SASE is priced four ways: per user, per site, per unit of bandwidth, or as a stack of modular tiers. For a mid-market organisation the baseline license for a full platform usually lands around $14 to $22 per user per month. The number that actually hits your budget is different. Once onboarding, EU data regions, MFA add-ons, dedicated IPs and bandwidth blocks pile on, the real total cost of ownership on a multi-SKU legacy stack climbs to $33 to $60 or more per user per month. Budget on TCO, not the sticker price, and this guide shows you where the gap comes from.
Key takeaways
- The four models are per-user, per-site, bandwidth-based and modular/tiered. Most hybrid mid-market teams end up on per-user, but the add-ons are where budgets break.
- Year 1 implementation and operational overhead routinely run 30% to 50% above the initial software quote.
- Legacy stacks charge separately for MFA, endpoint management, EU compute regions, dedicated IPs and bandwidth blocks. In one worked 200-user example those add-ons pushed the advertised $9.75 per user per month to a real $33.
- European buyers pay extra for NIS2-grade log retention (adding $4,000 to $8,000 a year), EU data-residency regions (around $11,000 a year on some platforms), and carry EUR/USD currency risk on USD-billed contracts.
- The model that wins on real TCO for an EU mid-market team is a single-vendor, flat-rate, EU-sovereign platform like Jimber, which bundles ZTNA, SWG, FWaaS, EU data residency and compliant log retention into one euro-denominated fee and roughly halves the three-year cost.
The four SASE pricing models
SASE vendors monetise along four dimensions. Each fits a different network shape, and each has a failure mode worth knowing before you sign.
- Per-user / per-seat. A fixed monthly fee per named or active user. It maps cleanly to headcount and suits hybrid and remote-first teams, but it encourages seat hoarding and often carries minimum thresholds of 25 to 100 users that penalise smaller organisations.
- Per-site / per-appliance. A fee per location or SD-WAN gateway, with unlimited users behind it. Cost-effective for branch-heavy retail or manufacturing, but it does not natively cover remote workers without buying secondary remote-access licenses.
- Bandwidth-based. Priced per Mbps or Gbps. It aligns cost with capacity but creates budget volatility, since video conferencing or cloud backup can saturate an allocation and trigger overage fees.
- Module-based / tiered. Separate SKUs or bronze/silver/gold packages. It looks flexible, but essentials like SSL decryption, sandboxing and identity integration are often locked behind premium tiers, so the real cost sits well above the advertised entry price.
| Model | Typical metric | Best fit | Main risk |
|---|---|---|---|
| Per-user / per-seat | $5 to $50+ per user/month | Hybrid, remote-first workforces | High base cost; minimum commitments |
| Per-site / per-appliance | $100 to $600+ per site/month | Branch-heavy retail or manufacturing | No native remote-user support |
| Bandwidth-based | $ per Mbps/month per location | Predictable WAN traffic | Throughput caps and overage fees |
| Module / tiered | Separate SKUs or packages | Basic ZTNA or SWG only | Essential security locked in high tiers |
What the major vendors actually charge in 2026
SASE vendors guard their pricing and route buyers through sales, but partner lists and reseller data reveal baseline ranges. Treat these as starting points; most require a “contact sales” conversation, and rates move.
