Top 10 Sales KPIs for Zero Trust Network Access (ZTNA) Vendors in 2027

1. ZTNA VPN-Replacement Conversion Rate

VPN-replacement conversion rate ranks first because it is the only ZTNA metric that simultaneously reflects product experience, onboarding execution, and the budget logic funding the contract. Define it as the percentage of pre-deployment remote-access seats whose legacy path has been decommissioned, not disabled or deprioritized, measured 18 months after go-live. Above roughly 80% signals a deployment that genuinely landed; below 50% means the customer is paying for two access paths.

This metric is for network and infrastructure buyers who control a specific circuit contract and hardware refresh they are trying to avoid. It trades away the simplicity of billing-derived seat counts, since evidence lives in the customer's asset register rather than your systems. Compared to ZTNA net revenue retention directly below, displacement leads by roughly a year and is far harder to fake, provided you require decommissioning artifacts instead of self-reported progress.

2. ZTNA Net Revenue Retention

Net revenue retention ranks second because it is the best revenue-side read on whether the installed base is deepening or quietly hollowing out. In this fast-growing category, retention above roughly 120% means seats are compounding inside logos, additional modules are attaching, and application coverage is broadening. Retention in the low 110s means you are winning new logos while failing to expand them; below 105% is a product-adoption problem disguised as a sales problem.

This metric suits boards and finance leaders who already speak SaaS vocabulary, since it falls directly out of billing tables. It trades away diagnostic depth: a customer can license 12,000 seats and still route most real traffic through the old VPN because forty critical applications were never onboarded. Compared to VPN-replacement conversion rate above, retention lags displacement by roughly a year and can be flattered by multi-year contract timing.

3. ZTNA P95 Added Connector Latency

P95 added connector latency ranks third because an always-in-path access layer gets blamed for every performance complaint whether or not it is responsible. Measure the 95th percentile of added round-trip time versus direct application access, per point of presence and per application class, never the mean. Under about 20ms the layer is genuinely invisible; 30 to 50ms is noticeable on chatty applications; past 80ms you lose the argument entirely.

This metric is for customer-success and network-operations teams who own renewal risk from user experience. It trades away simplicity, because synthetics from your own points of presence produce beautiful numbers bearing no relationship to a branch user reaching a regional data center. Compared to ZTNA app-onboarding velocity below, latency moves daily and must be reviewed daily, while onboarding velocity is a weekly delivery-meeting metric with named owners per account.

4. ZTNA App-Onboarding Velocity

App-onboarding velocity ranks fourth because it is the operational constraint determining everything downstream, including seats, displacement, and margin. Measure applications brought under enforcement per customer-success engineer per week, weighted by session volume or user population served. A 1,200-application estate at three applications per engineer-week consumes 400 engineer-weeks; bulk discovery and automated connector provisioning move that number by an order of magnitude.

This metric is for delivery leaders and customer-success managers who control deployment staffing and tooling spend. It trades away flattery: onboarding twelve low-traffic internal tools per week looks superb next to two business-critical applications with complex authentication, yet moves displacement far less. Compared to ZTNA identity-provider coverage breadth below, onboarding velocity is a process and tooling measure, while coverage breadth is a pipeline filter that silently disqualifies deals during technical evaluation.

5. ZTNA Identity-Provider Coverage Breadth

Identity-provider coverage breadth ranks fifth because a missing integration does not slow a deal, it removes the deal silently before anyone reports it as a loss. The baseline expectation now includes major cloud identity platforms, SAML and OIDC federation, SCIM provisioning, and credible on-premises directory handling for hybrid environments. Run the matrix against open pipeline quarterly and rank gaps by blocked dollar value.

This metric is for product and engineering leaders allocating roadmap capacity across competing integration requests. It trades away the vocal-customer signal: request counts over-weight existing accounts, while the pipeline-value ranking surfaces silent lost deals. Compared to ZTNA average managed seats per customer below, coverage breadth is a binary gate dressed as a count, while seat count is a trajectory measure that reveals whether application onboarding has stalled inside existing logos.

6. ZTNA Average Managed Seats Per Customer

Average managed seats per customer ranks sixth because it makes the seat-growth model concrete and exposes stalled coverage expansion inside existing accounts. Enterprise deployments typically start in the low thousands and expand as coverage widens; large multinational accounts run into the tens of thousands. The absolute number matters less than the year-over-year trajectory within a cohort, since seats follow applications.

This metric is for sales leadership and account teams managing expansion motions inside landed logos. It trades away honesty when licensed seats are counted rather than active identities: licensing populations that will never deploy inflates ARR, deflates gross margin per active user, and sets up a renewal conversation where the customer arrives with a utilization report. Compared to ZTNA gross margin per active user below, seat count measures reach while margin measures whether that reach is economically sustainable.

