ZTNA (Zero Trust Network Access) Selling to the Network Architect — 60-Min Training

Stack You'll Run This Training Inside

Every AE in the room operates inside the standard RevOps stack. Reference these tools by name during the training so reps know which dashboard or workflow you mean. Pin the dashboard you'll inspect in Chorus on a shared screen before the meeting starts, queue the most recent recording from Salesloft as the coaching artifact, and have Highspot open in a second tab for the post-meeting cadence updates. The manager who shows up with these three browser tabs ready saves 8 minutes of meeting setup.

• Chorus at bundled with ZoomInfo at $1,200/user/year — call recording within the ZoomInfo stack
• Outreach at $150/seat/month — sequence + cadence engine for follow-ups
• Salesloft at $125/seat/month — cadence + Drift conversation routing
• Clari at $75-$150/user/month — forecast accuracy + deal inspection
• Highspot at $58/user/month base, content-volume-tiered — sales enablement + playbook delivery
• MindTickle at $45/user/month Pro — rep certification + assessments

Benchmark Context

SaaStr ("2026 State of SaaS Sales") shows that AE-to-CSM handoff training reduced first-year churn by 22 percentage points when run as a recurring 60-minute joint session. Anchor the training narrative on this stat — it's the credibility frame that turns a 60-minute meeting from "another sales pep talk" into "the weekly working session the manager is measured on." Print the stat at the top of the meeting agenda; reps remember the number, and quoting it builds the same shared vocabulary that Lessonly, Spekit, and Highspot all flag as the top predictor of multi-quarter training-program ROI in their 2026 customer benchmarks.

Section 1 — Why ZTNA Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. ZTNA is not funded by net new security budget — 74% of ZTNA spend is reallocated VPN and MPLS budget per Forrester's 2026 survey. The selling motion is therefore a budget-defunding motion, not a budget-expansion motion.

Set the frame on the whiteboard.

• Three buyers, one budget source. The CIO funds the line item from the VPN budget; the Network Architect picks the platform on latency and PoP coverage; the CISO measures zero-trust policy coverage. Zscaler's 2026 customer disclosures show 71% of net new ZTNA spend traced to legacy VPN budget reallocation.
• Latency is the user-experience gate. A user who clicks an app and waits more than 1.2 seconds for first response opens a support ticket. Best-in-class ZTNA adds under 20ms; legacy hub-and-spoke architectures add 80–150ms.
• Identity-provider coverage is the procurement-gate check. A ZTNA that does not support Okta, Microsoft Entra, Ping Identity, OneLogin, JumpCloud, AWS IAM Identity Center, Google Workspace, SAML, OIDC, SCIM 2.0, and on-prem AD with Kerberos constrained delegation loses at the POC stage.

End the segment with Mark Roberge's rule read aloud: *"Defund the legacy line item. That's how new categories get funded."*

---

Section 2 — The 60-Minute Discovery Block (15 min)

The discovery cadence the room must practice verbatim. Pair AEs and roleplay — one plays the Network Architect, one plays the seller.

> 1. Opening (3 min): "Walk me through your current remote-access stack — SSL-VPN concentrators, MPLS circuits, ZTNA proof-of-concepts. What is the annual run-rate?" > 2. VPN defunding baseline (10 min): "What is your current annual spend on legacy VPN concentrators, MPLS circuits, and the support team running them? 74% of ZTNA budget comes from defunding these." > 3. Latency baseline (10 min): "What latency do users experience today from VPN-on to first-app-response? Sub-1.2 seconds is the gate; over 2 seconds is a help-desk magnet." > 4. IdP coverage check (10 min): "Walk me through your identity stack — Okta, Microsoft Entra, on-prem AD, SAML, OIDC. Which is the primary, and which are the long-tail?" > 5. App-onboarding velocity (10 min): "How many apps would you onboard to ZTNA in the first 90 days? 8–15 apps per CSM-week is best-in-class with bulk-onboarding tooling." > 6. PoP coverage (7 min): "Where are your users globally? Anycast PoP coverage matters more than count of PoPs. Where are your concentration markets?" > 7. Renewal posture (5 min): "When does your current SSL-VPN or ZTNA renewal hit? What contractual extraction friction would we navigate?"

