The Zscaler renewal playbook: building the entitlement baseline before you commit the term

Zscaler prices ZIA and ZPA per user per year by edition, then co sells them as one blended number, and the 2026 opening proposal defaults to a three year term carrying a 7 to 10 percent annual uplift. Buyers who reconcile the active user baseline and cap the ramp recover 20 to 32 percent.

Prepared by Redress Compliance · June 2026 · Representative Zscaler estate (benchmark scenario, not a quote).

Zscaler prices its platform per user per year, packaged into editions, with the user count rather than the traffic volume driving the bill. You pay for licensed users on each product family, so the committed user count you sign is the cost driver, and the lever is the gap between that commitment and your real, reconciled population.

The platform splits into two priced cores and a set of metered add ons. Zscaler Internet Access is the web and inspection core. Zscaler Private Access replaces remote access for named applications. See the current packaging on the Zscaler products page.

The first non obvious mechanic is the blended single number. Zscaler co sells ZIA and ZPA as one combined per user figure, which hides whether the oversize sits in the inspection seats or the private access seats. Split the quote into its two product lines before you accept any count.

Reported ranges reflect public benchmark sources; Zscaler does not publish list pricing. Benchmark ranges: Redress Compliance advisory engagement file, 2024 to 2025.

Build the baseline on active users, then price the deal on that reconciled number. An entitlement baseline that survives vendor scrutiny ties every licensed seat to a person who actually routes traffic or reaches a private app, not to total headcount pulled from the directory.

The second non obvious mechanic is the directory inflation default. Zscaler quotes sized to the full identity directory count, which sweeps in contractors, service accounts, and departed users who never touch the platform.

In the worked estate the ZIA proposal carries 8,000 users while the reconciled active population is 7,500. The ZPA proposal carries 8,000 while only 6,500 reach a named private application.

Where the user count leaks

• Directory blend: the full identity directory counted as licensed users, including contractors and service accounts.
• Departed users: leavers still carried on the seat count between joiner mover leaver cycles.
• Private app overscope: every employee licensed for ZPA when only a subset reaches a named private application.

Anchor each product to the lowest edition that covers your required controls, then add modules selectively. Zscaler tiers ZIA and ZPA from Business through Transformation, and each step up raises the per user rate across the whole licensed population rather than only the incremental users.

The third non obvious mechanic is the edition uplift on the full base. Moving from Business to Transformation re prices every user, so a control needed by one department drags the rate for all 8,000 seats. Decide the edition on the controls the majority actually need, and license exceptions separately.

Defer ZDX, Data Protection, Cloud Browser Isolation, and Risk360 until a project owns each one. They inflate the base when bought ahead of use, and at renewal they reset toward list because nobody can show the usage that justified the discount.

The fourth non obvious mechanic is the assumed add on line. Zscaler presents these overlays as default lines on the proposal rather than as scoped projects, so they ride into the committed base without a named owner. Strip them back to a separate decision with its own justification.

How should you treat the experience and posture overlays?

Buy ZDX only when a named team consumes the path telemetry monthly. Buy Risk360 only when a board reporting cadence depends on it. Without an owner each overlay is shelfware carrying a renewal cost.

Reconcile the user count first, then anchor each per user rate to a defensible number before you discuss term. Zscaler quotes the opening per user figure high so the discount looks generous, which is why the count has to be settled before the rate conversation starts.

Benchmark ranges: Redress Compliance advisory engagement file, 2024 to 2025.

Match the committed user volume to your rollout curve and cap the annual increase in writing before you agree the term. The default 2026 Zscaler term is three years, and the opening proposal usually commits the entire estate from year one, so you pay for coverage that arrives over time as if it were live at signature.

The fifth non obvious mechanic is the absence of a true down. The committed user floor does not fall when the headcount drops, so an over sized year one commitment is locked for the full term while unused seats are forfeited each year. Negotiate a ramped commit and a true down right before you accept any multi year length.

Convert the negotiated numbers into clauses, because a rate you win in conversation evaporates without a written hold. These five clauses decide whether your Zscaler commitment protects the budget across the full term, and each one closes a gap the opening order form leaves open.

• Per user rate hold: fix the ZIA, ZPA, and ZDX per user rates for the term and the first renewal.
• Uplift cap: limit the annual increase to CPI or below, applied to the committed base.
• Expansion rate lock: set the price for added users so true ups never default to list.
• User true down: the right to reduce the committed floor on headcount or divestiture change.
• Module co terming: align ZIA, ZPA, ZDX, and every overlay to one anniversary date.

The sixth non obvious mechanic is split anniversary dates. When modules renew on separate dates, the buyer never reaches a single moment of full leverage, so co terming every line to one anniversary is itself a negotiated win, not an administrative detail.

Enter the renewal with a documented alternative and a deliberate signing date, because a credible second option is the single strongest source of price pressure you control. Zscaler competes with Palo Alto Prisma Access, Netskope, Cisco, and Cato Networks, and a priced alternative is the only thing that reliably moves the Zscaler number.

Per the Zscaler investor relations disclosures, the company reported fiscal 2025 revenue of about $2.67 billion, up 23 percent year over year, and it continues to push net retention. A vendor defending high retention is sensitive to a reference account testing the market, which is the lever the buyer should hold quietly rather than threaten loudly.

Which alternatives create real pressure?

• Palo Alto Prisma Access: the broad SASE comparator, useful for module by module pricing pressure.
• Netskope: strong on data centric controls, a credible test of the inspection and DLP rate.
• Cisco and Cato: network led comparators that test the private access and connectivity rate.

What side letter language do we use?

We fix the wins outside the order form in a short side letter. It records the per user rate hold, the uplift cap, the expansion rate, the true down trigger, and the single co term date, each as a binding commitment surviving the order form. The side letter is where a verbal concession becomes enforceable.

Most Zscaler tactics are predictable, and each has a clean buyer side counter. The discipline is to recognize the move and respond with a position you prepared before the call, not in it.

The worked estate shows where the 20 to 32 percent recovery comes from. The opening proposal totals $2,000,000 a year across the four lines. Reconciling the user baseline, scoping the modules, anchoring the editions, and capping the ramp brings it to $1,500,000, a recovery of $500,000 or 25 percent.

ZIA: 8,000 users at $9.00 falls to 7,500 at $7.60 per month. ZPA: 8,000 at $6.50 falls to 6,500 at $5.80. ZDX: 8,000 at $2.50 falls to 5,500 at $2.10. Benchmark scenario, not a quote.

Turn the framework into a renewal plan before the forecast hardens into a committed band. The steps are ordered on purpose, because the active user reconciliation earns the right to use every later lever.

1. Pull the identity directory and reconcile the active ZIA and ZPA user counts.
2. Split the blended quote into separate ZIA and ZPA product lines.
3. Set the edition for the majority on Business, scope Transformation to need.
4. Defer ZDX, Data Protection, Isolation, and Risk360 to scoped, owned projects.
5. Anchor the per user rates to the negotiated band before discussing term.
6. Build a ramped commitment against a documented rollout plan with a true down.
7. Price a credible alternative and hold it as a written walk position.
8. Fix the five clauses in a side letter and time the signature into fiscal Q4.