7. ZTNA Gross Margin Per Active User

Gross margin per active user per month ranks seventh because it is the unit-economics floor that nets bandwidth, point-of-presence costs, identity integration overhead, and monitoring against realized per-seat revenue. Thin margin per seat is not automatically a crisis, since some vendors deliberately run thin to win land deals and expand on modules. A margin trend that declines as seats grow indicates the network architecture is not scaling sublinearly.

This metric is for finance and infrastructure leaders deciding pricing and architecture investment. It trades away simplicity, because declining margin usually means one of three things: linear cost scaling, discounts outpacing cost declines at volume, or support burden growing with seats from manual onboarding configurations. Compared to ZTNA 24-month renewal rate below, margin is a forward-looking structural signal while renewal is the lagging truth that retroactively validates or invalidates every other metric.

8. ZTNA 24-Month Renewal Rate

Renewal rate at 24 months ranks eighth because year one renewals are frequently protected by multi-year contracts and deployment inertia, while year two is when the customer has enough operating experience and enough alternatives to act. This is the number that retroactively validates or invalidates every other metric on the board. If retention looks excellent but average contract length has been quietly extending, you have deferred the reckoning rather than earned it.

This metric is for executive teams and boards assessing whether the book of business is durable. It trades away timeliness, since by the time a 24-month renewal number moves, the underlying deployment problems are a year old and expensive to reverse. Compared to ZTNA access-related help-desk ticket volume below, renewal is a lagging outcome while ticket volume is the earliest predictor of a contested renewal, moving weeks before latency dashboards show sustained degradation.

9. ZTNA Access Help-Desk Ticket Volume

Access-related help-desk ticket volume ranks ninth because it predicts a contested renewal earliest, normalized per thousand active users. It moves weeks before latency dashboards show sustained degradation and months before retention numbers react, since users complain to their own IT desk long before anyone escalates to the vendor. This is the fastest-moving health signal on the board.

This metric is for customer-success and support leaders who need early warning on accounts trending toward churn. It trades away precision, because ticket volume reflects the customer's own IT responsiveness, internal tooling, and user tolerance, which vary widely across accounts and industries. Compared to ZTNA 24-month renewal rate above, ticket volume is a leading indicator requiring interpretation, while renewal is the lagging truth that no amount of dashboard excellence can substitute for.

10. ZTNA Agent Version Distribution

Agent version distribution ranks tenth because a fleet where a meaningful share of agents run two or more versions behind current means your latency and session-success telemetry describe a different product than the customer is running. Track the percentage on current-minus-one and treat drift above roughly 20% as an operational defect. This metric keeps the other nine honest.

This metric is for operations and fleet-management teams who own deployment hygiene across large endpoint estates. It trades away visibility into why drift occurs, since version lag often reflects customer change-control windows and slow endpoint-management cycles rather than vendor neglect. Compared to ZTNA access help-desk ticket volume above, agent drift is a slow-moving structural measure reviewed weekly, while ticket volume is a daily signal that reacts within hours to user-visible degradation.

How we ranked these

We ranked vendors on nine weighted measures: net new ARR (15%), net revenue retention (15%), average managed seats per customer (10%), VPN-replacement conversion at 18 months (15%), P95 added connector latency (10%), identity-provider coverage breadth (10%), app-onboarding velocity (10%), gross margin per active user (10%), and 24-month renewal rate (5%). Weighting favored metrics that predict renewal outcomes over metrics that merely describe growth.

We deliberately ignored composite health scores, analyst quadrant placement, feature-count comparisons, and raw ARR totals. Composites hide divergence between seat growth and displacement, which is the most diagnostic signal available. Feature counts reward breadth over production readiness. Raw ARR reflects market growth more than execution quality, and analyst placement lags operational reality by quarters.

Related questions

Why does VPN-replacement conversion matter more than seat count?

Seats measure what was licensed; displacement measures what was actually retired. A customer can run 12,000 licensed seats while routing real traffic through legacy concentrators. Only decommissioned infrastructure proves the deployment landed, and only decommissioned infrastructure defends the renewal line item against consolidation pressure.

What P95 latency threshold makes ZTNA invisible to users?

Under roughly 20ms of added round-trip time, the access layer disappears from user perception. Between 30 and 50ms it is noticeable on chatty applications but tolerable. Past 80ms every unrelated slowdown gets blamed on ZTNA first, and the CIO's mental model of the product becomes permanently negative.

How fast should applications be onboarded per engineer-week?

Enterprises carry high hundreds to low thousands of applications. At three apps per engineer-week, a 1,200-app estate consumes 400 engineer-weeks. Bulk discovery and automated connector provisioning move that number by an order of magnitude, which is why onboarding tooling compounds into margin, retention, and displacement simultaneously.

What does net revenue retention above 120% actually signal?

It means the installed base is expanding faster than the market — seats compounding inside logos, modules attaching, application coverage broadening. In the low 110s, you are winning new logos while failing to deepen them. Below 105%, you have a product-adoption problem dressed as a sales problem.