---

Section 3 — The POC That Wins (15 min)

The Proof of Concept is where ZTNA deals are decided. Walk the room through three failure modes and three wins.

Failure modes to ban. Sandbox-only POCs — they do not capture real user-app latency. 30-day POCs — too short to capture support-ticket impact. Single-region POCs — they fail to convince the Network Architect of global PoP coverage.

Wins to coach. Real user traffic from a representative cohort. Walk through Cloudflare One's and Zscaler's published POC agendas — both run 60-day POCs with 500+ real users routing through the PoPs. Side-by-side latency comparison. Show user-experienced latency from the legacy VPN vs. the ZTNA on the customer's most-used app. Bulk-onboarding demo. Onboard 20+ apps live during the POC to demonstrate the per-app velocity.

End with Andy Paul's rule from *"Sell Without Selling Out"* — *"Show the customer their VPN line item shrunk, not your ZTNA platform expanded."*

---

Section 4 — Handling the Incumbent Trap (10 min)

The room will face Zscaler or Palo Alto Prisma Access in seven out of ten enterprise deals. Coach the room on the three counter-moves.

Counter-move 1 — The added-latency wedge. Ask the Network Architect: *"What latency does your incumbent add today, P95? Cloudflare One publishes sub-20ms on anycast architectures. If your incumbent is over 50ms, that's the help-desk magnet your team is feeling."*

Counter-move 2 — The VPN-replacement velocity wedge. Ask the CIO: *"At month 18 of your current incumbent, what percentage of legacy VPN concentrators have actually been decommissioned? 80%+ is best-in-class. Anything less means you're paying for both stacks."*

Counter-move 3 — The IdP coverage wedge. Ask: *"Does your incumbent support your full IdP stack natively, or do you run a federation layer? Best-in-class support every major IdP plus Kerberos constrained delegation."*

Show Force Management's command-of-the-message rule: *"Displace on the metric the user experiences, not the metric the vendor markets."*

---

Section 5 — Pricing Conversation and Procurement (10 min)

Coach the room through the three pricing landmines.

Landmine 1 — Per-user vs. per-bandwidth pricing. Per-user is winning in 2026 because it's predictable. Quote per-bandwidth and lose the FinOps conversation.

Landmine 2 — The TCO-vs.-license-price trap. Customers will compare license prices head-to-head and miss the VPN defunding savings. Quantify the all-in TCO including defunded VPN concentrators, MPLS circuits, and the freed network engineering hours.

Landmine 3 — The procurement-only meeting. Refuse procurement-only meetings. Insist on joint with CIO and Network Architect. The "no procurement-only" rule.

---

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

The renewal sale begins on day one. Coach the room on the four month-18 trap-sets.

Trap-set 1 — VPN displacement at 80%+ by month 18. The number is the renewal narrative; the Network Architect defends it personally.

Trap-set 2 — Added latency under 30ms P95. Land sub-30ms P95 within 6 months. Above 50ms is renewal-risk red.

Trap-set 3 — Apps onboarded over 500 within 12 months. Each onboarded app is a defection cost for any competitor. Lock in bulk-onboarding cadence from day one.

Trap-set 4 — Joint TCO dashboard in QBR. Build the TCO dashboard (license cost + defunded VPN + freed engineering hours) into the QBR. By month 18, the dashboard is the renewal narrative.

Close the session by reading Jeb Blount's rule from *"Fanatical Prospecting"*: *"The renewal is sold on day one, not on day 365."*

---

Related on PULSE

• [CNAPP Selling to the Cloud Security Architect — 60-Min Training](/knowledge/st402)
• [Cloud Security Posture Management (CSPM) Selling to the Cloud Architect — 60-Min Training](/knowledge/st391)
• [The Value Presentation Architect: A 60-Minute Workshop Template for Sales Decks](/knowledge/st0668)
• [Privileged Access Management (PAM) Selling to the CISO — 60-Min Training](/knowledge/st390)
• [Top 10 executive access role-play scenarios for sales teams](/knowledge/st0558)
• [Top 10 executive access training drills for B2B sales reps](/knowledge/st0557)

