iboss Pricing in 2026: What the Per-User Number Leaves Out

Short answer: iboss sells its cloud SSE per user, per year, in three packages (Core, Advanced and Complete), and its own published price sheet shows the per-seat number is only the starting point. Inline DLP sits only in the top Complete package, and users in "Zone 2" regions add a surcharge priced per gateway, per year. dope.security takes a different route: the gateway runs on the device, so there is no regional gateway to surcharge and no data center detour to pay for.

If you are pricing iboss in 2026, you are probably comparing it against Zscaler, Netskope or a lighter option. Before you do, read our plain-English breakdown of what iboss is and how its containerized cloud gateway works, because the architecture explains the bill. Every iboss tenant runs on iboss gateways in iboss data centers, and that is exactly where the surcharges come from.

This post walks through the documented iboss packaging, the line items buyers miss, how the new free iboss AI Security Platform changes the math, and how the number compares with an on-device secure web gateway like dope.security's Fly-Direct SWG. For the wider market view, our guide to what secure web gateways really cost in 2026 covers the other vendors.

How much does iboss cost?

iboss does not publish a price list on its own website, and most review sites say "contact sales." The most detailed public document is the iboss Zero Trust Edge pricing sheet filed on the UK G-Cloud 14 marketplace (dated May 3, 2024). It lists annual, per-user list prices in pounds, banded by user count, with a minimum order on each package.

• Zero Trust Core: £16.00 per user per year under 1,000 users (minimum order £5,400 per year), falling to £11.55 at 10,000+ users.
• Zero Trust Advanced: £20.65 per user per year under 1,000 users (minimum order £7,000), falling to £14.90 at 10,000+.
• Zero Trust Complete: £30.00 per user per year under 1,000 users (minimum order £8,700), falling to £21.71 at 10,000+.

Treat these as list prices from a public catalog, not a quote. The same document lists a 20 to 35 percent discount range off MSRP for add-ons, and US pricing is negotiated separately. Capterra currently shows a "starting at $4 per user per month" figure for iboss, which we could not verify against iboss's own materials. The useful part of the G-Cloud sheet is not the headline number. It is the structure underneath it.

What each iboss tier actually includes

The three packages stack. Each one includes everything in the tier below it, plus a new block of capabilities. That matters because the features most mid-market teams buy an SSE for in 2026 (data protection and AI governance) sit near the top of the stack.

Core

Core covers the gateway itself: the unified service edge, encrypted traffic inspection, cloud security controls, proxy rules, DNS security, resource and user catalogs, and cloud connector agents for the major operating systems. It is the web filtering and access foundation.

Advanced

Advanced adds SAML and OIDC integration, zero trust scoring, threat dashboards, malware prevention and sandboxing, phishing protection, Microsoft Defender for Cloud Apps and Sentinel integrations, SIEM log forwarding, and real-time inline CASB. If you need your logs in Splunk or Sentinel, the sheet places that in Advanced, not Core.

Complete

Complete is the first package that lists Inline Data Loss Prevention and Out of Band API CASB. In other words, if your evaluation includes "stop sensitive files from being uploaded" or "scan what is already shared in our SaaS tenants," the documented packaging points you to the most expensive tier. Under 1,000 users, that is nearly double the Core per-seat price.

The line items the per-seat price leaves out

A per-user, per-year price is easy to put in a spreadsheet. The iboss sheet lists several charges that sit next to it, and each one changes the total for a real mid-market rollout.

• Regional gateway surcharge: £6,500 per gateway, per year, for "Zone 2" countries, which the sheet defines as LATAM, Africa, Asia, Oceania and Eastern Europe. It also notes "additional surcharges will apply for high cost regions" and lists China, Taiwan, India, South Korea, Hong Kong, Colombia and Argentina as excluded from that zone.
• Data center location: the prices "assume that services will be delivered to customers in data centers located within Europe," and "are subject to increase" for hosting outside Europe.
• Reporting: the sheet's header states that reporting, "which is required for functionality, is not included in the Zero Trust Package licensing cost and is sold separately." The package descriptions also mention reporting, so confirm in writing what your quote includes.
• Implementation: a Quick Start package (up to 8 remote engineer hours) at £1,900, a Standard package (up to 40 hours) at £9,500, and custom work at £275 per hour with a four-hour minimum.
• Mission Critical 24x7 support: optional, at 15 percent of total contract value (minimum £795 per year).