| Vendor | Model | Per-user monthly (approx.) | Transparency |
|---|---|---|---|
| Zscaler (ZIA + ZPA) | Per-user, annual tiered | $8 to $15 | Contact sales (gov rate cards public) |
| Palo Alto Prisma Access | Per-user + add-on modules | $14 to $22 | Contact sales (up to nine SKUs) |
| Cato Networks | Per-user + per-site bandwidth | $20 to $50 | Contact sales |
| Netskope One | Per-user, named tiers | $12 to $18 (full SASE $40 to $75) | Contact sales (app-seat CASB trap) |
| Fortinet FortiSASE | Per-user, banded tiers | $18 to $21 (real TCO ~$33) | Contact sales (add-on heavy) |
| Cloudflare One | Per-user, tiered | $7 to $12 | Semi-transparent |
| Twingate | Per-user, tiered | $6 to $9 (negotiated) | Fully transparent |
| NordLayer | Per-user, tiered | $11 to $15 (with dedicated IP) | Fully transparent (5-user min) |
| Check Point Harmony SASE | Per-user + per-gateway | $10 to $20 (+ $50/month gateway) | Fully transparent |
Two volume penalties matter to mid-market buyers. Zscaler’s per-user rate drops sharply above 1,000 users: a 999-user ZIA Business deployment runs $100.55 per user annually, while 1,000 users get volume pricing at $65. Netskope licenses most services per user but bills its out-of-band CASB API per app-seat, so a 500-user company securing five SaaS apps buys 2,500 app-seats, multiplying that module fivefold. A 10,000-user enterprise can demand a 53% discount; a 200-user business pays the top list band.
The costs that live below the license line
Procurement teams that compare only the per-user quote miss where budgets actually go. Year 1 overhead regularly exceeds the software quote by 30% to 50%.
- Onboarding and professional services. Certified integrators charge $1,200 to $1,800 per day; a 200-user rollout with branch offices runs roughly $15,000 in Year 1. Enterprise deployments reach $150,000 to $225,000, and Forrester data puts a Prisma Access rollout near $248,000 in installation labour.
- Hardware and PoP surcharges. Branch connectivity needs SD-WAN hardware (Cato Sockets, Prisma ION devices). Region fees stack on top: FortiSASE charges about $11,000 a year to route through dedicated EU PoPs, and Check Point Harmony adds $50 a month per active gateway.
- Security module add-ons. Data loss prevention or experience monitoring can double the base. Moving from Zscaler standard monitoring to ZDX Advanced takes per-user cost from $2 to $3 a month up to $37.50.
- Bandwidth overages. FortiSASE allocates a default 1.5 Mbps per user, so 200 users share a 300 Mbps ceiling. A morning of Teams calls at 1.2 to 1.5 Mbps per session can saturate it, forcing extra 25 Mbps blocks at $1,100 each per year.
- Premium support and renewals. A 24/7 support tier adds 8% to 15%, sometimes 20%, and a standard 10% to 15% renewal uplift in Year 3 quietly compounds an uncapped contract.
A worked 200-user example over three years
The gap between the advertised license and the real bill shows up clearly when you model a mid-market deployment. The comparison below sets a multi-SKU legacy stack (FortiSASE Advanced with the add-ons a compliant deployment needs) against an integrated, flat-rate single-vendor platform.
| Cost component (200 users) | Multi-SKU, 3-year | Integrated flat-rate, 3-year |
|---|---|---|
| Base SASE license | $72,540 | $115,200 |
| MFA, EMS, 180-day log retention | $92,070 | Included |
| EU PoP region + dedicated IPs + bandwidth blocks | $57,970 | Included |
| Professional services (onboarding) | $15,000 | $5,000 |
| 3-year cumulative TCO | $237,580 | $120,200 |
| Average per user/month | ~$33 | ~$16.70 |
The multi-SKU option advertised a license of about $117 per user annually, roughly $9.75 a month. Operational overhead drove the real figure to $33, up 182%. An all-inclusive flat-rate model delivered the same technical capabilities and cut the three-year TCO by nearly half. This is the model Jimber is built on: one flat, euro-denominated license that already includes ZTNA, SWG, FWaaS, SD-WAN, EU data residency and NIS2-grade log retention, with no MFA, region, dedicated-IP or bandwidth add-ons to inflate the bill. For a lean mid-market team that removes both the budget surprises and the integration overhead that make the multi-SKU column so expensive, which is what makes it the stronger structural choice on this comparison. The same logic runs through our FortiSASE pricing breakdown and the case for single-vendor versus multi-vendor SASE.
