A control you never configured protects nothing and costs full price
Zscaler sells security as a per user subscription stacked into transformation bundles, and the renewal quote rewards the buyer who prices the modules actually deployed rather than the platform story. The evidence that moves the number is not a benchmark, it is 90 days of module level traffic from your own admin portal, tabled before the discount conversation starts.
Prepared by Redress Compliance · August 10, 2026 · Security advisory. Based on 12 to 18 Zscaler renewals and competitive evaluations, 2024 to 2025.
Executive summary
Bundle scope moved more money than the discount rate, and half the reviews found 2 to 4 dead modules.
Zscaler prices per user per year, with the bill driven by which edition bundle you sit on and which modules it includes: internet access security, private access, digital experience monitoring, sandboxing, and data protection each carry their own meter.
The higher the tier, the more modules land in the price whether or not anything is deployed. In roughly half our reviews, estates on transformation bundles were paying for two to four modules with no measured traffic.
Licensed user counts ran 8 to 15 percent above actual active employees. Seat counts drift after layoffs, divestitures, and ordinary attrition, and they drift upward because nobody reconciles them downward.
The reconciliation has to run against HR active headcount rather than the directory, because a directory carries dormant accounts, service identities, and departed staff long after the payroll does.
This single check is the cleanest reduction available at renewal, and it requires no argument about value.
First renewal quotes opened 10 to 20 percent up and settled flat to single digits once usage data was tabled.
The uplift is standard and it is justified by usage growth and platform value, so the counter has to be evidential rather than rhetorical: reprice on active users against HR headcount, pay for deployed modules against a 90 day traffic report, and anchor to market with a competitor quote in writing.
The module audit alone built a 10 to 20 percent reduction case before any discount conversation began.
A tested alternative moves Zscaler more than any internal benchmark, because switching is genuinely possible at renewal boundaries. The security service edge market is competitive and the sellers respect specific anchors.
A scoped proof of concept on an alternative platform beats a quote alone, quoting the access modules separately against the bundle exposes the tier premium, and peer benchmarks by user band give the negotiation a defensible floor.
The lever is credibility rather than hostility: an account team that believes migration is priced and tested finds flexibility a verbal threat never surfaces.
The renewal positions, and the evidence that answers each
| Seller position | Buyer counter | Evidence to bring |
|---|---|---|
| Usage grew, price grows | Reprice on active users | HR headcount against licensed seats |
| The platform tier is best value | Pay for deployed modules | 90 day module traffic report |
| Multi year locks the rate | Only with a renewal cap | Cap language written into the order |
| List prices rose | Anchor to market | Competitor quote in writing |
The module audit is three tests, and each one produces a line in the reduction case rather than an opinion. The traffic test: a module with no transactions in 90 days is a removal candidate, not a renewal line.
The policy test: licensed features sitting on default or empty policies were never operationalized, whatever the deployment plan said at signature.
The seat test: reconcile licensed users against HR active headcount rather than the directory, because the directory keeps dormant and departed identities long after payroll stops.
Run all three before the quote arrives, because the same numbers presented after a price has been anchored do far less work. The wider sourcing view sits in the Zscaler procurement strategy.
The levers that actually move the quote
- Pull 90 days of module level traffic and policy data from the admin portal, because a security product with no transactions is a cost line rather than a control.
- Reconcile licensed users against HR active headcount, not the directory, since seats ran 8 to 15 percent above real headcount across our file.
- Build the unbundled quote, pricing the access modules separately against your tier, which exposes the premium the bundle is charging for capability you do not run.
- Collect one written competitor quote or run a scoped pilot, because a tested alternative moves the number and a verbal threat does not.
- Trade term length only for a written renewal cap and a seat true down right, since without protection the multi year discount is repaid through the uncapped uplift that follows it.
The Zscaler negotiation kit
The module traffic audit, the unbundled pricing model, and the renewal cap language that survives Zscaler's redlines.
Get the white paper →Timing, competition, and what the seller respects
Open the renewal conversation six to nine months out.
Security renewals run on fear of a coverage gap, which is the strongest deadline pressure in enterprise software because the consequence of lapsing is not a licensing dispute but an unprotected estate, and a buyer who starts late has effectively handed that lever to the seller.
Starting early removes it and, just as importantly, leaves enough runway to test an alternative properly rather than gesturing at one.
On competition, the security service edge market is genuinely contested and switching is possible at renewal boundaries, which is why the anchors sellers respect are specific rather than abstract.
A scoped proof of concept on an alternative platform beats a quote on its own, because it converts a claim into an engineering exercise the account team can verify.
