.png)
Frameworks, core principles and top case studies for SaaS pricing, learnt and refined over 28+ years of SaaS-monetization experience.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Procurement Guide How Are Network Security Firewalls & SASE Solutions Priced for Enterprises
Enterprise network security used to be comparatively easy to buy. A company sized a firewall for throughput, purchased an appliance, added threat-protection subscriptions and support, and refreshed the box several years later. SASE has changed the commercial logic. Security now follows users, branches, applications and traffic into a cloud service, so vendors can charge on several dimensions at once.
The difficulty for procurement teams in 2026 is therefore not finding a discount. It is discovering what will actually cause the invoice to grow after signing. Cisco Secure Access is primarily licensed by covered user but also places data-transfer limits behind that user count. FortiSASE starts with user subscriptions yet attaches data-transfer and branch entitlements. Palo Alto Networks prices mobile users separately from branch capacity. Zscaler now describes its subscription pricing as both per-user and metered usage. Cloudflare publishes a clean per-user entry price but moves full enterprise SASE deployments to custom contracts. Netskope says its pricing varies with the scale of the customer's organisation and the products deployed.
Monetizely's position is that enterprises should buy workforce SASE with protected users as the primary meter, while forcing branch capacity, traffic-heavy features and premium services into explicit, pre-priced and capped add-ons. Traditional on-premises firewalls should remain device-and-capacity purchases. The best contract is not the one with the lowest opening rate - it is the one in which secondary meters cannot quietly become the real price.
SASE has become a user-priced service with network-priced exceptions
The split between firewalls and SASE matters because each starts from a different economic unit. Physical firewalls still have real capacity constraints: inspection throughput, concurrent connections, interfaces, redundancy and appliance size determine what must be deployed. Cisco's July 2026 Network Security Ordering Guide, for example, organises Secure Firewall around physical, virtual and containerised products and separately attaches software subscriptions; its high-availability bundles can receive a 50% discount on the second software subscription. Fortinet likewise maintains a portfolio of FortiGate appliance models for different physical and virtual deployments.
SASE reverses the starting point. For a remote employee, the service exists because a person needs secure access to internet, SaaS and private applications. Per-user pricing therefore follows deployment and value more closely than appliance throughput. Branches remain different: a warehouse, retail location or factory pushes shared traffic, making site or bandwidth capacity a more defensible secondary measure. Palo Alto Networks' current Prisma Access model captures the distinction directly - mobile users have licences, while Prisma Access 6.0 offers remote-network site capacities from 25 Mbps to 2.5 Gbps.
That distinction fits Monetizely's 5-Step Pricing Framework. The framework begins with Customer Segmentation, identifying who buys and how use differs; proceeds to Positioning & Packaging, deciding which capabilities belong together; chooses the Pricing Metric, the unit against which the customer pays; sets the actual price and volume curves through Rate-Setting; and finishes with Operationalization, which determines how entitlements, overages, renewals, quotes and true-ups work in practice. The sequence matters here because a sensible user metric can still produce a bad SASE contract if DLP, branch connectivity, isolation or support sit behind unpredictable add-ons. The same sequencing discipline is developed in Monetizing Agentic AI.
Across six leading suppliers, the dominant pattern is already visible. User pricing has won the workforce-security layer, but virtually every provider has retained another way to charge when the customer's network or product scope expands.
