Zenarmor pricing 2026: what it really costs next to Fortinet, Sophos, WatchGuard, Palo Alto and Meraki

Short answer: according to Zenarmor's official price list, Unified Secure costs $5.00 per user per month and Unified Secure Plus $9.00 per user per month (10–49 users), with lower tier prices from 50 and 100 users. One user licence covers two devices, the first site is included, and prepaying for 1, 3 or 5 years takes 15, 25 or 35 per cent off the list price (status October 2026, excluding VAT, subject to change).

To be straight with you: for a single small office without remote workers, an entry-level Fortinet or Sophos appliance is usually cheaper at list price. Once you factor in home workers and phones, TLS inspection, multiple sites, reuse of existing hardware and the 2026 price increases, the sums change. Against premium stacks such as Palo Alto and enterprise SSE, Zenarmor is significantly cheaper; against Fortinet and Sophos the gap becomes small, and with the partner discount via Secrotec it can disappear altogether.

In this article we, as the official Zenarmor partner in the Netherlands and an independent ISO 27001 Lead Auditor, work through everything transparently: list prices, platform costs, worked examples for 25, 100 and 250 users, a sourced competitor table and a 3-year TCO including the costs that never appear on the first quote. If you would like a product introduction first, read Zenarmor beyond NGFW or see our Firewall & Network Security service.

Zenarmor pricing at a glance

• Unified Secure: $5.00 / $4.50 / $4.00 per user per month for 10–49 / 50–99 / 100–150 users.
• Unified Secure Plus: $9.00 / $8.50 / $8.00 per user per month.
• Minimum 10 users. Above 150 users or 20 sites, Zenarmor provides a custom quote.
• Sites: the first site is included; each additional site costs $50 per month (up to 20 sites).
• Prepayment: 15 per cent off list for 1 year, 25 per cent for 3 years and 35 per cent for 5 years.
• Free trial: 15 days.
• Via Secrotec: partner discount, price always negotiable and invoicing in euros available.

Zenarmor plans and list prices 2026

With release 2.7 (29 September 2026), Zenarmor simplified its business pricing into two per-user editions, Unified Secure and Unified Secure Plus, with SSE, ZTNA and SASE above them on a quote basis (release notes). You therefore pay per user, not per box. Printers, cameras and other IoT devices are not counted, and one licence covers two actively used devices, for example a laptop and a phone.

Plan	List price (USD)	Key contents	Best for
Free	$0	1 user, 1 gateway, community support	Testing and home labs; not for business
Home	$9.99 per month	Personal use, small households	Private use only, not for businesses
Unified Secure	$5.00 / $4.50 / $4.00 per user/month	IPS, DNS deep inspection, application control and web filtering, 5 endpoint and 5 mesh agents, cloud IdP, captive portal, gateway HA, 15-day reporting	Office-centric SMEs
Unified Secure Plus	$9.00 / $8.50 / $8.00 per user/month	Everything in Unified Secure plus 2 agents per user (including phone/tablet), full TLS inspection, mesh VPN, site-to-site up to 20 sites, 30-day reporting	Hybrid working, multiple sites
SSE / ZTNA / SASE	On request	Enterprise features such as CASB action control, 90-day retention, custom data residency	Larger or regulated organisations

Source: zenarmor.com/plans, accessed 7 October 2026; trial and terms of use: Zenarmor editions. USD, excluding VAT, subject to change. On Unified Secure, full TLS inspection is an add-on at $3 per user per month.

Unified Secure, Plus or SSE: which one fits?

Unified Secure is the logical choice when most of your traffic runs through the office. You get the core of a next-generation firewall: intrusion prevention, application control for thousands of apps, category-based web filtering and DNS inspection against tunnelling. With five endpoint and five mesh agents you can also protect a handful of laptops on the move, for example those of management or IT staff.

Unified Secure Plus is built for hybrid working. Every user gets two agents, so laptop and phone follow the same policy at home or on a public hotspot. Full TLS inspection, mesh VPN and site-to-site connectivity between up to twenty sites are included, and reporting data is kept for thirty days. A useful rule of thumb: if you need TLS inspection, Unified Secure plus the add-on costs $8.00 against $9.00 for Plus (10–49 users). For one extra dollar you get agents for everyone, mesh VPN and double the retention.