The European cost factors that catch mid-market teams
European buyers carry cost drivers that US-centric pricing pages rarely surface. NIS2 and DORA demand extended log retention, but standard SASE base tiers include only 7 to 30 days, so meeting the forensic and 24-to-72-hour reporting requirements means buying 180-day-plus retention at $4,000 to $8,000 a year. Keeping inspected data inside the EU for GDPR can trigger regional PoP surcharges of around $11,000 a year on platforms that rent public-cloud PoPs. Egress adds a variable line item: Azure charges about $0.02 per GB for cross-region transfers within Europe and Google Cloud about $0.05, and while the EU Data Act removes switching-related egress fees by 12 January 2027, everyday operational egress remains billable. Most dominant vendors invoice in USD, so a team budgeting €100,000 can see costs swing 5% to 10% on EUR/USD alone, and off-hours support routed through global helpdesks sits awkwardly against NIS2 timelines measured in hours. A native European sovereign platform such as Jimber owns its points of presence and bills in euros, which removes the EU-region surcharge, the currency risk and the off-hours support gap in one move, and it is why a sovereign single-vendor platform lands on the low side of every comparison above.
Frequently asked questions
How much does SASE cost per user?
For mid-market organisations the baseline license for a full platform typically runs $14 to $22 per user per month. On multi-SKU legacy stacks like Fortinet, Palo Alto or Zscaler, the real total cost of ownership regularly reaches $33 to $60 or more per user per month once professional services, dedicated egress IPs, EU compute regions, MFA and bandwidth extensions are added.
Are there minimum user commitments?
Usually, yes. FortiSASE enforces a 50-user minimum, NordLayer a 5-user minimum across its business tiers, and enterprise platforms like Zscaler or Netskope often require 100 users. Organisations below those thresholds either pay a premium flat rate or drop to self-serve tiers that lack advanced security.
What is the Netskope CASB “app-seat” trap?
Netskope licenses most services per user, but its out-of-band CASB API is billed per app-seat, defined as one user times one managed application. A 500-user company securing five SaaS apps buys 2,500 app-seats, multiplying that module’s cost by five.
How does NIS2 affect SASE logging costs?
NIS2 requires continuous threat detection and rapid incident reporting, which means retaining comprehensive logs. Standard SASE base tiers include only 7 to 30 days, so organisations buy 180-day-plus retention to satisfy audits, adding roughly $4,000 to $8,000 a year to a mid-market contract.
Can SASE completely replace on-premises firewalls?
No. SASE shifts where controls run, moving inbound remote-user traffic and outbound web filtering to the cloud layer, but physical branches still need a firewall or router appliance for local site-to-site VPNs, internal segmentation such as separating guest Wi-Fi from printer VLANs, and protecting local infrastructure.
Does SASE save money compared with legacy MPLS?
Yes, substantially, when it replaces MPLS. Legacy MPLS is expensive, with a single 10 Mbps link costing thousands per month and total WAN spend easily exceeding $27,000 a month. Moving to commodity broadband secured by cloud-delivered ZTNA and SD-WAN cuts monthly infrastructure cost by 30% to 50% while improving performance.
How does the EU Data Act change cloud egress and switching fees?
The EU Data Act, fully applicable from September 2025, requires cloud providers to eliminate switching charges, including egress fees, by 12 January 2027. That prohibition targets data transfers during a provider migration. Everyday operational egress, such as routing branch traffic through a SASE proxy, stays billable, so high-egress architectures still face variable costs.
Model the total cost before you sign
The advertised per-user rate is the smallest part of a SASE bill. Build your business case on the full TCO, including onboarding, EU regions, log retention, bandwidth and renewal uplift, and compare a modular stack against a flat-rate single-vendor platform over three years. For a European mid-market team, the option that keeps winning that comparison is a single-vendor, flat-rate, EU-sovereign platform, which is exactly what Jimber delivers: one predictable euro fee with the compliance controls already inside. See Jimber’s flat-rate pricing, or book a demo to map a 200-user quote against your current renewal. For the buying criteria, our SASE buyer’s checklist covers what to ask before you commit.