| Vendor | Dominant enterprise pricing metric | Secondary meters and boundaries | What procurement should treat as the real unit | Dated primary source |
|---|---|---|---|---|
| Palo Alto Networks - Prisma Access | Mobile-user licences for workforce access | Remote networks can be licensed by site capacity from 25 Mbps to 2.5 Gbps; Palo Alto also tracks unique mobile users for licence enforcement | Protected user for workforce SASE; capacity only for branches | Palo Alto official documentation, accessed 13 Aug 2026. |
| Fortinet - FortiSASE | User subscription, packaged Standard, Advanced and Comprehensive | User bands include 50-499, 500-1,999, 2,000-9,999 and 10,000+; data transfer and branch/location entitlements sit behind the subscription | Protected user, with branch and traffic entitlements written separately | FortiSASE Ordering Guide, 30 Jun 2026. |
| Cisco - Secure Access | Covered user, tiered by quantity and subscription term | Covered-site licences can be mixed into SIA; covered-user traffic is limited to 20 GB per purchased user per month | Covered user, with every non-user limit capped | Cisco Ordering Guide and Offer Description, Jun-Jul 2026. |
| Zscaler | Per-user plus metered usage | Isolation includes 1.5 GB/user/month in the published plan; branch packages run from 200 Mbps to 10 Gbps; other products use system or endpoint counts | Protected user, with metered services carved out explicitly | Zscaler Form 10-Q for quarter ended 30 Apr 2026 and pricing page accessed 13 Aug 2026. |
| Cloudflare - Zero Trust / Cloudflare One | Public PAYG offer at $7/user/month, paid annually; enterprise contract is custom per user | Full-featured SASE and enterprise support move to the contract plan; other Cloudflare services can contain usage elements | Protected user for Zero Trust, with separately negotiated network services | Cloudflare pricing accessed 13 Aug 2026. |
| Netskope - Netskope One | Subscription pricing based on organisation scale and products deployed | Orders can contain user, capacity, data-maintenance and other limits; individual services use defined subscription units | Demand an explicit protected-user baseline rather than accepting product-count pricing as the primary unit | Netskope S-1, 22 Aug 2025, and subscription terms accessed 13 Aug 2026. |
The table points to a procurement rule that is easy to miss during an RFP: SASE may be sold as a per-user service, but it is rarely only a per-user service. The buying team's job is to prevent the secondary dimensions from overwhelming the primary one.
Per-user pricing works because headcount is observable, budgetable and reasonably close to the number of people receiving security. Trouble starts when a contract says "$X per user" while traffic, locations, endpoints or applications determine how much product the customer can actually consume.
Cisco supplies the cleanest current example. Its July 2026 Secure Access Ordering Guide sets price tiers using covered-user count and subscription term. Yet its June 2026 Offer Description also gives SIA and SPA subscriptions an aggregate monthly transfer entitlement equal to covered users multiplied by 20 GB. A 1,000-user deployment therefore receives 20,000 GB per month. A customer buying 5,000 SIA users and 3,000 SPA users receives 100,000 GB because Cisco uses the higher count. If excess use cannot be reduced, Cisco says additional licences may be required.
A buyer can therefore stay flat at 5,000 employees and still increase spend because traffic grows. Video, browser isolation, generative-AI workloads, cloud migration or a newly acquired business can raise network consumption without adding seats. The headline metric and the practical meter have diverged.
Primary sources rarely publish named customer anecdotes saying, "our security bill shocked us". Enterprise contract values are usually confidential. For procurement purposes, the stronger evidence is the documented mechanism that can generate the shock - and the documented pricing reset when a supplier's commercial model itself comes under pressure.
| Named case | Documented figure | Why procurement should care | Source and date |
|---|---|---|---|
| Palo Alto Networks platformisation reset | Palo Alto cut FY2024 billings guidance on 20 Feb 2024 to $10.10bn-$10.20bn, or 10%-11% growth. Its 2024 proxy later reported actual billings growth of 11.0% against a 17.9% performance target. Management's May 2024 earnings call described platformisation arrangements lasting more than three years and, in some cases, three to five years, with deferred charging and occasional free-use periods while customers migrated. | Large platform deals can hide economics inside term length, payment timing and migration concessions. Compare total committed spend, not nominal annual rate. | Palo Alto investor release, proxy and Q3 FY2024 call, Feb-May-Oct 2024. |
| Cisco Secure Access traffic exposure | 20 GB per covered user per month; 5,000 users produce a 100,000 GB monthly pool. Cisco states that unresolved excess usage may require additional licences. | A seat contract can turn into a traffic contract without headcount changing. | Cisco Offer Description, 16 Jun 2026. |
| FortiSASE entitlement exposure | A 100-user subscription provides 25 TB of global data transfer. Each Branch On-Ramp includes 1 Gbps shared bandwidth and up to 2,000 connections, with location limits applying to the service. | Traffic, branch growth and connection density can cause commercial expansion independently of user count. | FortiSASE Ordering Guide, 30 Jun 2026. |
| Zscaler's expansion from seats to metered usage | Zscaler's FY2025 10-K described subscription pricing as primarily per-user; its 2026 filings state pricing is calculated on a per-user and metered-usage basis. Current packages also expose throughput tiers from 200 Mbps to 10 Gbps, while Light User seat counts use unique users over a rolling 90-day period. | Procurement cannot assume yesterday's seat-based price structure will remain tomorrow's renewal structure. | Zscaler FY2025 Form 10-K, 2026 Form 10-Q, pricing page and Light Users terms. |
These are different commercial events, but they reveal the same weakness: unbounded secondary measures transfer forecasting risk from the supplier to the customer.