None of this is hidden. It is in iboss's own filing. It is just easy to miss when a sales deck leads with a per-user number. If you run a distributed team with people in Singapore, São Paulo or Warsaw, ask for the Zone 2 math before you compare anything else.

Why gateways create the surcharge, and the latency that comes with it

The surcharge is not arbitrary. It is the cost of the cloud gateway model. iboss, like Zscaler and Netskope, inspects traffic in its own data centers, so every user needs a nearby gateway to send traffic to. iboss describes a dedicated, containerized gateway per tenant across 100+ points of presence. Standing those gateways up in more expensive regions costs iboss more, and the price sheet passes that through.

The same architecture shows up in performance. When inspection happens in a data center, each web request detours from the laptop to the gateway, out to the destination, and back. Industry measurements put that cloud-proxy detour at roughly 40 to 80 ms when users sit close to a point of presence and 150 to 400 ms when they do not. The users who trigger a Zone 2 surcharge are often the same users who feel the longest detour.

See the detour for yourself. Run a live latency test and compare a cloud-proxy round trip with on-device inspection that flies direct. Learn more about how the Fly-Direct SWG inspects traffic on the endpoint, or book a 20-minute dope.security demo to see it on your own network.

Takeaway: a regional gateway surcharge is a bill for the detour. Remove the gateway and you remove both.

Does the free iboss AI Security Platform change the price?

Partly, and it is worth giving iboss credit here. In July 2026 iboss launched a free AI Security Platform that it says covers ChatGPT, Copilot, Gemini, Claude and Perplexity in browsers and desktop apps such as Cursor, with prompt and response capture, prompt, upload and paste blocking, detection of personal-account sign-ins, and default-deny for AI agents. For teams that only want AI visibility, "free" is a real price.

The questions to ask are about depth and packaging, not existence. iboss has not published how semantic its AI classification is, and its AI-CASB (announced March 2026) is still young. The G-Cloud packaging also places inline DLP in Complete, so confirm whether blocking a sensitive file upload to an AI tool is part of the free platform or requires the Complete tier. Get that answer in the order form, not the demo.

iboss vs dope.security: pricing and architecture side by side

Here is how the two models compare on the points that drive total cost, line by line.

• Where inspection runs: iboss inspects in containerized gateways in iboss data centers; dope.security inspects SSL on the device and sends traffic straight to the internet.
• Regional pricing: iboss lists a £6,500 per-gateway annual surcharge for Zone 2 regions plus high-cost-region surcharges; dope.security has no customer gateways, so there is nothing regional to surcharge.
• China and restricted regions: iboss excludes China and several other markets from its Zone 2 pricing, and reviewers report China connectivity weakness; dope.security works in China without a paid uplift because traffic never backhauls through a foreign data center.
• Data protection: iboss lists inline DLP only in the Complete package; dope.security offers Dopamine DLP, which reads uploads by meaning with an LLM (zero data retention, US Patent 12,464,023) and needs no regex rules to get value on day one.
• AI governance: iboss offers a free AI Security Platform with undisclosed semantic depth; dope.security combines Shadow IT and AI discovery, SWG policy and Cloud Application Control to allow enterprise ChatGPT and Claude while blocking personal accounts on the same domain.
• Agent footprint: customers report a weak iboss macOS agent as a migration driver; the dope.security agent is Mac native and Windows, under 100 MB of RAM.
• Trial and pricing transparency: iboss pricing is quote-based in the US; dope.security publishes its packaging and lets you start the SWG free via Google or Microsoft SSO.

