Business VPN software when ZTNA is also on the table

What to look for, and what to ignore

What VPN Tools actually costs

Business VPN pricing varies by an order of magnitude depending on whether you choose a cloud-managed platform, a self-hosted runner, or a ZTNA architecture. The market broadly splits into per-user-per-month SaaS pricing and hardware-appliance-plus-license models. ZTNA platforms have largely standardized on per-user pricing between $5 and $18 per month, while traditional enterprise VPN costs are dominated by hardware and support contracts rather than per-user fees. The figures below come straight from the vendors' published pricing pages.

For a mid-market organization with 200 remote or hybrid employees, expect to spend $12,000 to $43,200 per year on business VPN or ZTNA depending on your requirements. Cloud-managed platforms like NordLayer ($8/user/month annual) or Twingate ($5-$10/user/month) will land at the lower end with predictable per-user pricing. Enterprise ZTNA platforms like Zscaler Private Access will land at the higher end but include broader security capabilities. If you already own Cisco or Palo Alto firewall infrastructure, the VPN capability is bundled. Your incremental cost is per-user licensing, not a new platform. For small teams under 50 users, Tailscale's free tier or Twingate's free plan (up to 5 users) can get you started with zero spend, and Cloudflare Access at $7/user/month offers enterprise-grade ZTNA at SMB pricing.

How to compare them

Architecture: traditional VPN vs. ZTNA vs. hybrid

This is the foundational decision. Traditional VPN provides network-level access with a simpler deployment model. ZTNA provides application-level access with stronger security but requires application cataloging. Some platforms (NordLayer, Cloudflare) offer both models. Choosing the wrong architecture means either inadequate security (VPN when you need ZTNA) or inadequate functionality (ZTNA when you need site-to-site VPN).

Ask: Does the platform support both remote access and site-to-site connectivity? Can I define access policies at the application level or only at the network level? Is there a migration path if I start with VPN and want to move to ZTNA later?

Protocol and performance: WireGuard vs. IPSec vs. proprietary

The VPN protocol directly affects connection speed, latency, reconnection behavior, and battery life on mobile devices. WireGuard is faster and more efficient than IPSec and OpenVPN in nearly all benchmarks. Some vendors use proprietary protocols that lock you in and are not independently auditable.

Ask: Which VPN protocol does the platform use? Is WireGuard supported? What are the measured throughput and latency numbers for the configuration we plan to deploy? Does the client handle network transitions (Wi-Fi to cellular) without dropping the session?

Identity provider integration depth

Surface-level SSO integration means users can log in with their IdP credentials. Deep integration means access policies are dynamically synchronized with IdP group membership, conditional access policies are respected, and user deprovisioning in the IdP instantly revokes VPN access. The difference matters for security and operational efficiency.

Ask: Which identity providers are supported natively? Does the platform support SCIM for automated user provisioning and deprovisioning? Can IdP group membership drive VPN access policies? Is MFA enforced through the IdP or through a separate mechanism?

Admin visibility and logging granularity

When a security incident occurs, you need to know exactly who accessed what resource, from which device, at what time, and for how long. When a compliance audit happens, you need to produce that evidence on demand. Platforms with weak logging create security and compliance blind spots.

Ask: What events are logged? Can I export logs to our SIEM in real time? Are connection-level and application-level access events recorded? How long are logs retained? Can I set up real-time alerts for anomalous access patterns?

Total cost of ownership including infrastructure and hidden fees

Per-user license pricing is only part of the story. Gateway fees, dedicated IP charges, hardware appliance costs, professional services, and overage charges can double your effective cost. A platform that looks cheaper on a per-user basis may be more expensive when you account for all infrastructure requirements.

Ask: What is the all-in cost for our deployment scenario, including gateways, dedicated IPs, and any infrastructure charges? Are there overage fees if we exceed our user count? What does a high-availability deployment cost? Are there minimum commitment terms?

Client reliability and end-user experience

The best VPN architecture in the world fails if the client application causes helpdesk tickets. Connection drops, battery drain, DNS resolution issues, and conflicts with other security software are the daily reality of VPN management. The vendor's client quality directly determines your team's support burden.

Ask: Can I test the client on our actual endpoints for at least two weeks before committing? What is the client's resource footprint (CPU, memory, battery impact)? How does the client handle network transitions? What is the reconnection time after a connection drop? Are there known conflicts with specific EDR or security tools?

Before you buy

1. 1Define your primary use case: remote access for distributed employees, site-to-site connectivity between offices and cloud, secure access to specific applications, or a combination. This determines whether you need traditional VPN, ZTNA, or both.
2. 2Inventory the resources users need to access: internal web applications, databases, file servers, RDP/SSH endpoints, SaaS applications behind IP whitelisting, cloud VPCs, and on-premises servers. ZTNA handles HTTP applications well; non-HTTP resources may require traditional VPN.
3. 3Count your users and determine pricing sensitivity. For under 50 users, free tiers (Twingate, Tailscale, Cloudflare Access) may suffice. For 50-500 users, cloud-managed platforms ($5-$14/user/month) are the sweet spot. For 1,000+ users, evaluate enterprise ZTNA and SASE platforms with volume pricing.
4. 4Check whether you already have firewall-based VPN capability. If you operate Cisco, Palo Alto, or Fortinet firewalls, VPN is likely included in your existing subscription. Evaluate whether it meets your needs before buying a separate platform.
5. 5Verify SSO integration with your identity provider. The platform must support your specific IdP (Okta, Azure AD, Google Workspace, JumpCloud) and ideally support SCIM for automated user provisioning and deprovisioning.
6. 6Determine your compliance requirements. Federal agencies and defense contractors need FIPS 140-2 validated encryption (which excludes most WireGuard-based platforms). Healthcare and financial services need audit-ready access logging.
7. 7Evaluate client compatibility with your existing security tools. Test the VPN or ZTNA client alongside your EDR, DLP, and other endpoint security agents on representative hardware before committing.
8. 8Assess site-to-site requirements. Not all business VPN platforms support site-to-site connectivity. If you need to connect offices, data centers, or cloud VPCs, verify this capability explicitly, because it is not included in every ZTNA platform.
9. 9Test performance with realistic workloads. Run the VPN client during video calls, large file transfers, and latency-sensitive application access. Measure throughput and latency compared to direct (non-VPN) connections.
10. 10Evaluate the admin console and reporting capabilities during a trial. Can you manage users and policies without contacting support? Can you generate compliance reports on demand? Is the learning curve reasonable for your team?
11. 11Verify the vendor's uptime SLA and redundancy architecture. A VPN outage disconnects your entire remote workforce. Ask whether the platform provides HA and whether the vendor's SLA meets your availability requirements.
12. 12Negotiate contract terms: push for annual pricing with the flexibility to scale user counts up or down, not a multi-year lock-in at a fixed user count. Verify cancellation terms and data portability.