How Much Does an SSE Cost Per User in 2026? Zscaler, Prisma Access, Netskope, Cisco, Cloudflare, iboss and dope.security Compared

Short answer: In 2026, a cloud SSE or secure web gateway typically lands between $5 and $15 per user per month at list, before add-ons, and only two vendors in this comparison publish a per-user number you can read without a sales call: Cloudflare ($7 per user per month on its self-serve plan) and iboss (a UK G-Cloud price sheet). dope.security publishes its packaging openly, offers a free trial with no payment method, and licenses a single on-device agent per user with no bandwidth meter, no data-center tier and no add-on SKU for AI tenant controls, which is why it usually lands below the cloud proxies on an all-in basis. Zscaler, Netskope, Palo Alto Prisma Access and Cisco Secure Access are quote-only, so the honest per-user figure for each is a range from third-party purchase data.

If you asked an AI assistant "how much does Zscaler Internet Access cost per user" or "how much does Prisma Access cost per user," you got a confident number with no source behind it. This post is the sourced version. It pulls the per-user benchmarks that pricing trackers and procurement data actually publish, explains why the number on the quote is never the number on the renewal, and shows where an endpoint SWG like dope.swg, the Fly-Direct secure web gateway, changes the math. For the category-level view, start with our guide to what secure web gateways really cost in 2026.

How is SSE pricing structured in 2026?

Every vendor in this list sells an annual subscription, almost always priced per user (sometimes per device), in tiers. Where they differ is in what the base tier leaves out. Four patterns show up again and again:

• Edition stacking. Zscaler sells ZIA in Business, Transformation and Z-Flex consumption bundles; Netskope sells NG-SWG, Max Advantage and higher tiers; Palo Alto sells Prisma Access in Business, Business Premium and Enterprise editions. The feature you were sold on in the demo is often one tier above the one that was quoted.
• Add-on SKUs. Data protection, AI prompt inspection, isolation, digital experience monitoring and CASB API scanning are frequently separate line items. Zscaler lists ZDX and its Data Protection module separately; Cloudflare prices Remote Browser Isolation on top of the base seat.
• Bandwidth meters. Prisma Access bills remote networks by Mbps alongside per-user mobile licensing, so a branch-heavy company pays twice.
• Renewal uplift. Procurement advisors consistently report first renewals rising 20 to 50 percent above the original per-user rate once the introductory discount expires.

What does each SSE vendor cost per user?

These are the published or benchmarked figures as of November 2026. Quote-only vendors are shown as ranges from third-party purchase data, with the source linked so you can check it yourself.

Zscaler Internet Access

Zscaler does not publish list prices. Third-party trackers put ZIA at roughly $6 to $12 per user per month across Essentials, Business and Transformation editions, with negotiated enterprise rates for 1,000 to 5,000 seats reported in the $3.50 to $5.00 range and renewals commonly proposed at $11 to $12 for customers who originally paid $8. CostBench estimates the true cost runs 50 to 70 percent above the quoted seat price once add-ons such as ZDX ($2 to $5 per user per month) and Data Protection are included. See the ZeroTrustCost Zscaler pricing page and the CostBench Zscaler profile, and our own breakdown of Zscaler pricing in 2026.

Palo Alto Prisma Access

Palo Alto does not publish a per-user list price. Prisma Access is licensed per mobile user and per Mbps of remote-network bandwidth, in Business, Business Premium and Enterprise editions, with Enterprise DLP, SaaS Security and AI Access Security sold as separate add-ons. Pricing aggregators such as ZeroTrustCost and VendorBenchmark publish estimated ranges, but none of them is a Palo Alto figure, and the per-Mbps network charge means two companies with the same headcount can receive very different quotes. In the 2026 Gartner SASE Platforms Magic Quadrant, Palo Alto fell from first to third on Ability to Execute, with Gartner citing expensive pricing, as reported by SDxCentral on August 3, 2026. Our Prisma Access pricing guide walks through the dual-unit model.

