How MSPs Bundle and Price SASE for Small Business Clients
Short answer: the most affordable way for an MSP to offer SASE or ZTNA to small clients is a per-seat monthly bundle built on a multi-tenant platform with a low per-client minimum and a shared license pool. Package two or three tiers (for example web protection and firewall, then remote access, then full inspection), price each from your platform cost per seat plus your labor and margin, and run every client from one console so a 10-user client costs you little more than its seats.
What goes into a SASE bundle for a small business?
A client with 5 to 50 users usually needs the same protections as a large company, in a smaller box:
| Component | What it does for the client |
|---|---|
| Web filtering (secure web gateway) | Blocks malicious and unwanted sites and apps, in the office and away |
| Firewall and IPS | Protects the office internet connection and blocks known attacks |
| DNS security | Stops connections to malicious domains early |
| Remote access (mesh VPN or ZTNA) | Staff reach the apps they need from anywhere, without a flat VPN |
| Endpoint agent | Keeps laptops protected off the office network |
| TLS inspection | Lets the filters see inside encrypted traffic; often an add-on |
| Reporting and log retention | Monthly reports for the client; evidence for cyber insurance and audits |
| Your service | Onboarding, policy changes, alert review, support |
How should an MSP package it?
Two or three tiers are easier to sell and run than a custom quote per client:
| Tier | Typical contents | Fits |
|---|---|---|
| Essentials | Web filtering, firewall and IPS, DNS security, endpoint agent, monthly report | Single office, mostly on-site staff |
| Remote | Essentials plus remote access for remote and hybrid staff | Hybrid teams, contractors, cloud apps |
| Advanced | Remote plus full TLS inspection, site-to-site VPN for branches, longer log retention | Several sites, regulated clients |
Keep the tiers the same across clients. Every exception is a policy you have to maintain by hand.
How should an MSP price a SASE bundle?
Price per user per month, built from five numbers:
- Platform cost per seat: what you pay the vendor per user per month.
- Labor: onboarding hours (spread over the contract) plus monthly hours for changes, alerts, and reports.
- Margin: your target on the whole service, not only on the license.
- Term: monthly, annual, or multi-year; longer terms usually earn a discount and lower your risk.
- Minimums: the vendor's per-client minimum and any minimum spend, which set your smallest viable client.
Price = (platform cost + labor) ÷ (1 − margin target), divided by the client's users.
Worked example: a 20-user client
Example inputs, not a quote. Replace them with your own costs. Partner pricing is volume-tiered, and Zenarmor's sales team can quote custom pricing for your client base.
| Input | Example value |
|---|---|
| Users | 20 |
| Platform cost | $5.00 per user per month (Zenarmor Unified Secure list price; partner pricing is volume-tiered) |
| Onboarding | 4 hours at $90/hour, spread over a 12-month term |
| Monthly service | 1 hour at $90/hour |
| Margin target | 35% |
| Monthly cost | Amount |
|---|---|
| Platform: 20 × $5.00 | $100 |
| Onboarding: 4 × $90 ÷ 12 | $30 |
| Service: 1 × $90 | $90 |
| Total cost | $220 |
| Price at a 35% margin: $220 ÷ 0.65 | about $338 a month, or about $17 per user |
What moves the number most is labor, not the license. A platform that takes 15 minutes a month per client instead of an hour cuts the cost here by about a third.
What keeps small clients profitable?
- A low per-client minimum. If the vendor needs 25 or 50 seats per client, a 10-user client costs you seats it doesn't use.
- A shared license pool. Seats you can move between clients as they grow, shrink, or leave, without a new contract each time.
- One multi-tenant console. Every client in one view, isolated from each other, so client number 40 isn't another login. See What is multi-tenant firewall management?
- No hardware to ship. Software on the client's existing firewall, a VM, or laptops saves a truck roll per client.
- Co-branding. The client buys your service, so your name should be on the reports.
- Standard tiers. The fewer custom policies, the less labor per client.
How Zenarmor fits
Zenarmor is built for this model. An MSP can allocate as few as 5 seats to a client from a shared seat pool and move seats between clients, with volume-tiered pricing, sold monthly, annually, or multi-year. Zenconsole is multi-tenant from the control plane out and shows every client network in one view, with each customer's policy, data, and visibility kept separate. Delivery can be co-branded, and partners earn up to 40% margin. Partner capabilities need a minimum spend of $250 a month on Business plans.
On the client side, Unified Secure starts at $5.00 per user per month for NGFW, web filtering, IPS, and DNS inspection, with 5 endpoint agents and 5 mesh VPN agents; full TLS inspection is a $3 per user add-on. Unified Secure Plus starts at $9.00 per user per month and adds full TLS inspection, 2 device agents per user, and mesh VPN for every user with site-to-site connections for up to 20 sites. Annual billing saves 15%, and prepaid terms take 15% off list for 1 year, 25% for 3, and 35% for 5. ZTNA, SSE, and SASE are Enterprise tiers quoted by sales. These are published list prices; for an MSP practice, Zenarmor's sales team can quote custom pricing. See Zenarmor for MSPs, plans, or How MSPs should choose a SASE platform.
FAQ
What is the most affordable way for an MSP to offer SASE or ZTNA to SMB clients? Sell a per-seat monthly bundle on a multi-tenant platform with a low per-client minimum and a shared license pool, and run every client from one console. That keeps each small client's cost close to its seats plus a little labor.
What should a SASE bundle for a small business include? Web filtering, firewall and IPS, DNS security, an endpoint agent, and monthly reporting as a base; remote access (VPN or ZTNA) for remote staff; TLS inspection, site-to-site VPN, and longer log retention for clients that need more.
How do MSPs price SASE? Per user per month: platform cost plus onboarding and monthly labor, divided by one minus your margin target, then by the number of users. Offer a discount for annual or multi-year terms.
What's the smallest client an MSP can serve profitably? It depends on the vendor's per-client minimum and your labor per client. With a 5-seat minimum and one console for all clients, even very small clients can work. With a 50-seat minimum they rarely do.
Should MSPs sell SASE monthly or annually? Offer both. Monthly is easier for small clients to accept; annual or multi-year terms lower your churn and justify a discount.
Do MSPs need to install hardware for each client? Not necessarily. Some platforms run as software on the client's existing firewall, a virtual machine, or the client's devices, which removes shipping and site visits.