VPN to ZTNA replacement cost: pricing and break-even
Replacing legacy VPN with zero trust network access is the most common zero trust entry point and the one with the cleanest cost-justification path. This page walks through the migration cost, per-VPN-vendor specifics, break-even versus continued VPN, the parallel-run period, the connector deployment cost most CISOs under-budget, and the security-value angle that often dominates the decision regardless of economics.
What VPN-to-ZTNA migration actually costs
Year-one VPN-to-ZTNA migration cost for a 500-user mid-market organisation breaks down into five components. ZTNA platform licensing is $30K to $120K for the first year, depending on tier (lightweight ZTNA at the lower end, full SSE bundle at the upper). Migration professional services is $20K to $80K covering policy translation from IP-based VPN rules to identity-based ZTNA rules, connector architecture design, and rollout coordination. Parallel-run licensing overlap is $15K to $40K for the 60 to 180 day period where both VPN and ZTNA are licensed. End-user training is $5K to $15K for materials, sessions, and help-desk preparation. Connector deployment is $10K to $30K, varying with the number of private app environments needing ZTNA connectors. The five components total $80K to $285K, which is the year-one VPN replacement budget at this scale.
Ongoing annual cost in steady state is roughly $40K to $140K, which is substantially lower than maintaining VPN appliances plus VPN per-user licensing. The dominant ongoing line is ZTNA licensing at $30K to $120K per year. Hardware maintenance, VPN per-user licensing, and the operational labour around VPN appliances all disappear.
A useful sanity check: total three-year cost of ownership. Continued VPN at the same 500-user scale runs roughly $60K to $200K per year in licensing plus maintenance plus operational labour, totalling $180K to $600K over three years. ZTNA at $80K to $285K year one plus $40K to $140K per year ongoing totals $160K to $565K over three years. ZTNA is broadly cost-neutral over three years and noticeably cheaper after that, with the security-value benefit on top.
Migration cost by incumbent VPN vendor
Migration cost is similar in absolute terms across major VPN vendors. The differences are in what is replaced (firewall function, hardware refresh avoidance) and how the migration is sequenced.
| Incumbent VPN | Appliance replaced | Refresh capex avoided | Per-user VPN licensing avoided | Migration notes |
|---|---|---|---|---|
| Cisco AnyConnect | Cisco ASA hardware | $15K - $80K avoided | $2 - $6 / user / month | Migration typically also retires Cisco ASA firewall. Sequence the firewall function replacement carefully. |
| Palo Alto GlobalProtect | PA firewall ZTNA module | $25K - $150K avoided | $3 - $8 / user / month | ZTNA function lives on PA firewalls. Migration often paired with Palo Alto's own SASE platform (Prisma Access). |
| Fortinet FortiGate SSL VPN | FortiGate firewall | $10K - $60K avoided | $2 - $5 / user / month | SSL VPN function on FortiGate. Migration sometimes paired with Fortinet's ZTNA platform. |
| Pulse Connect Secure / Ivanti Connect Secure | Dedicated SSL VPN appliance | $20K - $100K avoided | $3 - $7 / user / month | Pure SSL VPN appliance. Migration urgency from repeated zero-day vulnerabilities in recent years. |
| OpenVPN Access Server | Self-hosted | Limited capex avoided | $3 - $9 / user / month | Open source variant has zero license cost but operational overhead. Migration often paired with operational simplification. |
| Citrix NetScaler Gateway | NetScaler ADC + Gateway | $30K - $200K avoided | Varies | Often co-resident with Citrix Virtual Apps; migration sequencing more complex. |
When VPN replacement pays back
Break-even calculations depend on three variables: the current annual VPN total cost of ownership (licensing plus hardware maintenance plus operational labour), the ZTNA year-one and ongoing cost, and the timing of the next VPN hardware refresh cycle.
For a typical mid-market 500-user organisation with continuing VPN at $120K per year all-in and ZTNA at $150K year one plus $80K per year ongoing, payback is roughly 18 to 24 months. The first-year ZTNA premium ($30K above continuing VPN) is recovered in years two onwards through the $40K per year saving. Organisations facing imminent VPN hardware refresh see much faster payback because the avoided capex pulls into the year-one calculation. A 500-user organisation that would otherwise spend $80K on Cisco ASA refresh next quarter is comparing $150K ZTNA year-one (cumulative cost $150K) against $80K refresh plus $120K ongoing (cumulative cost $200K) over the same period; ZTNA breaks even in months 8 to 14.
Organisations with low VPN usage (under 30 percent of workforce regularly connecting via VPN) see slower payback because the per-user VPN savings are smaller. A 1,000-user organisation where only 200 users regularly use VPN is saving less than a 1,000-user organisation where all 1,000 use VPN. Payback in low-usage scenarios stretches to 30 to 40 months. In those cases the security-value argument (described below) typically dominates the cost argument.
The hidden cost most CISOs under-budget
Every ZTNA platform requires a software connector deployed in each environment that holds private applications. On-premise data centres, AWS VPCs, Azure VNets, GCP projects, branch-office networks, partner-facing app environments, regulated-data isolation environments, all need their own connector. The connector advertises which private apps are available behind it and routes authenticated user traffic to those apps.
Each connector deployment is 4 to 16 hours of professional services work, depending on the complexity of the environment, the firewall rules that need to allow the connector outbound, the integration with the identity provider, and the testing of the apps behind the connector. For an organisation with eight distinct private app environments, that is 32 to 128 hours of professional services labour. For an organisation with thirty private app environments (typical at upper mid-market or enterprise), 120 to 480 hours of labour, costing $24K to $96K depending on rates.
The labour cost is real but the larger issue is calendar time: each connector deployment takes a day or two of dedicated attention from the team that owns that environment. Eight connectors across eight different teams in a 500-user organisation is typically a four to eight week stream of work, not a single sprint. Plan the connector deployment as a sustained workstream, not a single deployment event, and resource the professional services accordingly.
Cloud-native organisations with all apps in SaaS need fewer connectors (often just one or two: one for any remaining private app, one for identity-aware proxy fronting legacy systems). The migration is much faster and cheaper for these organisations. Hybrid estates with significant on-premise app footprint are the slowest and most expensive to migrate, with connector deployment dominating the year-one timeline.
The argument that often dominates the cost economics
VPN appliances have been a dominant ransomware initial-access vector across multiple high-profile incidents in 2023-2025. CISA and the FBI have published joint advisories specifically calling out exploited vulnerabilities in Pulse Connect Secure (now Ivanti Connect Secure), Fortinet FortiOS, Citrix NetScaler, and others. The pattern is recurring: VPN appliance is internet-exposed by necessity (remote users need to reach it), the appliance has occasional severe vulnerabilities (the codebase is mature but large), and exploited vulnerabilities provide unauthenticated remote access to the internal network. The risk-reduction value of moving off internet-exposed VPN appliances onto cloud-delivered ZTNA is meaningful and often the strongest single argument for the migration regardless of cost economics.
The IBM 2024 Cost of a Data Breach report attributes lateral-movement-reduction value to identity-based access controls; the value is concentrated in environments that have successfully retired the VPN as an attack surface. The reduction in breach cost from removing the VPN exposure plus implementing per-app access policy is typically 15 to 30 percent of expected breach cost over a five-year window. For a mid-market organisation with 2 to 4 percent annual breach probability and $4.88M average breach cost (the IBM 2024 figure), the expected breach-cost reduction value is $30K to $120K per year. This is on top of the operational cost savings and is usually the largest single value line in the VPN replacement business case.