Cisco deserves credit for recognising that true-ups themselves create friction. Its current Enterprise Agreement advertises "True Forward", under which growth is not billed retroactively, and says the EA is available from $100,000 total contract value. That approach is stronger than a retroactive audit, but procurement should still establish what quantity will be measured, when forward charges begin and whether the new baseline survives into renewal.
The pricing-metric discussion should not be isolated from packaging or operationalisation. A supplier can choose the right primary meter and still make the product expensive to expand.
Consider Cisco. Its covered-user logic is sound, and its July 2026 user bands are transparent: 1-99, 100-499, 500-999, 1,000-4,999, 5,000-9,999, 10,000-24,999 and 25,000 or more. Yet quantities can be added during the subscription and co-terminated, while reductions are allowed at renewal rather than mid-term. A customer that downsizes after a restructuring therefore has less flexibility than one whose headcount grows.
Palo Alto presents the mirror image. Prisma Access now gives branches concrete site capacities from 25 Mbps to 2.5 Gbps, replacing the harder task of estimating one aggregate bandwidth pool for remote networks. That change improves operationalisation because the buyer can associate each branch with a capacity tier. Mobile-user enforcement, however, tracks unique users over a rolling period, so identity hygiene still matters commercially.
The following scorecard focuses on the three parts of the 5-Step Pricing Framework that create the greatest procurement risk: packaging, pricing metric and operationalisation. The grades are Monetizely assessments based on the cited current contract mechanics, not vendor claims.
| Vendor | Packaging | Pricing metric | Operationalisation | Where the model fails for the buyer |
|---|---|---|---|---|
| Palo Alto Networks | B | B+ | B- | Broad platform consolidation can create a large multi-year commitment before all workloads have migrated; the 2024 platformisation disclosures show how free periods and deferred billing can make annual comparisons misleading. |
| Fortinet | B+ | B | B- | Standard, Advanced and Comprehensive packages give buyers recognisable choices, but data-transfer, branch and location entitlements mean the user count is not sufficient to forecast spend. |
| Cisco | B+ | B- | B | Covered-user pricing is intuitive, but the 20 GB/user/month traffic limit adds a second meter; mid-term quantity reductions are also constrained. True Forward improves growth handling but does not remove the underlying limits. |
| Zscaler | B+ | B- | B- | The move to per-user plus metered usage makes the contract harder to model, while rolling 90-day Light User counts and capacity-sized branch packages create additional quantity definitions. |
| Cloudflare | A- | A- | B+ | Public PAYG pricing makes the entry layer unusually legible, but the $7/user/month product is intended for narrower SSE use cases; full-featured SASE and enterprise support move to a custom contract. |
| Netskope | B | C+ | B- | Pricing by organisation scale and products deployed gives the supplier considerable packaging discretion unless the order form defines subscription units and capacity limits tightly. |
Cloudflare comes closest to the commercial direction we favour because it makes the user meter visible. As of 13 August 2026, its Zero Trust PAYG offer is $7 per user per month, paid annually, while the contract plan remains a custom annual price per user for organisations moving towards full SSE or SASE with enterprise support. The limitation is equally important: procurement should not misrepresent $7 as a public enterprise SASE rate. It is a useful price anchor for the user-security layer, not a complete enterprise quote.
Netskope sits at the other end of the transparency spectrum. Its 22 August 2025 S-1 states that subscriptions are generally priced according to the scale of the customer's organisation and products deployed, while its contractual terms permit limits based on user quantity, capacity, data maintenance or other measures set out in the quote and documentation. That can support a sophisticated enterprise configuration, but it makes a clean RFP template essential.
Most enterprise SASE vendors do not publish a complete rate card. Palo Alto Networks, Fortinet, Cisco, Zscaler and Netskope expose licence logic and product limits in primary documentation, but the final enterprise prices are generally obtained through sales or channel quotes. Cloudflare is the useful exception at the narrow-SSE level, publishing its $7 per-user PAYG anchor while reserving the full contract plan for custom pricing.
A responsible TCO model therefore should not invent vendor list prices. We can instead show how a real three-year contract changes once the documented commercial mechanisms - headcount, package expansion, branch capacity and implementation - begin moving.
For a 5,000-user organisation, Cloudflare's public PAYG Zero Trust rate creates a useful lower-scope benchmark: $420,000 a year and $1.26 million over three years at constant headcount. If the organisation rises to 6,000 users in years two and three, the same public rate produces $1.428 million over three years. These figures cover the PAYG user layer described by Cloudflare, not a full enterprise SASE contract.
