VPN Cost per User/Device: When Per-Seat Pricing Gets Expensive
Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.
Many modern business VPN and ZTNA tools feel cheap at first: quick setup, SSO/policies, "easy" remote access. The problem: The bill scales linearly with your people and devices – and that's where it gets painful for businesses fast.
💡 Managed NetBird by WZ-IT - your own instance, unlimited users, hosted in Germany. No per-user fees. View the managed offering →
In this post you'll get:
- A simple calculation model (break-even)
- Price anchors for common providers (with sources)
- Typical cost traps (gateways, add-ons, policies/SSO)
- A checklist for when a fixed-price model makes sense
More resources:
- → VPN Hub: All business VPN comparisons
- → Managed NetBird by WZ-IT
- NetBird vs. Tailscale: Self-hosted vs. cloud
- NetBird vs. Twingate: Zero Trust alternative
Note: Prices and plans change. All figures are snapshots; use the sources below to verify.
TL;DR — When Does Flatrate Beat "Per Seat"? Rule of thumb: Break-even Seats = individual monthly proposal price / price per user and month (plus add-ons/gateways)
WZ-IT does not publish a blanket list price for this service. Sizing, locations, routing, SSO, high availability and service level determine the specific proposal.
Add-ons (relays, gateways, higher tiers for SSO/policies) can shift the break-even point significantly forward.
Table of Contents
- The Core Problem: VPN Costs Rise with Growth
- Quick Calculator: When Does a Fixed Price Pay Off?
- Price Reality: What Do Tailscale, Twingate, ZeroTier Cost?
- The 5 Most Common Cost Traps
- What's the Alternative?
- Decision Guide: When Does a Flat Model Make Sense?
The Core Problem: VPN Costs Rise with Growth
Per-user/per-seat/per-device models have a logic: providers earn with growth. For you that often means:
- New employees → more licenses
- More devices (laptop + phone + test device) → more licenses
- More locations/networks → more add-ons
- More security/SSO → higher tier
With Twingate, for example, business plans are clearly priced per user (monthly or annually) and increase with user count.
With Tailscale, the business/premium tier is also priced per active user/month (e.g., $18 in Premium plan).
Quick Calculator: When Does a Fixed Price Pay Off?
You only need:
- U = Number of users (or seats)
- P = Price per user/month
- F = Fixed price/month (your flat model)
- Optional: Gateway/add-ons per month
Cost per month (per-seat):
Cost = U × P (+ add-ons)
Break-even user count:
U_break_even = F / P
Break-even Examples
Tailscale Premium ($18/user): Break-even users = individual monthly proposal price / 18
Twingate Business ($10/user, annual): Break-even users = individual monthly proposal price / 10
Add-ons, relays, and gateways can shift the break-even point forward – in practice, many teams reach the tipping point sooner than expected.
Price Reality: What Do Tailscale, Twingate, ZeroTier Cost?
Tailscale (per-seat model)
| Plan | Price | Basis | Source |
|---|---|---|---|
| Premium | $18/month | per active user | tailscale.com/pricing |
Twingate (per-seat model)
| Plan | Price (annual) | Price (monthly) | Source |
|---|---|---|---|
| Business | $10/user/month | $12/user/month | twingate.com/pricing |
ZeroTier (plan + device-based)
ZeroTier is not per-seat, but plan- and device-based: Each plan includes a certain number of devices, additional devices cost extra. This looks cheap initially but also scales noticeably with many endpoints.
| Plan | Base Price | Incl. Devices | Extra Devices | Source |
|---|---|---|---|---|
| Essential | $18/month | 10 | $2/device/month | zerotier.com/pricing |
| Scale | $179/month | 100 | $1.80/device/month | zerotier.com/pricing |
Quick Comparison: 25 / 50 / 100 Users (License Costs)
Assumptions:
- Tailscale: $18/active user/month
- Twingate: $10/user/month (annual billing)
- WZ-IT: individual proposal based on architecture and operating scope
| Team Size | Tailscale (per-seat) | Twingate (per-seat) | WZ-IT (Flatrate) |
|---|---|---|---|
| 25 Users | $450/month | $250/month | on request |
| 50 Users | $900/month | $500/month | on request |
| 100 Users | $1,800/month | $1,000/month | on request |
ZeroTier Note: ZeroTier is plan + device-based (included devices + cost per additional device). For a fair comparison, estimate devices, not seats (e.g., laptop + smartphone = 2 devices/user).
Want to check the break-even with your real numbers? → Enterprise VPN Flatrate with Managed NetBird
The 5 Most Common Cost Traps
1. SSO/Policies Only in Higher Tiers
With many tools, "Business" is only where SSO, policies, provisioning etc. actually work properly. The cheap entry price often doesn't include these features.
2. Additional Infrastructure Components
With many ZTNA/VPN providers, additional components are required depending on architecture (relays, gateways, connectors). As soon as traffic doesn't run purely P2P, you need this infrastructure – which can increase costs or become a bottleneck.
3. More Devices per User = More Costs
Some providers limit devices per user or tier indirectly. Laptop + smartphone + tablet = 3 devices, but sometimes only 2 allowed.
4. Compliance: Where Are Control Plane & Metadata?
For EU/DACH decision-makers, "where does it run" is a real purchase criterion, not just "nice to have". US cloud hosting can be a deal-breaker.
