Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
3-year total migration cost
$356,360
Year 1 cost (buildout)
$236,000
Year 2 cost (expansion)
$70,800
Year 3 cost (maturity)
$49,560
3-year cost per user
$445
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter users to cover.
- 2Enter applications/services to segment.
- 3Enter identity/mfa cost per user (year 1).
- 4Enter device trust cost per user (year 1).
- 5Enter network segmentation cost per app (year 1).
- 6Enter ztna/app-proxy cost per user (year 1).
- 7Read your 3-year total migration cost on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
Zero-trust migration is a multi-year program, not a product purchase, and vendors selling a single 'zero-trust' box tend to understate the identity, device management, and network segmentation work that actually makes the model function. This calculator breaks estimated cost into four workstreams that map to how most real migrations are scoped: identity and access (SSO, conditional access, MFA everywhere), device trust (endpoint posture checking, MDM coverage), network micro-segmentation (moving off flat VLANs to per-application or per-service access policies), and application proxy/ZTNA replacing VPN. Each workstream scales roughly with user count or application count rather than being a flat fee, and the model applies a phasing discount because year-2 and year-3 work builds on year-1 identity foundations and costs less per unit than the initial buildout. Use it for multi-year budget planning conversations, not vendor quote replacement.
Worked example
Using the values the calculator loads with:
Inputs
- Users to cover: 800
- Applications/services to segment: 40
- Identity/MFA cost per user (year 1): 60
- Device trust cost per user (year 1): 45
- Network segmentation cost per app (year 1): 3000
- ZTNA/app-proxy cost per user (year 1): 40
Results
- 3-year total migration cost: $356,360
- Year 1 cost (buildout): $236,000
- Year 2 cost (expansion): $70,800
- Year 3 cost (maturity): $49,560
- 3-year cost per user: $445
What each field means
Inputs
- Users to cover
- The users to cover used in the calculation. Starts at 800 so you have a working example on load.
- Applications/services to segment
- The applications/services to segment used in the calculation. Starts at 40 so you have a working example on load.
- Identity/MFA cost per user (year 1)
- The identity/mfa cost per user (year 1) used in the calculation. Starts at 60 so you have a working example on load.
- Device trust cost per user (year 1)
- The device trust cost per user (year 1) used in the calculation. Starts at 45 so you have a working example on load.
- Network segmentation cost per app (year 1)
- The network segmentation cost per app (year 1) used in the calculation. Starts at 3000 so you have a working example on load.
- ZTNA/app-proxy cost per user (year 1)
- The ztna/app-proxy cost per user (year 1) used in the calculation. Starts at 40 so you have a working example on load.
Results
- 3-year total migration cost
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Year 1 cost (buildout)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Year 2 cost (expansion)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Year 3 cost (maturity)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- 3-year cost per user
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why is year 1 so much more expensive than years 2-3?
Year 1 builds the identity foundation (SSO, conditional access policies, MFA enrollment) and device management baseline that everything else depends on, which is mostly one-time integration and rollout work. Years 2-3 extend that foundation to more applications and refine policies, which is incremental work on existing infrastructure rather than a fresh build.
What's the single most common reason zero-trust projects stall?
Trying to segment the network or applications before identity and device trust are solid, which creates access friction and outages that erode organizational support for the whole program. Sequencing matters more than most vendors' marketing suggests; identity first, then device, then network, then application-level enforcement.
Do I need to replace my VPN entirely?
Most mature zero-trust programs replace VPN with ZTNA (per-application access with continuous verification) rather than broad network-level access, since VPN grants network-level trust once connected which defeats the zero-trust principle of least-privilege, per-request verification.
How do I scope 'apps to segment' realistically?
Start with your crown-jewel and compliance-in-scope applications (financial systems, customer data stores, source code repos) rather than trying to segment every internal tool in year one; a phased app list of 20-40 for a mid-size company is typical for the first 12-18 months.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
SOC 2 Audit Cost Calculator
Estimate first-year SOC 2 Type II cost including prep, auditor fees, and tooling.
MFA Rollout ROI Calculator
Weigh MFA deployment cost against the account-takeover losses it prevents.
Third-Party SaaS Sprawl Risk Cost Calculator
Estimate exposure and cleanup cost from unmanaged, unreviewed SaaS applications.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Zero-Trust Migration Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/zero-trust-migration-cost
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/zero-trust-migration-cost" target="_blank" rel="noopener">Zero-Trust Migration Cost Calculator — RevenueLab</a> (2026).</p>
Source: [Zero-Trust Migration Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/zero-trust-migration-cost) (2026).