SSE, ZTNA and SASE are aimed at organisations that want to control not only the network but also the cloud session and data movement, for example blocking uploads to WeTransfer with CASB rules. In the De Hooge Waerder customer story, Zenarmor cites roughly €29,000 per year (list price) for SSE for 235 users, against an enterprise quote of €200,000 per year for ZTNA alone. These are Zenarmor's figures; Secrotec is quoted in that story as an ISO 27001 Lead Auditor and Zenarmor partner. Read more about the approach in our article on SSE, CASB and data leak prevention.

According to Zenarmor, the Home edition is intended exclusively for non-commercial use. For a company, practice or association, Home is therefore not a cheap shortcut.

Partner discount via Secrotec: price always negotiable

You can buy Zenarmor licences through Zenconsole, through the OPNsense interface or through an authorised partner. Secrotec is listed on Zenarmor's partner page (Netherlands, IT Security Service Provider) and delivers licences and projects throughout Europe. What this means for your price:

• Partner discount on the list price. We deliberately do not quote a fixed percentage, because the discount depends on volumes, term, sites and project scope.
• Price always negotiable in Zenarmor projects, particularly if you are switching from another vendor.
• Quote and invoice in euros available, so you know exactly what you will pay up front.
• One party for licence, implementation and audit evidence. We configure Zenarmor so that it produces the evidence an auditor wants to see: policies, logging, segmentation and reports mapped to ISO 27001 Annex A and NIS2 Article 21.

Send us your current renewal quote from Fortinet, Sophos, WatchGuard, Meraki or Palo Alto. We will put a Zenarmor quote with partner discount next to it and tell you honestly which option is cheaper over three years, even if that turns out to be your current solution.

Full details on licensing, delivery and support are on our Zenarmor partner page.

Platform and hardware costs: often zero

Zenarmor is software. It runs as a plugin on OPNsense and pfSense CE, and also on FreeBSD, Ubuntu, Debian, Amazon Linux 2, OpenWRT and Docker (installation documentation). Note that pfSense Plus is no longer supported. Because the licence is per user and not tied to a box, you can reuse existing hardware or a virtual machine.

Platform option	Cost (indicative)	Notes
Existing x86 server or VM (Proxmox, Hyper-V, VMware)	€0 additional hardware	If you have capacity on your hypervisor or a spare server
OPNsense Community Edition	Free (open source)	Standard basis for Zenarmor
OPNsense Business Edition	€149 per year (3 years: €399)	Optional: commercial update stream and OPNcentral
Deciso DEC740 / DEC850 / DEC3852	€978 / €1,648 / €1,898	Ready-made OPNsense appliances; smallest model DEC677 from €598

Sources: OPNsense Business Edition and shop.opnsense.com, shop prices accessed October 2026, indicative.

Which hardware fits depends on the number of active devices and your internet bandwidth, not on the number of users. Zenarmor's hardware guidance gives this indication:

Active devices	WAN bandwidth	Minimum memory
0–50	300 Mbps	1 GB
50–100	500 Mbps	4 GB
100–250	1 Gbps	8 GB
250–1,000	1–2 Gbps	16 GB
2,000+	2–4.5 Gbps	64 GB

If you want local reporting with Elasticsearch, plan for at least 8 GB of RAM and preferably an SSD. For high availability (gateway HA is included in Unified Secure) you need two nodes, so twice the hardware. In the worked examples below we use the DEC740, DEC850 and DEC3852 purely as examples; the final choice is made after sizing. If you prefer to do it yourself, read our guide to installing Zenarmor on OPNsense.

Worked examples: 25, 100 and 250 users

Please note: these are worked examples, not a quote. We use list prices in USD excluding VAT, without partner discount, without additional sites and without implementation. Above 150 users Zenarmor provides a quote, so for 250 users we calculate indicatively with the lowest published tier rate.