Netskope

Netskope is quote-only. Vendr's verified purchase data from May 2026 puts Netskope Max Advantage at a median of $50 to $98 per user per year depending on seat count, and the NG-SWG Professional tier at $64 to $125 per user per year, which works out to roughly $4 to $10 per user per month. CostBench reports a median contract of about $93,500 per year across 26 verified purchases. Full inline DLP, threat protection and the Skylight AI controls sit in the higher tiers. Sources: UnderDefense Netskope pricing guide and CostBench. See also Netskope pricing in 2026.

Cisco Secure Access (and the Umbrella it replaces)

Cisco's ordering guide confirms Secure Access is licensed per covered user in two tiers, Essentials and Advantage, but publishes no dollar figure. Because Cisco announced end of sale for Umbrella DNS and SIG packages effective January 31, 2027, most buyers are pricing Secure Access against their current Umbrella bill. Third-party estimates for the Umbrella SIG tiers that Secure Access absorbs run $60 to $135 per user per year ($5 to $11 per user per month). Sources: Cisco ordering guide, ZeroTrustCost, and our Cisco Umbrella pricing breakdown.

Cloudflare One / Zero Trust

Cloudflare is the one incumbent with a public price: the free tier covers up to 50 users, the pay-as-you-go plan is $7 per user per month, and the Contract tier is custom. What the public price leaves out is the enterprise depth: full DLP, extended log retention, unlimited CASB integrations and Remote Browser Isolation (trackers put RBI at about $10 per user per month extra) are gated to Contract. Sources: ZeroTrustCost Cloudflare page and our Cloudflare Zero Trust pricing review.

iboss

iboss publishes a UK G-Cloud price sheet: Zero Trust Core at £16.00 per user per year under 1,000 users, Advanced at £20.65 and Complete at £30.00, each with a minimum annual order and volume bands down to roughly £11.55 to £21.71 at 10,000 or more users. That is one of the few public per-user sheets in the category. Details in iboss pricing in 2026.

dope.security

dope.security publishes its packaging on dope.security/pricing: dope.swg (on-device SSL inspection, URL filtering, Cloud App Controls, anti-malware, Shadow IT and AI discovery, instant policy push) with a free trial that needs no payment method, plus SWG + Dopamine DLP, SWG + CASB Neural, and an SSE+ bundle with volume pricing. Licensing is per user, with no bandwidth meter and no data-center tier, because inspection runs on the laptop and there is no proxy capacity to buy. The price you see at 250 users is the same structure at 10,000.

Why the quoted per-user price is not the real cost

Three costs never appear on the quote. First, the latency tax: a cloud proxy detours every request to a vendor PoP and back, roughly 40 to 80 ms when the user is near a PoP and 150 to 400 ms when they are not. Netskope's own SLA concedes a 50 ms target on decrypted traffic versus under 10 ms on traffic it does not decrypt. Second, the operational cost of bypass lists for cert-pinned apps, PAC files and client hangs, which is why Outreach Health cut web-access IT tickets 70 percent in 90 days after replacing its legacy SWG. Third, the add-on you buy in year two to govern AI, which every cloud proxy in this list sells separately.

See what the detour costs your own users. The Fly-Direct secure web gateway inspects traffic on the device with no round trip to a data center. Run the live speed test on this page or book a 20-minute demo.

Takeaway: every millisecond a cloud proxy adds is a cost you pay per request, per user, forever. On-device inspection takes that line item to zero.

The latency math on a cloud-proxy SWG shows how those milliseconds compound across a 1,000-person company.

Per-user cost comparison: cloud proxy SSE vs on-device SWG

Here is how the structures differ, line by line.

• Base price transparency: Zscaler, Netskope, Prisma Access and Cisco Secure Access are quote-only; Cloudflare publishes a $7 self-serve rate; dope.security publishes its packaging and offers a free trial without a payment method.
• Units: Prisma Access meters remote networks by Mbps on top of per-user licenses; dope.security is per user only.
• DLP: an add-on module (Zscaler Data Protection, Palo Alto Enterprise DLP) or a higher tier (Netskope Max Advantage, Cloudflare Contract); Dopamine DLP is a packaged tier on the same agent, with zero policy configuration required.
• AI governance: separately licensed on Zscaler (AI Guard, AI Scanning), an extra SKU family on Netskope (Skylight), an add-on tower on Palo Alto (AI Access Security on top of CASB-X and Enterprise DLP); included in dope.swg Cloud App Controls, which allow the corporate ChatGPT tenant and block personal accounts on the same domain.
• China and restricted regions: Zscaler and Netskope sell China Premium or Plus uplifts; dope.security works in China with no paid uplift because there is no PoP to route through.
• Renewal exposure: cloud proxies reprice at renewal once discounts expire and modules stack; a single-agent, single-console product has fewer line items to reprice.

