Am I missing something or has the pricing of ZA has at least doubled?

[fvnet]

Hello, setting up OPNsense for a small company of accountants, about 35-40 employees, a couple of servers, 3 printers etc. So, about 45-50 active hosts in network everyday (not counting their wifi connected phones, they are completely in another isolated VLAN which I don't care).
I notified boss that he has to expect about yearly 800-900$ for ZA NGFW subscription which (my fault there) is legacy now and has been replaced with Unified Secure  $2,040.00 billed annually for 40 users. They mention something about one user license covering two devices so even with 20 user licenses $1,020.00 billed annually.

Am I missing something here??

[sy]

Hi There,

Please submit a ticket via the "Have Feedback" option in the bottom-left corner of the UI. Our sales team will then reach out to you to discuss pricing details.

[Greg_E]

You are not wrong, waiting for a quote to be returned because what was once $1000usd turned into $4000usd. It's almost like they are going to kill the OPNsense plugin and push you to set up a dedicated server. It might be better performance, but it absolutely prices places like my work out of being possible.

[mb]

Hi everyone, Murat here, founder of Zenarmor. I want to respond to this thread directly.

We read these forums, and we read every message. I'd rather address the concerns here openly than let people guess at our intentions. There are a few separate things tangled together in this thread, so let me take them one at a time.

1. The OPNsense plugin is not going anywhere.

Let me be direct: we are not killing the OPNsense plugin. It is actively being developed and maintained, it continues to receive new features and engine updates, and OPNsense is and will remain a primary platform for Zenarmor. It remains a product we invest in.

2. The Business Next-Gen Firewall plan still exists.

The Business NGFW plan remains available for purchase and renewal; it's just not on the pricing web page, since we're actively promoting unified plans (See below for why we are promoting unified network security). Having said that, if you log into Zenconsole and try to purchase a subscription, you'll see it offered as an option, and our FAQ says the same. Reach out to us or your partner if it's all you need.

3. What we're actually building, and why the plans changed shape.

The plan restructuring makes more sense once you see what we're trying to do as a product company, so let me clarify:

Nobody works 100% from the office anymore. The same employee is on the office LAN in the morning, a café Wi-Fi at lunch, and their home network in the evening; and they expect everything to just work from all three. Meanwhile some of your workloads have moved to several dozen cloud VPCs. The network you're responsible for is no longer in one place; it's wherever your users and assets happen to be at the moment.

The traditional way to secure that is a separate product for each piece: a firewall for the office, a VPN or ZTNA product for remote users, something else for cloud egress, and then you spend your time making them agree with each other: separate policies, separate logs,etc etc. For a large enterprise with a security team, that's an annoyance. For a small company where one person runs all of IT, it's the reason the laptop on café Wi-Fi usually just goes unprotected... not because anyone decided that, but because the stack to cover it was too expensive and too much work to operate.

Our answer is unified network security that deploys anywhere, instantly.

Unified means the functions are one product: NGFW, web and content filtering, TLS inspection, IDS/IPS, CASB, secure web gateway, zero-trust network access, mesh VPN, one engine doing all of it under one policy and one console.

Deploys-anywhere means that one engine runs wherever your network is: on your OPNsense gateway at the office, in a cloud VPC in front of your workloads, on the laptop that's at a café right now. Same software, same policies, all locations.. so covering a new place is a deployment step done in minutes. One security fabric across the office, the cloud, and everywhere your people actually work.

Our enterprise plans — SSE, ZTNA, SASE — were our first answer to this, and they're priced very competitively against other products in that category. But as those plans got traction, we kept hearing the same thing from partners and smaller businesses: the architecture is right, now make it affordable on a small-company budget.

That feedback is where the Unified plans came from. This decision is the output of a year of those conversations.

And to my knowledge, no other vendor offers this at a small-business entry point. The single-vendor SASE products this architecture competes with aren't built to be bought small: for example, FortiSASE's standard minimum order is 50 user licenses and the cloud-SASE vendors typically come with minimum annual commitments that start where a small company's entire IT budget ends.

The Unified plans are that same exact architecture, priced as one product: small company can justify. A per-user subscription that covers the gateway, the cloud deployments, and the endpoint agents together; because to us those aren't three products, they're three places the same software runs.

For instance, one of our partners was evaluating Fortinet for gateway security plus Tailscale for connectivity; they deployed Zenarmor (on OPNsense on the gw) instead because Unified Secure Plus cost about the same as Tailscale alone and covered both.

That's the product and that's what we want to achieve. And we're not the only ones who think this architecture is where the market is heading  (e.g., EMA named Zenarmor a Vendor to Watch in its 2026 SASE report & Zenarmor earning several awards throughout the year).

4. On the pricing math.

With Unified Secure, we're not actually increasing prices. When we built the original NGFW device tiers, we priced them on an assumption of roughly 2.5 devices per user.. and that ratio included the non-user devices (IoT, printers, etc.) on a typical network, because under the old plan everything with an IP/MAC counted toward your tier: workstations, but also printers, cameras, and IoT. So a "50-device" plan was, in our planning, a ~20-user plan carrying its share of IoT overhead.

The entry NGFW tier was $50/month for 25 devices; Unified Secure starts at the same $50/month for 10 users. Same money. What changed is the unit, and the unit change is an improvement in most use-cases: we stopped billing non-user devices entirely. One license covers two actual user devices, and a device only counts as a user device if it generates real traffic through Zenarmor, i.e. 3,000+ sessions on at least two days in a month. Printers, cameras, switches, and quiet servers fall below that and are simply not charged.

Where the two plans start to land apart is at the margins. A very lean network like one workstation per person, almost nothing else on the wire,  comes out $120–220/yr higher on Unified Secure than on the old 50-device tier, roughly a dollar per license per month. I won't pretend that's zero. But that dollar buys things the NGFW plan never had at any price: mesh VPN and zero-trust access, desktop endpoint agents that cover your people when they work off-network, centralized reporting and management. A mesh-VPN product alone typically costs more per user than the entire Unified Secure plan.

Additionally, under Unified plans you no longer pay extra for the HA gateway: every Unified site license now includes two gateway keys, active and passive, so an HA pair costs the same as a single gateway. Under NGFW pricing, an HA pair meant paying roughly 40% extra for the second node. If you run HA, that change alone typically outweighs the per-license delta.

But again: if this is not what you want, the Business NGFW plan is still here.

5. On being "the cheapest."

I want to be honest about this rather than tell everyone what they want to hear. Our goal is not to be the cheapest option on the market. if you're comparing us with free, open-source blocklists, we will never win that comparison, and those are also different tools solving different problems. Our goal is to be the best unified network security solution at the best possible price for what it does. For some people here, a free stack, or even our free edition is genuinely the right answer, and that's fine. For those who want one integrated engine instead of maintaining and correlating multiple disparate utilities, the value we provide is hard to beat... and the NGFW plan remains there for everyone in between.

Thanks for caring enough to post about this. It beats silence.