The normalised scenario below starts with a $1 million year-one enterprise SASE licence quote so procurement teams can see the effect of contract structure without pretending the number belongs to a particular vendor.
| Three-year scenario | Year one | Year two | Year three | Three-year TCO | Increase versus three flat $1m years |
|---|---|---|---|---|---|
| Flat quote with user growth only - user-equivalent quantity rises 10% in Y2 and 20% versus Y1 in Y3 | $1.000m | $1.100m | $1.200m | $3.300m | 10.0% |
| Growth plus package expansion - same quantity growth; selected package cost rises 15% from Y2 | $1.000m | $1.265m | $1.380m | $3.645m | 21.5% |
| Growth, package expansion and branch-capacity change - adds 10% Y1 implementation and a further 10% network-capacity uplift in Y3 | $1.100m | $1.265m | $1.518m | $3.883m | 29.4% |
| Cloudflare public Zero Trust PAYG benchmark - 5,000 users throughout | $0.420m | $0.420m | $0.420m | $1.260m | Not comparable to full enterprise SASE |
| Cloudflare PAYG with 6,000 users from Y2 | $0.420m | $0.504m | $0.504m | $1.428m | 13.3% versus constant-user PAYG |
The modelling makes the procurement point visible: a 10% opening discount on a $1 million quote saves $100,000 in year one, while uncontrolled package and capacity expansion in the example adds $883,000 over a flat three-year baseline. Negotiating the growth rules can matter several times more than negotiating the opening unit price.
The effect becomes more important when a supplier embeds an actual traffic threshold. Cisco's 20 GB per-user monthly limit means a 5,000-seat customer gets a 100 TB monthly aggregate allowance, while FortiSASE's June 2026 documentation ties 100 users to 25 TB of global transfer. Those are materially different entitlement designs even before unit prices enter the discussion.
Procurement teams should therefore stop asking suppliers only, "What is your price per user?" A stronger question is, "Show every condition that can make our three-year invoice change while our covered-user count remains constant."
Before commercial selection, we would require the following items in the bid response:
One meter inventory. Require the supplier to list every counted quantity - users, devices, branches, Mbps or Gbps, data transfer, systems, applications, IPs, connection counts and premium service usage - and identify whether each can trigger an extra charge. This catches structures such as Cisco's user-plus-transfer model, Fortinet's user-plus-entitlement model and Zscaler's per-user-plus-metered-usage model.
One definition for a billable user. Spell out employees, contractors, service accounts, guests, seasonal workers, shared identities and terminated staff. Zscaler's Light Users terms, for example, count unique individual users over a rolling 90-day period, while Palo Alto documentation describes enforcement based on unique mobile users over a rolling measurement window.
Pre-priced capacity bands. Every branch, bandwidth or transfer overage should have a rate card before signature. Palo Alto's 25 Mbps to 2.5 Gbps site capacities provide a natural structure for such planning, while Zscaler's published branch packages range from 200 Mbps to 10 Gbps.
Forward-only true-ups. Expansion should affect future periods rather than recreating past invoices. Cisco explicitly positions True Forward as avoiding retroactive surprise billing in its Enterprise Agreement; buyers should seek the same economic principle regardless of vendor.
A downgrade mechanism. Headcount can fall as well as rise. Cisco's July 2026 Secure Access ordering terms permit additional quantities during the term but reductions at renewal, which shows why downsizing rights should be negotiated rather than assumed.
A single three-year price sheet. The sheet should show year-one licences, growth bands, optional modules, support, professional services, migration credits and renewal pricing. Palo Alto's 2024 platformisation disclosures demonstrate why free-use periods and deferred payments can make nominal ARR or year-one spend poor substitutes for total committed cost.
One synthesis follows from all six requirements: a discount percentage is commercially weak information unless procurement knows what quantity the percentage applies to and how that quantity can change.
The market is converging, but not on one invoice structure. Palo Alto Networks has deliberately separated users from branch capacity. Cisco starts with covered users but overlays traffic. Fortinet starts with users but adds data, branch and location entitlements. Zscaler formally describes both per-user and metered usage. Cloudflare makes the user rate unusually visible before moving larger customers to custom contracts. Netskope leaves greater scope to the quote by tying price to organisation scale and products deployed.