Users and plan	Monthly, per year	1 year prepaid	3 years prepaid (total)
25 – Unified Secure	$1,500	$1,275	$3,375
25 – Unified Secure Plus	$2,700	$2,295	$6,075
100 – Unified Secure	$4,800	$4,080	$10,800
100 – Unified Secure Plus	$9,600	$8,160	$21,600
250 – Unified Secure (indicative)	$12,000	$10,200	$27,000
250 – Unified Secure Plus (indicative)	$24,000	$20,400	$54,000

With three years prepaid, Unified Secure works out at $3.75 per user per month (25 users) down to $3.00 (from 100 users); Plus at $6.75 down to $6.00. Each additional site adds $600 per year at list price.

Below are the same scenarios as 3-year totals in euros, with and without new hardware. We use a deliberately conservative conversion rate of 1 USD = €0.90; if you are invoiced in euros via Secrotec, the exact price is stated in your quote.

Scenario (3 years)	Reused hardware or VM	With new Deciso appliance
25 – Unified Secure	≈ €3,038	≈ €4,016 (DEC740)
25 – Unified Secure Plus	≈ €5,468	≈ €6,446 (DEC740)
100 – Unified Secure	≈ €9,720	≈ €11,368 (DEC850)
100 – Unified Secure Plus	≈ €19,440	≈ €21,088 (DEC850)
250 – Unified Secure (indicative)	≈ €24,300	≈ €26,198 (DEC3852)
250 – Unified Secure Plus (indicative)	≈ €48,600	≈ €50,498 (DEC3852)

Three lessons from this table. First, prepaying for three years saves a quarter of the list price and fixes the price for the whole period. Second, hardware is a small part of the total cost with Zenarmor, and zero if you reuse what you have. Third, Plus roughly doubles the licence cost but protects every device of every user, wherever they work. Whether you need that is decided by your risk profile, not by the price list. Optionally add OPNsense Business Edition (€399 per installation for three years).

What do FortiGate, Sophos, WatchGuard, Palo Alto, Check Point and Meraki cost?

To compare fairly, we collected public reseller prices. All prices are indicative, status October 2026, excluding VAT unless stated otherwise; reseller prices vary and your own purchase price may differ. Bundles also differ in content, so price alone does not tell the whole story.

Vendor and model	What you get	Price (indicative)	Source
Fortinet FortiGate 40F	Appliance + 1 year FortiCare and FortiGuard UTP	€1,180	software-express.de
Fortinet FortiGate 60F	Appliance + 1 year FortiCare Premium and UTP	€1,417	software-express.de
FortiGate 60F renewal	UTP bundle 1 year / 3 years	£403 / £1,087	tnp.net.uk
Sophos XGS 88 / 108 / 118 / 128 / 138	Appliance + 1 year Xstream Protection	€817 / €1,249 / €1,811 / €2,532 / €3,552	software-express.de
Sophos XGS 108 / 118 renewal	Xstream Protection 1 year	€536 / €901	as above
WatchGuard Firebox T145	Total Security Suite 1 year (subscription); appliance separate	€1,174 incl. VAT (≈ €987 excl.); appliance ≈ €427 (RRP excl. VAT)	office-partner.de (TSS); shop.allnet.de (appliance)
Palo Alto PA-440	Hardware + annual subscriptions	€2,490 + Threat Prevention €1,190, Advanced URL Filtering €790, WildFire €890, GlobalProtect €590	optinoc.com (Apr 2026)
Check Point Quantum Spark 1575W	Appliance + 1 year SandBlast (SNBT)	$1,808 (US)	pcnation.com
Cisco Meraki MX75	Advanced Security licence + support 1 year	$763 (list $1,661) + hardware	hummingbirdnetworks.com (US)

What stands out: with appliances you pay per box, and the security subscriptions are tied to that box. With Palo Alto you buy the security modules separately, which pushes the annual cost up quickly. Zenarmor charges per user, regardless of the hardware it runs on. Zenarmor also publishes its own comparison with Fortinet, which you can find on Zenarmor's own comparison page.

3-year TCO: the costs that are not on the first quote

You do not buy a firewall for one year, so we compare the total cost of ownership over three years. Assumptions: list prices from the tables above; Zenarmor prepaid for three years; competitors renewed annually; Sophos renewals including the announced 10 per cent increase from 1 November 2026; conversion rates 1 USD = €0.90 and 1 GBP = €1.15; no partner discount, implementation or VAT.

