SASE Licensing & Pricing Guide

SASE licensing is deliberately confusing — vendors use per-user, per-device, and bandwidth tiers to obscure true costs. Expect $15-45/user/month for full SASE. Watch for hidden costs: DEM often requires a separate license, DLP advanced features are premium tier, and bandwidth overages trigger surprise charges. Always negotiate multi-year commits for 20-30% discounts.

SASE licensing and pricing refers to the commercial models vendors use to charge for cloud-delivered security and networking services, typically structured as per-user, per-device, per-site, or bundled subscriptions with annual or multi-year terms. The honest reality of SASE pricing is that every vendor's published price list is a starting point for negotiation, and the total cost of ownership is typically 30-60% higher than the initial quote once you account for add-on features, premium support, professional services, and overage charges that surface after contract signature. This guide breaks down the pricing models, identifies the hidden costs, and gives you the negotiation leverage to avoid the most common traps.

Pricing models explained

Per-User Licensing

Per-user licensing charges a fixed annual fee for each named user who accesses the SASE platform. This is the most common model for SSE deployments where the primary use case is securing remote and office workers. Per-user pricing typically ranges from $8-30 per user per month depending on the vendor, license tier, and feature bundle. The advantage is predictability: you know your cost based on headcount. The trap is that 'user' definitions vary. Some vendors count every identity in your IdP directory, including service accounts and shared mailboxes. Others count only users who actually authenticate to the SASE agent. Clarify the counting method before signing.

Per-Device Licensing

Per-device licensing charges based on the number of endpoints running the SASE agent. This model penalizes organizations where users have multiple devices: a user with a laptop, tablet, and phone counts as three licenses. Per-device pricing ranges from $5-20 per device per month. Some vendors offer a hybrid model where a single user license covers 2-3 devices. Verify whether headless devices (IoT sensors, printers, conference room systems) that route traffic through the SASE platform require device licenses.

Per-Site Licensing

Per-site licensing is used for SD-WAN and branch connectivity, charging based on the number of sites connected to the SASE fabric. Pricing depends on bandwidth tier and site size, typically ranging from $500-5,000 per site per month. Large hub sites with multiple WAN links and hundreds of users cost more than small branch offices with a single broadband connection. The hidden cost here is bandwidth overage: if your site exceeds the licensed bandwidth tier, you pay premium rates for the excess or the vendor throttles your traffic.

Bundled and Tiered Pricing

Most vendors package SASE features into tiers: a base tier covering SWG and basic ZTNA, a mid tier adding CASB and DLP, and a premium tier including DEM, advanced threat prevention, and sandbox. The challenge is that the features you actually need often span multiple tiers. You might need base-tier SWG plus premium-tier DLP, forcing you into the premium tier and paying for features you will not use. Some vendors allow a la carte add-ons to lower tiers, which can be more cost-effective but creates licensing complexity.

Hidden costs that inflate TCO

Market pricing benchmarks (2026)

SASE pricing data is deliberately opaque — vendors do not publish list prices because every deal is negotiated. The ranges below are compiled from publicly available sources, industry benchmarks, and deployment experience as of early 2026. According to Gartner, enterprises should expect $15 to $40 per user per month for comprehensive SASE solutions encompassing the full SSE stack plus SD-WAN. SSE-only deployments cluster in the $8 to $25 range. These benchmarks give you a sanity check on any vendor quote: if a vendor quotes significantly above these ranges without clear justification (advanced DLP, premium support, global PoP requirements), you have room to negotiate.

Vendor pricing model comparison

Negotiation strategies

First, always negotiate with at least two vendors in active competition. SASE vendors will drop pricing 15-30% when they know a competitor is in the final round. Second, negotiate the three-year TCO, not the year-one price. Vendors often offer a steep year-one discount that increases in years two and three. Get price caps in writing for the full contract term. Third, bundle everything into the initial deal. DEM, premium support, professional services, and training credits are easier to negotiate during the initial purchase than as add-ons after you are already deployed and locked in.

Fourth, challenge the user count. If the vendor counts IdP directory users, push back with 'active user' counting that only bills for users who authenticate to the SASE agent at least once per month. This alone can reduce your license cost by 20-30% if you have seasonal workers, inactive accounts, or a large contractor population. Fifth, negotiate exit terms before you sign. SASE contracts with 12-month notice periods and no data portability provisions trap you into renewal. Push for 90-day termination notice, data export in standard formats, and migration assistance credits if you switch vendors.

TCO modeling template

Build your three-year TCO model with these line items to capture the full cost picture. Sum all categories and compare across vendors using the same assumptions.

• Base license: per-user or per-device fees times your user/device count times 36 months
• Site licensing: per-site fees times your site count times 36 months (if SD-WAN is included)
• Add-on features: DEM, advanced DLP, sandbox, RBI, and any feature not in the base tier
• Support: standard vs. premium tier times 36 months
• Professional services: deployment, migration, policy design, and integration
• Training: vendor certification for your operations team (typically 2-4 people)
• Internal labor: FTE time for deployment, ongoing operations, and policy management
• Log storage: overage charges if log retention exceeds the default included period
• Overage buffer: 10% contingency for user count growth and unplanned add-ons

Sources & further reading

• Gartner, "Market Guide for Single-Vendor SASE" — gartner.com/reviews/market/single-vendor-sase
• Cisco, "Cisco Secure Access Ordering Guide" — cisco.com/c/en/us/products/security/secure-access/ordering-guide
• Fortinet, "FortiSASE Licensing Overview" — fortinet.com/products/sase
• Palo Alto Networks, "Prisma SASE Licensing" — paloaltonetworks.com/sase
• Check Point, "Harmony SASE Pricing" — checkpoint.com/harmony/sase

Vendor pricing estimates 2026

Hidden costs to budget for

• TLS inspection certificate deployment: Budget 2-4 weeks of engineering time for root CA distribution across all managed devices. Unmanaged devices need a separate strategy (clientless ZTNA or RBI).
• Bypass policy maintenance: TLS inspection breaks 5-15% of applications (certificate-pinned apps, financial platforms, healthcare portals). Maintaining bypass lists is an ongoing operational cost.
• Agent deployment and support: Every SSE vendor requires an endpoint agent. Budget 30-60 minutes per device for initial deployment, plus ongoing helpdesk tickets for agent conflicts with EDR/AV software.
• Professional services: Most vendors recommend 40-80 hours of professional services for initial deployment. At $250-400/hour, that's $10K-32K before users touch the platform.
• True-up enforcement: Zscaler and Palo Alto aggressively enforce user count true-ups. If you exceed licensed user counts, expect invoices for the overage at list price within 30-60 days.
• DEM licensing: Basic DEM is increasingly included, but advanced features (synthetic monitoring, ISP-level path analysis, historical trending) often require premium DEM licensing at $2-6/user/month extra.

TCO comparison framework

When comparing SASE TCO, use this framework: (1) Per-user SSE licensing × user count × 36 months, (2) SD-WAN hardware or licensing for all branch sites, (3) Professional services for deployment, (4) Internal engineering time for migration (typically 0.5-1.0 FTE for 6 months), (5) Ongoing operational overhead (policy tuning, bypass list management, agent updates), (6) DEM and advanced feature add-on licensing. The per-user price is only 40-60% of total three-year cost — hidden costs account for the rest.

For a 5,000-user organization with 20 branch offices, three-year TCO ranges from roughly $180K (Cloudflare, minimal deployment) to $550K+ (Palo Alto with full SASE, professional services, and premium DEM). The median across all vendors is approximately $300K-400K for three years.

Related on sase.cloud

One email per publish. Unsubscribe anytime.