Module unbundling does similar work from inside the incumbent quote, since pricing the access modules separately against the bundle tier exposes exactly what the platform premium costs for capability the estate does not run.
Reference pricing by user band gives the whole conversation a defensible floor. None of this requires hostility, and hostility tends to reduce the flexibility available: an account team that believes migration has been priced and tested will find room that no amount of pressure otherwise surfaces.
The standing programme around renewals of this shape sits with Vendor Shield.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Zscaler renewals, 2024 to 2025
The standard advice is to consolidate onto the highest platform tier because bundle economics beat point pricing. We disagree.
In roughly 8 of the 12 plus estates we reviewed, the transformation tier carried modules with zero measured traffic a year after signature, which made the bundle discount an illusion:
How far licensed user counts drifted above actual active employees after layoffs, divestitures, and ordinary attrition.
The case built by module traffic and seat reconciliation alone, before anyone discussed a discount percentage.
Three patterns recurred: estates on transformation bundles paying for two to four modules with no measured traffic in roughly half the reviews, licensed user counts running 8 to 15 percent above actual active employees.
And first renewal quotes opening 10 to 20 percent up then settling flat to single digits once module usage data was tabled.
The buyer side move is to license the modules you deploy, hold an unbundled quote against the tier price, and buy the next module when a deployment plan exists rather than in advance of one. Consolidation is the seller's economics; utilization is yours.
Treat the ranges as negotiation benchmarks rather than promises: your estate sets the baseline, and the file tells you what disciplined buyers achieved against the same vendor playbook.
Your first five moves
- Pull 90 days of module level traffic and policy data from the admin portal, because a module with no transactions in that window is a removal candidate rather than a renewal line.
- Reconcile licensed users against HR active headcount, not the directory, since the directory keeps dormant and departed identities and seats ran 8 to 15 percent high across our file.
- Build the unbundled quote with the access modules priced separately against your tier, so the platform premium for undeployed capability becomes visible and arguable.
- Collect one written competitor quote or run a scoped pilot, because the lever is credibility and a tested alternative moves the number where a verbal threat does not.
- Open the renewal 6 to 9 months early with the audit file on the table, and trade term length only for a written renewal cap and a seat true down right. Vendor Shield runs the audit and the renewal with you.
Frequently asked questions
How is Zscaler licensed?
Per user per year, with cost driven by the edition bundle and which modules it includes. Internet access security, private access, and digital experience monitoring each carry their own meter, stacked into platform tiers, and add ons such as sandboxing and data protection meter separately.
The edition decision, not the discount, sets most of the cost.
Where does shelfware hide in a Zscaler estate?
In bundled modules with no traffic: data protection bought but never configured, digital experience monitoring licensed estate wide but monitored nowhere, sandboxing on a tier above measured need.
In roughly half our reviews, transformation bundle estates were paying for two to four modules with no measured traffic at all.
What uplift should we expect at a Zscaler renewal?
First quotes in our 2024 to 2025 file opened 10 to 20 percent up, justified by usage growth and platform value. With module usage data and a competitor anchor on the table, settled outcomes ran flat to single digits.
The difference is evidence rather than negotiating style, and the module audit alone built a 10 to 20 percent reduction case.
Can we drop unused Zscaler modules at renewal?
Yes. The renewal is the boundary where bundles can be restructured, and a module with no measured traffic in 90 days is a strong removal candidate.
The unbundled quote, pricing the access modules separately against your tier, is the pricing evidence that makes the removal a commercial argument rather than a request.
Why reconcile seats against HR headcount rather than the directory?
Because a directory carries dormant accounts, service identities, and departed staff long after payroll stops, so it always overstates the population. Licensed counts ran 8 to 15 percent above actual active employees across our file after layoffs and divestitures.
Reconciling against HR is the cleanest reduction available and needs no argument about value.
Does Zscaler negotiate against competitive alternatives?
Yes. Security service edge is a competitive market and documented alternatives move quotes, because switching is genuinely possible at renewal boundaries. A tested proof of concept moves them most, since it makes migration credible rather than rhetorical.
The lever is credibility, not hostility, and hostility tends to reduce the flexibility on offer.
Should we sign a multi year Zscaler deal?
Only with a written renewal cap and a seat true down right. Without both, the multi year discount is repaid through the uncapped uplift that follows it, and a seat count locked for three years survives every workforce change you make in that period.
Trade term length for protection rather than for a headline percentage.
How early should a Zscaler renewal start?
Six to nine months before expiry. Security renewals trade on coverage gap fear, which is the strongest deadline pressure in enterprise software, and starting late hands that lever to the seller.
Opening early removes it and leaves enough runway to test an alternative properly rather than gesturing at one late in the process.
