Zero Trust vs VPN: The Real Cost of Switching

Zero Trust's commercial pitch almost invariably includes the promise that it will be cheaper than a VPN. Sometimes it's true — but not in the first two years, not for small teams, and not without considering the migration costs that rarely appear on initial spreadsheets. Doing an honest analysis requires separating the licensing cost from the total operating cost, and the recurring operating cost from the one-time transition cost.

What traditional VPN really costs

The cost of a well-maintained corporate VPN has three components that are rarely added together. The first is the VPN concentrator hardware or VM: Cisco ASA or Palo Alto GlobalProtect Gateway appliances for medium environments cost between R$25,000 and R$250,000, amortized over 3 to 5 years. The second is customer licensing: Cisco AnyConnect and GlobalProtect charge between $15 and $25 per user per year; for 200 users, that's $3,000 to $5,000 annually on client software alone.

The third — and often underestimated — is operational cost. VPN requires certificate rotation, managing client versions across heterogeneous devices, maintaining split tunnel rules when new internal services are created, and managing hub capacity when the number of concurrent sessions grows. For a team of 100 users, conservative estimates put this overhead at 10 to 15 hours of engineering per month. For 100 users, the TCO for a well-operated VPN is between $15,000 and $25,000 per year, considering amortized hardware, licensing, and engineering time.

What Cloudflare Zero Trust Really Costs

Cloudflare Zero Trust's Team plan costs $7 per user per month. For 100 users, that's $8,400 per year of licensing — below the VPN TCO even without counting the engineering time saved. For 500 users, that's $42,000 per year, with the possibility of trading below $7 on volumes above 200. The plan includes Access, Tunnel, WARP and Gateway with logs — no hardware to amortize.

The initial implementation cost changes the equation in the first year. A medium complexity deployment — three to eight internal applications, integration with Okta or Azure AD, WARP rollout via MDM to 100 devices — requires between 40 and 80 hours of engineering. Adding implementation to first-year licensing, the total cost for 100 users is between $14,000 and $22,000 — comparable to the TCO of a VPN. From the second year onwards, with no implementation cost and lower operational overhead, the financial advantage of Zero Trust becomes concrete.

The hidden costs of migration

VPN migration to Zero Trust has costs that optimistic designs omit. The parallel operation period is the first: during the migration, the old VPN continues running while the applications are migrated one by one to Access. For organizations with many internal applications, this period can last six months or more — paying for VPN and Cloudflare simultaneously.

The second cost is applications that depend on IP allowlisting. Any service that accepts connections only from specific IP ranges — databases configured to accept only the VPN concentrator IP, internal APIs that check source IP — breaks the Zero Trust model, where the source IP is the Cloudflare edge. Remediation involves updating the allowlist or implementing service tokens. Inventorying these dependencies before starting the migration is essential — discovering them during the process is costly.

The third cost is training. Users calling support asking "the VPN is down" after migration isn't an IT problem — it's a sign that communication of the change has failed. Documentation and communication effort for end users needs to be budgeted for, especially in organizations with non-technical users.

When migration doesn't make sense

For teams with fewer than 20 people and a simple and stable VPN setup — basic split tunnel, few internal services, already paid for hardware — the effort of migrating to Zero Trust is rarely justified by the financial return. The security gain is real, but the implementation cost distributed over few users and the low complexity of the environment make the ROI negative over a two to three year horizon.

Migration is also not justified for organizations with a large number of heavy client applications that require access to specific internal subnets and cannot be refactored to a hostname access model. Legacy ERP systems and engineering tools that access equipment over IP directly continue to require network access that the Zero Trust per-application model cannot replace without significant changes to the application.

The security argument with real financial value

The cost of an incident per compromised VPN credential is the variable that transforms the analysis. VPN grants network access after authentication — stolen credential means unrestricted lateral access to internal network. Zero Trust grants access per application — compromised credentials only reach applications explicitly authorized for that identity, with device posture checking as additional control.

For auditing purposes — SOC 2, ISO 27001, HIPAA — Access logs are qualitatively superior to VPN connection logs. Each event records user, specific application, timestamp, IP, device and decision made. VPN logs record that a connection was established and when it was closed — what happened inside doesn't appear. The difference has a concrete impact on the time and cost of external audits.

What to decide before approving the project

TCO analysis is necessary but not sufficient for the decision to migrate. The most important question is about the current risk profile: how many internal applications with sensitive data are accessible to any user with an active VPN? If the answer is "I don't know exactly what data is accessible via VPN," that in itself is an argument for migrating — not for cost, but for control.

Deployment starts with the two or three applications with the highest data sensitivity and highest risk of exposure. The configuration pattern tested in them — group access policies, session duration, device posture — is replicated for the rest. What the first migrated application generates is not just better security for that service; it is operational evidence that the model works in the context of the organization.