ZTNA (Zero Trust Network Access) Selling to the Network Architect — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **ZTNA (Zero Trust Network Access) Selling to the Network Architect** is a 60-minute training for enterprise account executives, sales engineers, and channel sellers running $250K–$3M ACV cycles against incumbents like **Zscaler**, **Netskope**, **Cloudflare One**, **Palo Alto Networks Prisma Access**, **Cisco Duo + Hybrid Mesh**, **Microsoft Entra Private Access**, **Akamai EAA**, and **Tailscale**. The session teaches sellers to qualify against the **three-buyer reality (CIO, Network Architect, CISO)**, run a structured discovery on **VPN-displacement and latency economics**, demo against the customer's actual user-app latency, and trap-set the multi-year renewal at month 18. Built on the **MEDDPICC qualification model**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why ZTNA Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. ZTNA is **not** funded by net new security budget — **74% of ZTNA spend is reallocated VPN and MPLS budget** per Forrester's 2026 survey. The selling motion is therefore a budget-defunding motion, not a budget-expansion motion.

Set the frame on the whiteboard.

- **Three buyers, one budget source.** The CIO funds the line item from the VPN budget; the Network Architect picks the platform on latency and PoP coverage; the CISO measures zero-trust policy coverage. **Zscaler's 2026 customer disclosures** show 71% of net new ZTNA spend traced to legacy VPN budget reallocation.
- **Latency is the user-experience gate.** A user who clicks an app and waits more than **1.2 seconds for first response** opens a support ticket. Best-in-class ZTNA adds **under 20ms**; legacy hub-and-spoke architectures add 80–150ms.
- **Identity-provider coverage is the procurement-gate check.** A ZTNA that does not support Okta, Microsoft Entra, Ping Identity, OneLogin, JumpCloud, AWS IAM Identity Center, Google Workspace, SAML, OIDC, SCIM 2.0, and on-prem AD with Kerberos constrained delegation loses at the POC stage.

End the segment with **Mark Roberge's** rule read aloud: *"Defund the legacy line item. That's how new categories get funded."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

The discovery cadence the room must practice verbatim. Pair AEs and roleplay — one plays the Network Architect, one plays the seller.

> 1. **Opening (3 min):** "Walk me through your current remote-access stack — SSL-VPN concentrators, MPLS circuits, ZTNA proof-of-concepts. What is the annual run-rate?"
> 2. **VPN defunding baseline (10 min):** "What is your current annual spend on legacy VPN concentrators, MPLS circuits, and the support team running them? **74% of ZTNA budget** comes from defunding these."
> 3. **Latency baseline (10 min):** "What latency do users experience today from VPN-on to first-app-response? **Sub-1.2 seconds** is the gate; over 2 seconds is a help-desk magnet."
> 4. **IdP coverage check (10 min):** "Walk me through your identity stack — Okta, Microsoft Entra, on-prem AD, SAML, OIDC. Which is the primary, and which are the long-tail?"
> 5. **App-onboarding velocity (10 min):** "How many apps would you onboard to ZTNA in the first 90 days? **8–15 apps per CSM-week** is best-in-class with bulk-onboarding tooling."
> 6. **PoP coverage (7 min):** "Where are your users globally? **Anycast PoP coverage** matters more than count of PoPs. Where are your concentration markets?"
> 7. **Renewal posture (5 min):** "When does your current SSL-VPN or ZTNA renewal hit? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CIO + Network Architect + CISO?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[VPN Baseline + Latency 13 min]
    E --> F[IdP Coverage + Onboarding Velocity 20 min]
    F --> G[PoP + Renewal Posture 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[Pre-Workshop Brief Sent All 3 Personas]
    I --> J[2-Hour POC Scope Workshop Within 7 Days]
    J --> K[Pilot Kicked Off Within 14 Days]
```

---

## Section 3 — The POC That Wins (15 min)

The Proof of Concept is where ZTNA deals are decided. Walk the room through three failure modes and three wins.

**Failure modes to ban.** **Sandbox-only POCs** — they do not capture real user-app latency. **30-day POCs** — too short to capture support-ticket impact. **Single-region POCs** — they fail to convince the Network Architect of global PoP coverage.

**Wins to coach.** **Real user traffic from a representative cohort.** Walk through **Cloudflare One's and Zscaler's published POC agendas** — both run 60-day POCs with 500+ real users routing through the PoPs. **Side-by-side latency comparison.** Show user-experienced latency from the legacy VPN vs. The ZTNA on the customer's most-used app. **Bulk-onboarding demo.** Onboard 20+ apps live during the POC to demonstrate the per-ap

ZTNA (Zero Trust Network Access) Selling to the Network Architect — 60-Min Training

Direct Answer

Section 1 — Why ZTNA Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

ZTNA (Zero Trust Network Access) Selling to the Network Architect — 60-Min Training

Direct Answer

Section 1 — Why ZTNA Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

What does the score mean?