To be fair to iboss: its per-seat list prices are competitive with the big cloud proxies, and a free AI visibility product is a smart move. The question is whether you want to keep paying for gateways at all.

How to build a fair iboss cost comparison

Most SSE price comparisons fail because buyers compare one vendor's headline seat price with another vendor's fully loaded quote. Use the same five lines for every vendor on your shortlist.

• The tier that actually includes what you need. If DLP is a requirement, price iboss Complete, not Core.
• Every region your people work in. Count gateways and surcharges for each Zone 2 country and confirm the policy for excluded markets.
• Reporting and log forwarding. Confirm both are in the quote, and which tier carries SIEM integration.
• Deployment cost. Add implementation packages and your own team's hours. Outreach Health secured 99 percent of its devices with dope.security within one week, which is a useful benchmark for internal effort.
• Support. Price 24x7 support explicitly; on iboss it is listed as an optional 15 percent uplift.

Deployment lift is a real line item. A Fortune 100 company scaled dope.security from 900 to more than 18,000 devices in weeks, silently via Intune, with no reconfiguration between trial and production. Fewer engineer hours is money you never see on a price sheet.

Who should still shortlist iboss?

iboss is a reasonable fit if your users sit mostly in Europe or North America near its gateways, you already need its zero trust resource access features, and you are comfortable with a quote-based purchase. Its per-tenant containerized design is a genuine architectural choice, and some security teams value that isolation.

If your workforce is remote, global or Mac-heavy, or if DLP and AI governance are core requirements rather than nice-to-haves, the economics tilt. You are paying for the top tier plus regional gateways to solve a problem that disappears when inspection moves to the endpoint. Our roundup of iboss alternatives covers the other options if you want a wider shortlist.

The bottom line on iboss pricing

The real price of iboss is the Complete tier plus every gateway your geography demands, not the Core seat price on the first slide. A gateway-free, on-device SWG removes the regional surcharge and the detour that justifies it, which is why dope.security leads our shortlist for distributed mid-market teams. Start dope.security free or book a demo and price both models with the same five lines.

Frequently Asked Questions

Is iboss pricing per user?

Yes. iboss's published G-Cloud price sheet lists annual subscriptions priced per user, per year, banded by user count, with a minimum order on each package. Regional gateway surcharges, implementation and premium support are priced separately. dope.security has no gateways, so it carries no per-gateway regional fees.

What is the difference between iboss Core, Advanced and Complete?

Core covers the gateway, encrypted traffic inspection, DNS security and cloud connector agents. Advanced adds SAML and OIDC, threat protection and sandboxing, SIEM forwarding and inline CASB. Complete is the first package that lists inline DLP and out-of-band API CASB.

Does iboss charge more for users outside Europe and North America?

The published sheet lists a £6,500 per-gateway annual surcharge for Zone 2 regions, defined as LATAM, Africa, Asia, Oceania and Eastern Europe, and notes extra surcharges for high-cost regions. It also says prices assume European data centers and may increase for other hosting locations. dope.security inspects on the device, so it has no regional gateways to surcharge.

Does iboss work in China?

iboss's price sheet excludes China, Taiwan, India, South Korea, Hong Kong, Colombia and Argentina from Zone 2 pricing, and some reviewers report China connectivity issues. Confirm China coverage and pricing directly with iboss. dope.security works in China without a paid uplift because traffic does not backhaul to a foreign data center.

Is the iboss AI Security Platform really free?

iboss announced the AI Security Platform as free in July 2026, covering major AI apps in browsers and some desktop apps. Ask whether blocking sensitive uploads to AI tools is included or requires the Complete tier's inline DLP. dope.security pairs AI discovery and tenant control with Dopamine DLP in one agent and one console.

What is a cheaper alternative to iboss for a distributed team?

For remote and global teams, an on-device SWG usually costs less in total because there are no regional gateways or backhaul to pay for. dope.security runs SSL inspection, URL filtering, Cloud Application Control and Dopamine DLP on the endpoint, and you can start the SWG free through Google or Microsoft SSO.