Scenario A: one office, 25 users, no remote workers

Solution	3 years (indicative)	Note
Zenarmor Unified Secure, own hardware/VM	≈ €3,038	No hardware purchase
Zenarmor Unified Secure + Deciso DEC740	≈ €4,016	Hardware stays yours, independent of the licence
Sophos XGS 108 + Xstream Protection	≈ €2,429	€1,249 + 2 × ≈ €590 renewal
FortiGate 60F + UTP	≈ €2,343	€1,417 + 2 × £403 renewal
WatchGuard T145 + Total Security Suite	≈ €3,388	Appliance + 3 × TSS
Cisco Meraki MX75 + Advanced Security	≈ €2,060 + hardware	3 × $763 street price
Palo Alto PA-440 + 4 subscriptions	≈ €12,870	€2,490 + 3 × €3,460

Honest conclusion: for one small office without remote workers, Sophos, Fortinet and (at street price) Meraki are cheaper than Zenarmor at list price. WatchGuard is in the same range as Zenarmor on your own hardware, and Palo Alto is considerably more expensive. If you still choose Zenarmor in this situation, it is for user-centric reporting, freedom from hardware lock-in, a migration without new boxes, or because the partner discount closes the gap.

Break-even point. With three years prepaid, Unified Secure costs about €122 per user over three years (10–49 users), €109 (50–99) or €97 (100–150); Plus about €219, €207 or €194. A Sophos XGS 108 bundle of ≈ €2,429 therefore equals ≈ 20 users, a FortiGate 60F ≈ 19, a WatchGuard T145 ≈ 28 and a Palo Alto PA-440 with four subscriptions ≈ 132 users (Plus: ≈ 62). Below those numbers Zenarmor on your own hardware is cheaper; above them the box wins, as long as one box is enough and you need nothing extra. With a new DEC740 the break-even point for Unified Secure shifts by about eight users.

Scenario B: 100 users, 3 sites, hybrid working

Solution	3 years (indicative)	Note
Zenarmor Unified Secure Plus	≈ €24,636	2 agents per user, full TLS, mesh VPN, site-to-site, 30 days; head office on existing VM, 2 × DEC740
Zenarmor Unified Secure + OPNsense VPN	≈ €14,916	Gateway protection at 3 sites; remote workers via OPNsense WireGuard or IPsec
Sophos XGS 118 + 2 × XGS 108	≈ €8,651	Boxes + Xstream; phone agents and ZTNA not included
Fortinet 3 × FortiGate 60F + UTP	≈ €7,029	Boxes + UTP; ZTNA and endpoint licences not included; model depends on sizing
Palo Alto 3 × PA-440	≈ €35,070	Threat Prevention, URL and WildFire everywhere; GlobalProtect at head office

Here too, Fortinet and Sophos remain cheaper per box as long as you only compare the office gateways. The gap to Zenarmor Unified Secure is ≈ €6,300 to €7,900 over three years, or about €1.75 to €2.20 per user per month. For that you get per-user policies via Entra ID, Google Workspace or Okta, per-user reporting as audit evidence, central management in Zenconsole and no hardware lock-in. Unified Secure Plus costs more, but protects every laptop and phone, including outside the office. If you want the same from an appliance vendor, check whether the bundle covers users outside the office; if not, ask for the price of the separate SASE or ZTNA licence and add it. Against Palo Alto, Zenarmor Plus is ≈ €10,400 cheaper over three years in this scenario.

Scenario C: SSE and ZTNA for 200+ users

The price gap is largest with enterprise SSE and ZTNA. In the De Hooge Waerder story, Zenarmor cites ≈ €29,000 per year for SSE for 235 users, against a quote of €200,000 per year for ZTNA alone. The firm also moved from Hyper-V to Proxmox without buying new hardware (figures and results as reported by Zenarmor and the customer).

