, not months. Neither page prices the engineering time to re-segment applications, rewrite access policy per app and retire the concentrator, so budget that internally and treat the vendor's hours claim as the floor, not the estimate.

The decision rule for a 1,000-staff estate

Choose Zscaler Private Access if the requirement is a named ZTNA service with clientless access to RDP, SSH and VNC production systems and inline inspection with data loss prevention, and if the estate is prepared to buy the wider Zero Trust Exchange platform to get internet and SaaS security alongside it. The condition that decides it is the app inventory: ZPA is sold as user-to-app segmentation, so a buyer who can enumerate the apps and the user groups per app gets a quote that reflects the estate, and a buyer who cannot will be quoted on the full user count.

Choose Cloudflare's SASE and Zero Trust tier if the renewal is really a consolidation, where the per-seat price has to absorb branch networking, email security, DNS filtering and CASB to beat the sum of the separate contracts, and if unlimited connectors and no bandwidth charges for managed devices remove the two lines most likely to grow. The condition is the branch estate: the per-seat model only pays if the same users are the ones the branch network serves, because a seat bought for a warehouse location that never uses remote access is a seat wasted.

Wait if the 1,000 staff are overwhelmingly on-site and the VPN's only real job is a small remote cohort, because neither vendor publishes a price that beats a paid-for concentrator for that shape of estate, and the per-user line would be bought for capability the team will not use this year. Before signing either quote, ask for the user count including contractors and third parties, the connector count and price, the app segment count, and the full list of services inside the seat, because those four answers decide which of the two per-user prices is actually lower.