Managed Service Providers

AppGate ZTNA has no middle component in the data plane, which means your customers' traffic never passes through a third-party infrastructure layer. This eliminates a class of risk that most ZTNA platforms introduce. Combined with an API-first architecture and flexible deployment across any environment, it's designed for MSPs who need to support diverse customer environments without standardizing on a single infrastructure model.

The land-and-expand model is straightforward—start with secure remote access or VPN replacement, then grow into additional use cases like third-party access, contractor access, OT/IoT access, and application-specific secure access across hybrid environments. Appgate ZTNA helps MSPs expand recurring revenue by reducing the attack surface through cloaking unauthorized resources, enforcing granular context-aware access, and enabling a segment-of-one approach for each user and device. Each new use case increases MRR without requiring a new platform sale. 

AppGate is cloud-native and runs on any Type 1 hypervisor, giving you flexibility to deploy in customer-owned infrastructure, your own hosted environment, or public cloud. The pay-as-you-go model means you're not carrying unused license overhead between customer engagements.

Yes. The MSP program includes technical training and certification designed specifically for partners, along with 24/7 dedicated technical support for delivery confidence.

AppGate holds multiple certifications and supports compliance across frameworks including NIST, CMMC, and others relevant to regulated industries. See the certifications and compliance page for the current list.

AppGate focuses on Zero Trust Network Access and does not include a built-in SWG. For customers requiring internet filtering, AppGate works with technology alliance partners that integrate with the platform. Your AppGate channel team can recommend validated integration options based on your customer profile.

You pay a flat $5/seat/month with no minimums beyond your committed pool. No complex discount structures to navigate. You bill your clients however you already do—we don't dictate that. Most partners position ZTNA as a line item in their security stack at a price point that reflects the value, not the cost. The simplicity is the point: you should know exactly what you're paying before the invoice arrives.

Start with the problem they already feel, not the technology. Ask them when they last audited who can reach what on their network—most can't answer that. Then ask how they'd contain a breach today if one of their remote access credentials was compromised. That conversation creates the opening. ZTNA becomes the answer to a problem they already have, not a concept they need to learn.

Onboarding is structured around your first client deployment. Week one is platform access, training, and pairing you with your dedicated Sales Engineer. Weeks two through four are architecture review and initial deployment scoped to your first client. By day 60, most partners have completed their first deployment and are in conversations about expansion. Your CSM owns the relationship from day one—you won't be passed between teams.

The natural expansion path—VPN replacement to micro-segmentation to OT/IoT coverage—means a single client can grow in seat count and scope over time. Because pricing is consumption-based and billed per seat, your revenue grows as the client's footprint grows. Partners who start with 50 seats at a mid-market client routinely expand to 200+ within 18 months.