Why is 24-month renewal more diagnostic than year-one renewal?

Year-one renewals are protected by multi-year contracts and deployment inertia. Year two is when the customer has enough operating experience to judge the product and enough alternatives to act. This lagging metric retroactively validates or invalidates every other number on the scorecard.

Should ZTNA vendors measure platform attach rate?

Platform attach is a packaging metric, not an operational one. It tells you what was sold, not whether the deployment works, and it is the easiest metric to game with bundling discounts that inflate the attach rate beyond realized revenue. Use it for strategy, never for account health.

What blocks more ZTNA pipeline than price?

Missing identity-provider integrations. Run every open opportunity against the coverage matrix and a small number of absent connectors will block a disproportionate share of pipeline value. Those losses rarely appear in loss-reason fields because deals are disqualified silently during technical evaluation.

How often should each ZTNA metric be reviewed?

Latency, session success, and access tickets are daily. Displacement progress, onboarding velocity, and integration backlog are weekly with named owners. Retention, per-seat margin, and 24-month renewal pipeline are monthly. Coverage roadmap and point-of-presence expansion are quarterly. Reviewing slow metrics weekly generates noise-chasing.

FAQ

What are the top sales KPIs for ZTNA vendors in 2027?

Nine core measures: net new ARR, net revenue retention, average managed seats per customer, VPN-replacement conversion rate, P95 added connector latency, identity-provider coverage breadth, app-onboarding velocity, gross margin per active user, and 24-month renewal rate. Displacement speed and invisible latency drive the rest.

What is the difference between the seat-growth and displacement models?

Seat growth treats ZTNA as a subscription platform measured in users under enforcement. Displacement treats it as an infrastructure replacement program measured in retired concentrators and cancelled circuits. Both sell the same product but build very different companies, with different compensation and different renewal durability.

Why can high NRR coexist with a failing deployment?

A customer can license and deploy 12,000 seats while routing most real traffic through the old VPN because critical applications were never onboarded. Billing reports success; the next renewal reports the truth. NRR without displacement data describes a book that contracts violently during consolidation exercises.

What counts as a genuine VPN replacement?

Decommissioned legacy remote-access seats, not disabled or deprioritized ones, measured at a fixed interval after go-live, usually 18 months. Above roughly 80% is a landed deployment. Below 50% means the customer pays for two access paths, which is the strongest predictor of a contested renewal.

Why does app-onboarding velocity determine ZTNA outcomes?

Seats follow applications. Users only move to the new access path when the applications they need sit behind it. If onboarding stalls, coverage stalls, displacement stalls, and the deployment becomes permanent dual-running. Tooling that accelerates onboarding compounds into margin, retention, and displacement at once.

How should ZTNA latency be measured and reported?

Report P95 and P99 of added round-trip time versus direct application access, per point of presence and per application class. Never report the mean, because averages hide the tail that generates help-desk tickets. Use synthetic probes for infrastructure regressions and real-user measurements for application-specific pathologies.

What is the biggest mistake buyers make evaluating ZTNA vendors?

Buying on feature breadth and analyst placement rather than displacement evidence and measured latency. The mistake compounds because partial coverage in access control is closer to no coverage than full coverage — users route around gaps, establish sticky workarounds, and the deployment never lands.

Why is identity-provider coverage a pipeline filter, not a feature?

A missing connector does not slow a deal, it removes the deal silently before anyone logs a loss. The opportunity is disqualified during technical evaluation, often without the vendor learning why. That asymmetry is why coverage breadth belongs on a management dashboard, not a product backlog.

What is gross margin per active user measuring?

It nets bandwidth, point-of-presence costs, identity integration overhead, and monitoring against realized per-seat revenue. Thin margin is not automatically a crisis, but a margin trend that declines as seats grow means the network architecture is not scaling sublinearly — a structural problem discounts cannot fix.

Should ZTNA vendors roll the nine metrics into one health score?

No. The nine are deliberately non-redundant, and the diagnostic value lies in cases where they disagree — excellent latency with stalled displacement, or strong seat growth with collapsing per-seat margin. Averaging those into a green dot destroys the only signal worth having.

Sources

• https://www.gartner.com/en/information-technology/glossary/zero-trust-network-access-ztna
• https://www.nist.gov/publications/zero-trust-architecture
• https://www.cloudflare.com/learning/access-management/what-is-ztna/
• https://www.cisa.gov/zero-trust-maturity-model
• https://www.forrester.com/research/
• https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights
• https://www.okta.com/identity-101/zero-trust/
• https://www.paloaltonetworks.com/cyberpedia/what-is-zero-trust-network-access

Related on PULSE

• [More sales kpis for zero trust network access (ztna) vendors rankings and buying guides](/knowledge)
• [PULSE Tools and calculators](/tools)
• [Everything on PULSE RevOps](/)