Hidden costs you should include

1. Price increases at renewal. Sophos raised XGS hardware and hardware-bound subscriptions by 10 per cent from 1 July 2026 and announced another 10 per cent from 1 November 2026, roughly 21 per cent combined (Avanet, September 2026). For other vendors, include an indexation scenario in your TCO and ask about multi-year price protection. With Zenarmor the price is fixed for the period you prepay.
2. Hardware lock-in and refresh. Appliance subscriptions belong to one box, such as the Meraki licence for the MX75 or the WatchGuard suite for the T145. When the model reaches end of life, or when you switch, you lose both the box and the remaining term. Sophos UTM 9 reached end of life on 30 June 2026 (Avanet), forcing many organisations to replace it. With Zenarmor the licence belongs to the user and you choose the x86 hardware.
3. Remote workers, VPN and ZTNA. With Palo Alto, GlobalProtect costs an extra €590 per year. With other vendors it varies by bundle, so ask explicitly. Zenarmor Unified Secure includes 5 + 5 agents, Plus two per user, and OPNsense provides WireGuard, OpenVPN and IPsec without an extra licence.
4. What happens when the licence expires. With Cisco Meraki, devices stop passing client traffic after a 30-day grace period (Meraki documentation). With Fortinet, firewall and VPN keep working, but signature updates, web filter categories and outbreak prevention stop (Fortinet Community). With Sophos, IPS and application policies are no longer applied (Sophos licensing guide). With Zenarmor the underlying OPNsense firewall keeps working; the paid Zenarmor features require an active subscription.
5. Multiple sites and management. With Zenarmor an extra site costs $50 per month and you manage everything centrally in Zenconsole, including policy import, backup and audit trail (documentation). With other vendors, check whether central management and log storage are licensed separately.
6. Logging and data residency. Retention is 15 days (Unified Secure), 30 days (Plus) or 90 days (SSE), and you can stream to your SIEM or syslog. Since version 2.7 you can keep cloud reporting in the Netherlands or Germany. How to turn that into evidence is covered in Zenarmor reporting for NIS2 and ISO 27001.
7. Implementation and management. Every firewall needs set-up, segmentation and maintenance. Secrotec prices implementation per project, so you know where you stand in advance.

Feature for money: what is included and what costs extra?

Solution	Licence model	Included (per source)	Extra or watch out
Zenarmor Unified Secure	Per user (2 devices)	IPS, application control, web filter, DNS deep inspection, 10 agents, cloud IdP, gateway HA	TLS inspection +$3 per user/month; extra site $50 per month
Zenarmor Unified Secure Plus	Per user	Plus agents for everyone, full TLS, mesh VPN, site-to-site, 30-day reporting	Extra site $50 per month
FortiGate + UTP	Per appliance	FortiCare plus NGFW licence, antivirus, web filtering and antispam, among others	After expiry no new signatures or web filter categories
Sophos XGS + Xstream	Per appliance	Security bundle incl. 24/7 support, updates and advance replacement	Hardware-bound; +10% in July and November 2026
WatchGuard + TSS	Per appliance	Total Security Suite bundle	≈ €987 per year excl. VAT for the T145
Palo Alto PA-440	Per appliance and per module	Base firewall	Threat Prevention, URL, WildFire and GlobalProtect separate (≈ €3,460 per year together)
Check Point 1575W	Per appliance	SandBlast package: firewall, VPN, application control, IPS, antivirus, threat emulation	Ask for the renewal price separately
Cisco Meraki MX	Licence per appliance	Advanced Security, support and cloud management	No client traffic after 30 days without a valid licence

Sources: see the competitor table above; FortiGate bundle contents per tnp.net.uk, Sophos per software-express.de, Check Point per pcnation.com. Status October 2026.

Honest advice: which model wins when?

An appliance is probably cheaper if:

• you have a single site with more than about 20 users and hardly anyone works from home or on the road;
• you do not need TLS inspection, per-user reporting or protection on phones;
• your current box has years of life left and your renewal falls before a price increase.

Zenarmor is competitive or cheaper if:

• you currently pay for Palo Alto, an enterprise SSE or separate ZTNA licences;
• you can reuse existing servers or a hypervisor and do not want to buy new boxes for every site;
• your staff work hybrid and you want laptop and phone under the same policy;
• your appliance is due for replacement, for example because of Sophos UTM end of life, or your renewal falls after 1 November 2026;
• you want per-user evidence for ISO 27001 or NIS2, for example combined with network segmentation;
• you include the partner discount via Secrotec in the comparison.

Zenarmor helps you demonstrate controls, but it does not make you compliant on its own. That still depends on policy, risk assessment and a working ISMS; we can help there too with an ISO 27001 audit.