The deals shaped before the first quote outperformed the deals fought after it, because buyers who start at the quote negotiate inside an envelope the seller drew
Architecture chooses the shortlist. Competition chooses the winner. Each stage of the sequence sets the ceiling for the next.
Prepared by Redress Compliance · August 19, 2026 · Secure service edge procurements advised. 12 to 18 files, 2024 to 2025.
Executive summary
A genuine two vendor evaluation settled 15 to 25 percent lower than single vendor negotiations, across roughly 12 to 18 secure service edge procurements and renewals advised in 2024 to 2025.
Identity and seat hygiene before quoting cut the licensed base by 8 to 15 percent at no negotiating cost at all.
Phased module adoption with written price holds avoided the shelfware that platform day one deals carried.
The sequence is architecture, hygiene, competition, then commercial terms. Each stage sets the ceiling for the next, and stage one decides most of the spend.
What does the procurement sequence look like?
Architecture, hygiene, competition, then commercial terms, in that order. Each stage sets the ceiling for the next.
Buyers who start at the quote negotiate inside an envelope the seller drew.
The four stages
- Define the target architecture and the modules it genuinely requires.
- Reconcile identities and seats against active headcount.
- Run a scoped competitive evaluation with at least one credible rival.
- Negotiate structure: term, caps, true down, and staged module pricing.
The platform scope described on the products page is broad enough that stage one decides most of the spend.
How do you scope the deal to what you will deploy?
Scope the order to the modules with funded deployment plans, and take written price holds on the rest.
The platform pitch will push the full edition, and undeployed modules renew at full rate forever. The deployment plan is the scoping document.
Scoping questions that save money
- Which traffic flows move first? Internet security and private access rarely cut over together.
- Who owns each module? A module without a named owner is shelfware with a start date.
- What does the network save? Circuit and appliance retirement fund part of the business case.
Document the savings side too. Appliance retirement and bandwidth changes make the internal case honest and the vendor case negotiable.
- Your quote benchmarked against real closed secure service edge deals
- Renewal cap, true down and seat definition language flagged with replacements
- The licensed base modelled against active headcount before the first quote
How do you keep competitive tension alive?
Run two vendors to a scoped pilot and keep both live until the order form is final. Settled outcomes in our file ran 15 to 25 percent better with genuine competition.
The market gives you credible rivals at every layer, including Netskope and Cloudflare.
| Need | The incumbent offer | Credible rivals |
|---|---|---|
| Internet security | Secure web gateway | Netskope, Palo Alto |
| Private app access | Zero trust access | Palo Alto, Cloudflare |
| Experience monitoring | Digital experience | Point tools, built in telemetry |
| Data protection | Add on modules | Access broker and loss prevention incumbents |
The pilot is the proof
A two week scoped pilot with measured outcomes converts a pricing conversation into an architecture conversation, which is the one you win.
Paper benchmarks alone rarely move a strategic seller.
Which commercial terms decide total cost?
Four, and they live in your order form rather than in the vendor's standard paper. The subscription agreement frames the relationship, but these four decide the number.
- Renewal cap: a written ceiling on the uplift, the cheapest insurance available at signature.
- True down right: annual seat reduction aligned to workforce reality.
- Staged pricing: price holds on deferred modules, so later adoption is not a new negotiation.
- Seat definition: active employees, not directory entries. The definition decides the count.
Read the last one twice. Seat hygiene cut the licensed base 8 to 15 percent at no negotiating cost, and the definition is what makes that cut stick.
The Zscaler procurement brief
The four stage sequence, the scoping questions, and the four order form terms that decide total cost.
Get the brief →What 12 to 18 SSE procurements showed
Across the secure service edge procurements and renewals advised in 2024 to 2025, the deals shaped before the first quote outperformed the deals fought after it.
The three patterns that recurred
- Buyers who ran a genuine two vendor evaluation settled 15 to 25 percent below single vendor negotiations.
- Phased module adoption with written price holds avoided the shelfware that platform day one deals carried.
- Identity and seat hygiene before quoting cut the licensed base by 8 to 15 percent at no negotiating cost.
The third is the one worth repeating. It is the only lever on this page that costs nothing and requires no counterparty agreement.
Research briefingTiming and structuring the dealWhere the fiscal calendar, the module staging and the renewal cap meet inside a secure service edge agreement.
Where the common advice on SSE procurement is wrong
The standard advice is to pick the platform first and negotiate price second, because architecture fit matters more than commercial terms. We disagree with the sequencing.
In roughly 10 of the procurements advised, buyers who carried two architecturally acceptable vendors into commercial negotiation beat single vendor buyers by 15 to 25 percent, with identical deployment outcomes.
Qualify two platforms honestly, pilot both, and let the order forms compete.
Architecture chooses the shortlist. Competition chooses the winner. The procurement sequence decides the envelope before any seller discount is discussed.
Against single vendor negotiations, with identical deployment outcomes.
Achieved before quoting, at no negotiating cost.
Buyers carrying two acceptable vendors into commercial talks.
Neighbouring security negotiations sit in the Zscaler negotiation guide, Palo Alto licensing, and CrowdStrike Falcon.
Your first five moves
- Define the target architecture and the modules it genuinely requires, because stage one decides most of the spend.
- Reconcile identities and seats against active headcount, which cut the licensed base 8 to 15 percent at no cost.
- Qualify two architecturally acceptable platforms and run both to a scoped two week pilot with measured outcomes.
- Keep both vendors live until the order form is final, since that is what produced the 15 to 25 percent gap.
- Write the renewal cap, true down right, staged module pricing and seat definition into the order form rather than accepting standard paper.
Frequently asked questions
What is the right procurement sequence?
Architecture, hygiene, competition, then commercial terms. Each stage sets the ceiling for the next, and starting at the quote forfeits all of it.
How much does real competition move the price?
Between 15 and 25 percent against single vendor negotiations, with identical deployment outcomes in the procurements advised.
What does seat hygiene achieve?
It cut the licensed base by 8 to 15 percent before quoting, at no negotiating cost and without needing the vendor to agree to anything.
How should the order be scoped?
To the modules with funded deployment plans, with written price holds on the rest. The deployment plan is the scoping document.
What happens to undeployed modules?
They renew at full rate forever. A module without a named owner is shelfware with a start date attached.
Why does a pilot beat a benchmark?
Because a scoped two week pilot with measured outcomes converts a pricing conversation into an architecture conversation, which is the one you win.
Which four terms decide total cost?
The renewal cap, the true down right, staged module pricing, and the seat definition. All four live in the order form.
Why does the seat definition matter?
Because it decides the count. Active employees and directory entries are different numbers, and only one of them reflects reality.
Should architecture pick the vendor?
It should pick the shortlist. Competition should pick the winner, which is where the standard sequencing advice goes wrong.
When should price holds be negotiated?
At signature, while competition is live. Caps and true down rights cost little then and cost a great deal later.