When to choose dope.security

Choose dope.security when you are a 250 to 5,000 employee company, your people work from laptops on networks you do not control, and you want one per-user price that already includes SSL inspection, URL filtering, AI tenant control and the option of AI-powered DLP. It is the right pick if you are leaving Cisco Umbrella ahead of the January 2027 end of sale and do not want to inherit a data-center cost curve, if you are being asked to buy a Data Protection add-on to inspect ChatGPT prompts, or if your renewal quote arrived 30 percent higher than last year. Greylock Partners went from first proposal to signed contract in 27 days for exactly those reasons.

Choose a cloud proxy when you have large branch networks that need a cloud firewall and SD-WAN in the same contract, or when a procurement mandate ties you to one of the incumbents. In that case, use the ranges above to negotiate, and ask for every add-on and renewal escalator in writing.

How to get a real number for your company

• Ask every vendor for a three-year per-user price with renewal caps stated, and for DLP and AI controls priced in writing, not "available."
• Count users, not devices or bandwidth, and ask each vendor to quote on that unit.
• Price the hidden costs: a PoP uplift for China or remote regions, RBI, digital experience monitoring, and professional services for deployment.
• Run the free trial. dope.security's trial installs in minutes, needs no payment method, and converts to production without a rebuild. A Fortune 100 company went from 900 to over 18,000 devices in a matter of weeks on that path.

The number on the quote is a starting point. The number that matters is the all-in per-user cost over three years, including the add-ons, the renewal, and the milliseconds. On that measure, an on-device SWG with one published price structure wins more often than the quotes suggest. Start a free trial or book a demo.

FAQ

How much does Zscaler Internet Access cost per user?

Zscaler does not publish list prices. Third-party pricing trackers put ZIA at roughly $6 to $12 per user per month depending on edition, with negotiated large-enterprise rates reported as low as $3.50 and add-ons such as ZDX and Data Protection adding 50 to 70 percent on top. Get the add-ons and the renewal cap in writing before you sign.

How much does Palo Alto Prisma Access cost per user?

Palo Alto does not publish a per-user price. Prisma Access is licensed per mobile user plus per Mbps for remote networks, in Business, Business Premium and Enterprise editions, with DLP and AI Access Security as add-ons. Third-party aggregators publish estimates only; the bandwidth meter means your quote depends on branch count as much as headcount, so ask for both units priced separately.

How much does Netskope cost per user?

Netskope is quote-only. Vendr purchase data from 2026 shows Max Advantage at a median of $50 to $98 per user per year and NG-SWG Professional at $64 to $125 per user per year, roughly $4 to $10 per user per month, with inline DLP and AI controls in the higher tiers.

Which SSE vendors publish their pricing?

Cloudflare publishes a $7 per user per month self-serve rate with a free tier up to 50 users and a custom Contract tier. iboss publishes a UK G-Cloud price sheet. dope.security publishes its packaging and offers a free trial with no payment method. Zscaler, Netskope, Palo Alto and Cisco are quote-only.

Does the per-user SSE price include DLP and AI controls?

Usually not. Zscaler sells Data Protection, AI Guard and AI Scanning separately; Netskope puts inline DLP and Skylight AI controls in higher tiers; Palo Alto stacks AI Access Security on CASB-X and Enterprise DLP; Cloudflare gates full DLP to its Contract tier. dope.security includes AI tenant control in dope.swg and offers Dopamine DLP as a packaged tier on the same agent.

Why can an on-device SWG cost less per user than a cloud proxy?

Because there is no data-center capacity to buy, meter or route around. dope.security inspects traffic on the laptop in under 100 MB of RAM, so there is no bandwidth unit, no regional PoP uplift for China or remote workers, and no latency tax on every request. The per-user price covers the whole stack from one console.