5. Ops Effort Stays with You
Even "SaaS" doesn't automatically mean: no operational work. Policies, rollouts, IdP integration, routing, troubleshooting stay with your team.
What's the Alternative?
If you want predictable costs, there are two paths:
A) Self-hosted: Infrastructure Costs Instead of License Costs
NetBird can be self-hosted or cloud-hosted. Both share core functionality (mesh/WireGuard), while the cloud variant offers additional business features for automation/auditing (e.g., IdP provisioning, event streaming, EDR integrations).
Self-hosted pros:
- No per-seat license costs
- Full data sovereignty
- Unlimited users/devices
Self-hosted also means:
- Operations, updates, and backups are your responsibility
- Certain automation/audit features are primarily in the cloud variant
B) Managed Flatrate: Fixed Price + Operations Outsourced
For many companies the sweet spot: flat price, but without your team having to play "VPN ops".
What you get:
- Dedicated instance (no shared SaaS)
- Hosting in Germany (or USA, UAE, EU of your choice)
- Updates, monitoring, support included
- Fixed price, regardless of user count
Decision Guide: When Does a Flat Model Make Sense?
A fixed-price/managed model often makes sense when:
- ✅ Your user- or device-based costs are already increasing noticeably
- ✅ You really need SSO/policies (not "somehow")
- ✅ You have EU/DE hosting / data sovereignty as a requirement
- ✅ You're hybrid (cloud + on-prem + sites)
- ✅ You don't want VPN costs to increase with every hire
Quick Check: Per-Seat vs. Flatrate
| Criterion | Per-Seat | Flatrate |
|---|---|---|
| Small, stable team | ✅ Can be cheaper | ⚠️ Check economics |
| Growing team | ⚠️ Costs increase linearly | ✅ Predictable proposal |
| Many devices/sites | ⚠️ Check add-ons and limits | ✅ Sized by infrastructure |
| Growth planned | ❌ Costs increase | ✅ Costs fixed |
| GDPR/Compliance | ⚠️ Check required | ✅ DE/EU/US/UAE hosting available |
30-Second Check: Is Per-Seat Pricing Already a Problem for You?
If you answer 3+ questions with "Yes", comparing flatrate vs. per-seat is worth it:
- ☐ Your number of users, devices or locations is growing
- ☐ You need SSO + policies (not just "basic VPN")
- ☐ Devices per user are increasing (laptop + phone + …)
- ☐ EU/DE hosting / data residency is relevant (GDPR/compliance)
- ☐ You don't want VPN ops in-house (monitoring, updates, routing support)
3+ times "Yes"? → Schedule a free consultation
Conclusion
Per-seat pricing for VPN/ZTNA tools can work for small teams, but quickly becomes a cost trap as an organization grows. Once users, devices or locations regularly increase, it is worth comparing the current bill with an individually sized flat-rate model.
The combination of self-hosted NetBird (open source, no license costs) or managed flatrate (fixed price, no ops effort) offers a real alternative to the per-seat models from Tailscale, Twingate and others.
Our Services
We help you with decision and implementation:
- Cost analysis: Compare your current VPN costs vs. alternatives
- Migration: Gradual switch without downtime
- Managed Service: We operate NetBird for you – you just connect your devices
More VPN Comparisons
- NetBird vs. Tailscale – Self-hosted vs. cloud
- NetBird vs. Twingate – Zero Trust approaches
- NetBird vs. ZeroTier – WireGuard vs. proprietary
- NetBird vs. Enclave – Open source vs. closed
→ All VPN comparisons in the Hub
Sources
- Tailscale Pricing
- Twingate Pricing
- ZeroTier Pricing
- NetBird Documentation
- Self-hosted vs. Cloud-hosted NetBird
NetBird is a product of NetBird GmbH. Tailscale, Twingate, and ZeroTier are registered trademarks of their respective owners. Prices subject to change, as of December 2024.
What does your VPN really cost?
We calculate licensing, devices, add-ons and operational effort for your actual user count. You receive a comparable cost baseline for cloud VPN, self-hosting and a managed fixed-price service.
Frequently Asked Questions
Answers to important questions about this topic
No. For very small teams (e.g., 3–10 users) it can be ok. Beyond a certain size, it often becomes more expensive than a fixed price.
That depends on the individual operations proposal, the number of users and devices, and the required integrations. The comparison formula is: monthly proposal price divided by the current cost per user or device. WZ-IT quotes the VPN flat rate based on architecture and operating scope.
Tailscale Premium costs $18/user/month. With 50 users, that's $900/month.
Twingate Business costs $10/user/month (annual) or $12/user/month (monthly).
ZeroTier is plan- and device-based (not per-seat). The Essential plan costs $18/month incl. 10 devices, additional devices $2/month. Scale costs $179/month incl. 100 devices.
Yes. The typical path is parallel operation + gradual rollout (pilot → groups → routes → cutover). No big bang needed.
Written by
Timo Wevelsiep
Co-Founder & CEO
Co-Founder of WZ-IT. Specialized in cloud infrastructure, open-source platforms and managed services for SMEs and enterprise clients worldwide.
LinkedInLet's Talk About Your Idea
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Arrange a callback
Companies worldwide trust WZ-IT
