Zero-trust network access · US dollar pricing
Business VPN comparisons: every pairing we can price
Seven of the 24 vendors here publish a per-user price we can compute at ten users in the same currency, which makes exactly 21 head-to-head pairings. Every one of them has a page.
The grid names the cheaper side of each pairing and the gap per user per month at ten users. The vendors run cheapest first, so the cheaper side of any pairing is the one nearer the top of the table; where two of them publish the same figure at ten the cell says “Level” rather than naming a winner. The gap, not the winner, is what the grid is for: it is the difference between two published prices, before tax and before anything either vendor adds.
Every pairing, and the gap
| Firezone | Twingate | UTunnel | GoodAccess | OpenVPN | NordLayer | Tailscale | |
|---|---|---|---|---|---|---|---|
| Firezone $4.16 at ten | — | Firezone by $0.09 | Firezone by $1.84 | Firezone by $2.84 | Firezone by $2.84 | Firezone by $3.84 | Firezone by $3.84 |
| Twingate $4.25 at ten | Firezone by $0.09 | — | Twingate by $1.75 | Twingate by $2.75 | Twingate by $2.75 | Twingate by $3.75 | Twingate by $3.75 |
| UTunnel $6.00 at ten | Firezone by $1.84 | Twingate by $1.75 | — | UTunnel by $1.00 | UTunnel by $1.00 | UTunnel by $2.00 | UTunnel by $2.00 |
| GoodAccess $7.00 at ten | Firezone by $2.84 | Twingate by $2.75 | UTunnel by $1.00 | — | Level both $7.00 | GoodAccess by $1.00 | GoodAccess by $1.00 |
| OpenVPN $7.00 at ten | Firezone by $2.84 | Twingate by $2.75 | UTunnel by $1.00 | Level both $7.00 | — | OpenVPN by $1.00 | OpenVPN by $1.00 |
| NordLayer $8.00 at ten | Firezone by $3.84 | Twingate by $3.75 | UTunnel by $2.00 | GoodAccess by $1.00 | OpenVPN by $1.00 | — | Level both $8.00 |
| Tailscale $8.00 at ten | Firezone by $3.84 | Twingate by $3.75 | UTunnel by $2.00 | GoodAccess by $1.00 | OpenVPN by $1.00 | Level both $8.00 | — |
Scroll sideways on a phone.
How that is worked out
Nothing else is added. Optional add-ons are shown in the tables and left out of every computed figure, and so are taxes, which none of these vendors publishes. Every figure here is a floor. The full method is at Method.
Where team size changes the answer
In three of the 21 pairings the cheaper side at two users is not the cheaper side at ten. A minimum user count or a fixed charge is doing it: both are paid in full by a small team and spread thin by a large one.
- OpenVPN CloudConnexa and UTunnel VPN. At two users OpenVPN CloudConnexa is the cheaper side, $7.00 against $15.00 per user. At ten it is UTunnel VPN, $6.00 against $7.00.
- Tailscale and GoodAccess. At two users Tailscale is the cheaper side, $8.00 against $17.50 per user. At ten it is GoodAccess, $7.00 against $8.00.
- Tailscale and UTunnel VPN. At two users Tailscale is the cheaper side, $8.00 against $15.00 per user. At ten it is UTunnel VPN, $6.00 against $8.00.
The seven compared here, and where the figures come from
Each line is the vendor's cheapest published plan at ten users — the plan every pairing above uses for that vendor. A different plan can win at a different team size, which is what the individual pages show.
- Firezone — $4.16 per user at ten on Team, annual billing. Pricing page. checked 2026-08-21
- Twingate — $4.25 per user at ten on Teams, annual billing. Pricing page. checked 2026-08-21
- UTunnel VPN — $6.00 per user at ten on Basic (Access Gateway), monthly billing. Pricing page. checked 2026-08-21
- GoodAccess — $7.00 per user at ten on Essential, annual billing. Pricing page. checked 2026-08-21
- OpenVPN CloudConnexa — $7.00 per user at ten on Essential, annual billing. Pricing page. checked 2026-09-05
- NordLayer — $8.00 per user at ten on Lite, monthly billing. Pricing page. checked 2026-08-21
- Tailscale — $8.00 per user at ten on Standard, monthly billing. Pricing page. checked 2026-08-21
Why the other 17 vendors have no pairing
A comparison needs two published prices in the same currency that the same formula can run on. Where one is missing we say which one, rather than leaving the vendor out silently.
- ExpressVPN for Teams (Business VPN) publishes a pricing page we could not read a per-user figure from. What it does publish.
- Proton VPN Business (Business VPN) publishes a pricing page we could not read a per-user figure from. What it does publish.
- PureVPN Business (Business VPN) publishes only a “from” figure, which is a floor rather than a price, so the formula will not run on it. What it does publish.
- Surfshark Business (Business VPN) publishes a pricing page we could not read a per-user figure from. What it does publish.
- VyprVPN Business (Business VPN) publishes a flat base fee rather than a rate per user. What it does publish.
- Windscribe ScribeForce (Business VPN) is the only vendor in its category with a per-user price we can compute, so it has no counterpart to be compared with. What it does publish.
- Pritunl (Self-hosted and per-server) is billed per server, so a per-user figure would depend on how many people share the server rather than on the price list. What it does publish.
- ZeroTier (Self-hosted and per-server) is billed per server, so a per-user figure would depend on how many people share the server rather than on the price list. What it does publish.
- Appgate SDP (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- Cato Networks (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- Cisco Secure Access (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- Cloudflare One (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- NetBird (Zero-trust network access) is the only vendor in its category priced in euros, and we do not convert currencies, so there is nothing to set it against. What it does publish.
- Perimeter81 (Zero-trust network access) publishes a pricing page we could not read a per-user figure from. What it does publish.
- SonicWall Cloud Secure Edge (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- Todyl (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
- Zscaler (Zero-trust network access) asks you to contact sales, so there is no figure to compare. What it does publish.
What these comparisons are not
Every pairing here compares published prices and nothing else. It is not a judgment about security, throughput, support or how either product works, and we have not used any of them. Neither figure is an invoice either: taxes are not included and none of these vendors publishes what it will add.
Related
- Every vendor we hold, and which publish a price
- Put your own team size in
- What zero-trust network access costs per user
- How the ordering is produced
Written by Kaz (pen name). Figures are copied from providers' published pricing pages on the dates shown. We have not used these products. Corrections: contact form.