We do not view those structures as equally attractive to an enterprise buyer. Workforce SASE produces value by protecting people wherever they work, so protected users should be the primary meter. A warehouse or manufacturing branch consumes shared network capacity, so a separately priced site or bandwidth tier is legitimate. An on-premises firewall is constrained by hardware and inspection capacity, so device and capacity remain natural there.
What procurement should reject is an unbounded mixture in which users, traffic, sites, modules and support are all capable of repricing the same deployment. A 30% negotiated discount does not repair a contract whose quantity definitions can expand faster than the underlying business.
For 2026 sourcing decisions, Monetizely's position translates into five actions:
Choose the commercial architecture before choosing the vendor. Decide that workforce SASE will be evaluated on a protected-user primary meter and that on-premises firewall infrastructure will be evaluated on device and inspection capacity. Vendors should bid into that structure rather than redefining the unit after proposals arrive.
Run the competitive process on three-year TCO, not year-one ARR. Weight the evaluation towards the amount payable under expected business growth and a high-growth case. A supplier offering a larger initial discount should lose if its package expansion produces a higher three-year bill.
Give commercial predictability its own selection score. Security effectiveness remains non-negotiable, but once technical finalists satisfy the control requirements, predictable pricing should carry meaningful scoring weight. A supplier that can explain the next three years in one spreadsheet has an advantage over one whose price requires several independent usage forecasts.
Use consolidation savings to fund migration, not to justify a larger permanent bundle. Platform vendors naturally want to replace several point products at once. Capture those savings, but do not commit to every adjacent module merely because the first-year bundle appears cheaper.
Treat the renewal model as part of product design. Before final selection, model what happens when users rise, users fall, traffic doubles and another 50 branches are acquired. The vendor whose pricing still makes sense under all four conditions has the stronger enterprise offer.
The procurement objective is therefore not the cheapest firewall or the cheapest SASE seat. Right looks like one primary meter, a small number of justified secondary meters, hard contractual ceilings and enough rate transparency to forecast three years without asking the account executive to reinterpret the order form.
Assumptions
The TCO scenarios are modelling tools rather than vendor quotes. The normalised enterprise example assumes a $1 million year-one licence baseline, 10% quantity growth in year two, 20% growth versus year one in year three, a 15% package uplift where shown, a 10% year-one implementation charge where shown and a 10% year-three network-capacity uplift where shown. Cloudflare calculations use its public $7/user/month, paid annually PAYG rate as accessed on 13 August 2026; Cloudflare states that this plan targets narrower SSE use cases, while full-featured enterprise SASE uses custom contract pricing. Taxes, channel margins, local currency, hardware, circuits, negotiated discounts and customer-specific professional services are excluded.
Footnotes
https://www.amazon.com/Monetizing-Agentic-AI-Handbook-Transformation/dp/B0H7Z13VKJ/
https://www.paloaltonetworks.com/resources/datasheets/prisma-access-licensing-guide
https://docs.paloaltonetworks.com/prisma-access/activation-and-onboarding/your-prisma-access-license
https://docs.paloaltonetworks.com/prisma-access/activation-and-onboarding/your-prisma-access-license/remote-networks-site-based-licensing
https://investors.paloaltonetworks.com/news-releases/news-release-details/palo-alto-networks-reports-fiscal-second-quarter-2024-financial
https://www.sec.gov/Archives/edgar/data/1327567/000130817924000770/panw4345341-def14a.htm
https://investors.paloaltonetworks.com/financial-information/quarterly-results/
https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/og-fortisase.pdf
https://www.cisco.com/c/en/us/products/collateral/security/secure-access/secure-access-sub-og.html
https://www.cisco.com/c/dam/enus/about/doingbusiness/legal/OfferDescriptions/Cisco-Secure-Access-Product-Description.pdf
https://www.sec.gov/Archives/edgar/data/1713683/
https://www.sec.gov/Archives/edgar/data/1713683/000171368326000096/zs-20260430.htm
https://www.zscaler.com/pricing-and-plans
https://www.zscaler.com/legal/light-users-productsheets
https://www.cloudflare.com/plans/zero-trust-services/
https://www.cloudflare.com/sase/products/access/
https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm
https://www.sec.gov/Archives/edgar/data/2063196/000095017025110855/ck0002063196-20250822.htm
https://www.netskope.com/subscription-terms
https://www.sec.gov/Archives/edgar/data/2063196/000119312526135011/ck0002063196-20260131.htm
https://www.cisco.com/site/us/en/buy/enterprise-agreement/index.html
https://www.cisco.com/c/en/us/products/collateral/security/secure-firewall/guide-c07-737902.html