Cloudflare Zero Trust vs Tailscale vs Twingate: Real Zero-Trust Network Access Cost for 1,000 Users in 2026
Prices checked: October 2, 2026.
DIRECT ANSWER
Short answer
For 1,000 users:
| Product | Monthly | Yearly | Label |
|---|---|---|---|
| Cloudflare Zero Trust, Pay-as-you-go | $7,000 | $84,000 | OFFICIAL rate ($7/user/month) |
| Tailscale Standard | $8,000 | $96,000 | OFFICIAL rate |
| Tailscale Premium | $18,000 | $216,000 | OFFICIAL rate |
| Twingate | No self-serve plan at 1,000 users; Enterprise is custom | — | QUOTE-ONLY |
All figures are ILLUSTRATIVE.
All three bill per user, not per device or per gigabyte. At 1,000 seats, the list-price gap between Cloudflare's $7 and Tailscale Premium's $18 is $132,000 a year. Twingate's self-serve Business plan stops at 500 users, so a 1,000-person company has to negotiate.
Native billing units
| Product | Billed on | Rate | Limits | Label |
|---|---|---|---|---|
| Cloudflare Zero Trust Free | Users | $0 | Up to 50 users; 24-hour dashboard activity logging | REPORTED |
| Cloudflare Zero Trust Pay-as-you-go | Users | $7/user/month | Contract plan for premium support | OFFICIAL |
| Cloudflare Zero Trust Contract | Custom | Custom | — | QUOTE-ONLY |
| Tailscale Personal | Users | Free | Up to 6 users; 50 tagged resources (+$1/month each) | OFFICIAL |
| Tailscale Standard | Users (seats, reusable within a billing period) | $8/user/month | Unlimited users and user devices; 1,000 ephemeral-resource minutes/month | OFFICIAL |
| Tailscale Premium | Users | $18/user/month | 300 ACL groups; JIT access; network flow logs; log streaming; 10,000 ephemeral minutes/month | OFFICIAL |
| Tailscale Enterprise | Custom | Custom | Custom MSAs/SLAs | QUOTE-ONLY |
| Twingate Starter | Users | Free | 5 users, 10 remote networks | OFFICIAL |
| Twingate Teams | Users | $5 monthly / $4.25 annual | Up to 100 users, 20 remote networks | OFFICIAL |
| Twingate Business | Users | $10 monthly / $8.50 annual | Up to 500 users, 100 remote networks, 5 devices per user | OFFICIAL |
| Twingate Enterprise | Custom | Custom | Custom sizes | QUOTE-ONLY |
What 1,000 users costs at each tier (ILLUSTRATIVE)
| Product / tier | Per user | 1,000 users per month | Per year |
|---|---|---|---|
| Twingate Business rate (not sold above 500 users), annual | $8.50 | $8,500 | $102,000 |
| Cloudflare Zero Trust PAYG | $7 | $7,000 | $84,000 |
| Tailscale Standard | $8 | $8,000 | $96,000 |
| Twingate Business rate, monthly | $10 | $10,000 | $120,000 |
| Tailscale Premium | $18 | $18,000 | $216,000 |
Twingate's Business rate is shown only as a reference point for an Enterprise negotiation. At 1,000 users you can't buy Business self-serve.
What you get for the money
| Need | Cloudflare | Tailscale | Twingate |
|---|---|---|---|
| Model | Cloud proxy: Access (ZTNA) + Gateway (secure web gateway) | Mesh VPN (WireGuard), peer-to-peer | Connector-based ZTNA |
| Internet filtering (SWG) included | Yes (Gateway) | No | Not part of the core plans compared here |
| Device limits | No device limit reported | Unlimited user devices | 5 devices per user (Business) |
| Strong at | Replacing VPN + web gateway in one product | Engineer access to servers, SSH, dev environments | Simple remote access to private resources |
Where the cost catches you
- Seat definitions differ. Tailscale counts a user once they first log in or authenticate a device. Seats are reusable within the billing period, which helps with contractors who come and go. Inactive accounts that still log in occasionally keep consuming seats everywhere.
- Tailscale's real cost driver is Premium features. JIT access, flow logs and log streaming sit only in Premium, which is 2.25× Standard. Security teams often need exactly those for audits.
- Tagged resources and ephemeral nodes on Tailscale. Servers and CI runners use tagged resources and ephemeral minutes. Beyond the included allowances, heavy CI fleets can add cost, depending on plan terms.
- Twingate's 500-user ceiling. Growing past 500 forces an Enterprise contract mid-year. Plan the renewal before you hit the cap.
- Cloudflare is cheap per user but wide in scope. The low per-user price assumes you route through Cloudflare's network. Advanced features such as DLP, CASB and browser isolation can carry add-on pricing on contract plans.
- SSO and SCIM requirements. Identity-provider integrations sit in Standard tiers and up. Free tiers aren't viable for a 1,000-person company.
Which one fits
- Lowest per-seat price plus web filtering: Cloudflare Zero Trust.
- Engineering-heavy organization that needs device-to-device and SSH access: Tailscale Standard. Upgrade to Premium only if you need its audit features.
- Simple remote-access replacement for a traditional VPN at large size: Twingate Enterprise. Use its $8.50–$10 Business rate as the opening reference.
Assumptions
- 1,000 active users for the full month; list prices; no negotiated discounts
- Cloudflare, Tailscale and Twingate rates from their official pricing pages
- Excludes connector or relay infrastructure and taxes
Pricing sources
- Cloudflare Zero Trust plans: https://www.cloudflare.com/plans/zero-trust-services/
- Cloudflare Zero Trust Free-plan details (Dec 2025 review): https://controld.com/blog/cloudflare-zero-trust-pricing/
- Tailscale pricing: https://tailscale.com/pricing
- Twingate pricing: https://www.twingate.com/pricing