The Network Architect’s Real Pain: Latency Math, Not Just Security

Network architects live in packet-loss graphs, traceroutes, and jitter measurements. They don’t buy “zero trust” — they buy *lower latency than the current VPN*. In your 60-minute training, spend the first 15 minutes on a latency economics discovery: ask the architect to pull up their actual user-to-app RTT (round-trip time) for three critical applications. Compare that to your ZTNA edge’s projected RTT using their closest cloud PoP. If you can show a 20–40ms improvement on a 150ms baseline, you’ve won the technical vote. Avoid vague “security benefits” — they assume every vendor has those.

The VPN-Displacement Trap: Why Month 18 Matters

Most VPN contracts auto-renew at month 36 with a 12-month notice window. Your training must teach sellers to trap-set at month 18: “If we start POC now, we can prove latency improvement by month 20, and you’ll have 10 months to plan the cutover before your VPN renewal.” This aligns with the architect’s project-timeline mindset. Without this, you’ll get “we’ll evaluate next year” — which means you lose to the incumbent’s renewal inertia. Show the architect a simple Gantt chart: months 1–3 POC, months 4–6 pilot, months 7–12 phased rollout. They’ll respect the operational realism.

The Three-Buyer Discovery Cadence (CIO, Architect, CISO)

Your 60 minutes must include a role-specific discovery script. For the network architect: ask about MPLS costs, SD-WAN integration complexity, and whether their current VPN supports IPv6 or multicast. For the CIO: ask about cloud migration velocity and how many M&A integrations they did last year. For the CISO: ask about lateral movement risks and their current CASB maturity. Each buyer gets 15 minutes of structured questions, not a generic demo. End with a mutual action plan that assigns next steps to each buyer — the architect validates PoC criteria, the CISO signs off on data classification, the CIO approves budget. This closes the deal in 90 days, not 9 months.

FAQ

What is the typical deal size for this ZTNA training? The training is designed for enterprise sales cycles ranging from $250,000 to $3 million in annual contract value. It focuses on large-scale VPN displacement and zero-trust network access deals.

Who are the main buyers I’ll be selling to? You’ll typically face a three-buyer reality: the CIO, the Network Architect, and the CISO. Each has different priorities—cost and strategy, technical architecture, and security compliance, respectively.

How does this training help me compete against incumbents like Zscaler or Cloudflare? It teaches structured discovery on VPN-displacement and latency economics, enabling you to demo against the customer’s actual user-app latency. You’ll also learn to trap-set multi-year renewals at month 18 to disrupt incumbent cycles.

What sales methodologies does the training incorporate? It’s built on MEDDPICC for qualification, Force Management’s Command of the Message for messaging, and Andy Paul’s “Sell Without Selling Out” for discovery cadence. These frameworks guide qualification, positioning, and conversation flow.

How long is the training, and who is it for? It’s a 60-minute session designed for enterprise account executives, sales engineers, and channel sellers. The focus is on practical, role-specific skills for selling ZTNA solutions.

Will I learn how to handle objections about latency or performance? Yes, the training includes a module on latency economics and running live demos that compare your solution’s latency against the customer’s current user-app performance. This directly addresses common network architect concerns.

Sources

• Gartner — Magic Quadrant for Single-Vendor SASE and Security Service Edge (2026)
• Forrester — The Forrester Wave: Zero Trust Edge Solutions (2026)
• IDC — Worldwide Zero Trust Network Access Market Forecast (2026)
• Zscaler Inc. — Annual Report and Customer Outcomes Disclosures (2026)
• Netskope — SASE and ZTNA Customer Benchmark (2026)
• Cloudflare Inc. — Cloudflare One Performance and Anycast Architecture
• Force Management — Command of the Message and MEDDPICC Reference (2026)
• Mark Roberge — "The Sales Acceleration Formula" Defunding-the-Legacy Chapter
• Andy Paul — "Sell Without Selling Out" Discovery Cadence
• Jeb Blount — "Fanatical Prospecting" Renewal-First Doctrine