Cost, Compliance & Risk
Cost, Compliance & Risk — Round 1 Research Report
Section titled “Cost, Compliance & Risk — Round 1 Research Report”Session: 20260321-0115 Domain: Cost Analysis, Licensing, Compliance, and Migration Risk Assessment Date: 2026-03-21 Tools Used: mcp__claude_ai_Tavily__tavily_search (14 queries), mcp__exa_websearch__web_search_exa (2 queries), WebFetch (2 attempts), WebSearch (0 — Tavily/Exa provided sufficient coverage), Bash, Write
Executive Summary
Section titled “Executive Summary”Migrating from Palo Alto GlobalProtect on the PA-2020 to self-hosted NetBird on Azure represents a significant cost reduction (estimated 75-85% over 5 years) while improving security posture against the active credential-spraying campaign targeting GlobalProtect portals. The PA-2020 reached End of Service Life on April 30, 2020 — it has been unsupported for nearly 6 years. Continued operation on this appliance is the single largest risk factor in this analysis.
Self-hosted NetBird is genuinely free for unlimited users with no license fees. The primary cost is Azure infrastructure (~$15-25/month) and internal labor. Compliance risk is manageable for an engineering/construction company operating in Hawaii and Colorado, provided standard controls (encryption, MFA, access logging) are maintained. Cyber insurance implications actually favor migration away from the self-managed legacy VPN — insurers are increasingly penalizing organizations running self-managed VPN appliances, with At-Bay reporting companies using self-managed VPNs are 11x more likely to experience ransomware attacks.
Findings by Question
Section titled “Findings by Question”Question 1: Current Cost of Maintaining the PA-2020
Section titled “Question 1: Current Cost of Maintaining the PA-2020”Confidence: HIGH (verified via multiple Palo Alto price lists and EOL databases)
End of Life Status — CRITICAL FINDING
Section titled “End of Life Status — CRITICAL FINDING”The PA-2020 reached End of Service Life (EOSL) on April 30, 2020 — over 6 years ago.
| Milestone | Date | Status |
|---|---|---|
| End of Sale | ~2016-2017 (estimated) | Long past |
| End of Service Life | April 30, 2020 | 6 years past |
| PAN-OS Support | Last supported: PAN-OS 8.1 (EOL March 2022) | Unsupported |
Sources: Park Place Technologies EOSL database, Palo Alto Networks Hardware End-of-Life page, Procurri EOSL list
Subscription Renewal Pricing
Section titled “Subscription Renewal Pricing”Because the PA-2020 is past EOSL, Palo Alto Networks will not sell new or renewal subscriptions for this device. The appliance cannot run modern PAN-OS versions (11.x/12.x), which means:
- No Threat Prevention signature updates
- No URL Filtering database updates
- No WildFire malware analysis
- No GlobalProtect client compatibility with newer OS versions
- No security patches
If subscriptions were still available (extrapolating from comparable PA-3020 pricing, which is the nearest still-priceable model):
| Subscription | PA-3020 Annual Renewal (List) | Estimated PA-2020 Equivalent |
|---|---|---|
| Threat Prevention | $2,800/yr | ~$2,000-2,500/yr |
| URL Filtering (PANDB) | $2,800/yr | ~$2,000-2,500/yr |
| GlobalProtect | $2,800/yr | ~$2,000-2,500/yr |
| WildFire | $2,800/yr | ~$2,000-2,500/yr |
| Premium Support | $3,050/yr | ~$2,000-2,500/yr |
| Bundle (BND-NFR4) | $7,000-9,000/yr | ~$5,000-7,000/yr |
Key Point: Even if these subscriptions could be renewed, the device runs unsupported PAN-OS, making the subscriptions ineffective against modern threats. GSISG is currently paying $0 for subscriptions on a device that provides zero active threat protection.
Replacement Cost (If Staying with Palo Alto)
Section titled “Replacement Cost (If Staying with Palo Alto)”To maintain GlobalProtect on supported hardware, GSISG would need to purchase a replacement appliance:
| Replacement Model | Hardware Cost | Annual Subscription Bundle | Year 1 Total |
|---|---|---|---|
| PA-440 (entry) | ~$1,000-1,500 | ~$2,000-3,000 | ~$3,000-4,500 |
| PA-1420 (mid-range) | ~$5,000-8,000 | ~$5,000-7,000 | ~$10,000-15,000 |
| PA-3220 (comparable to PA-2020) | ~$10,000-15,000 | ~$8,000-12,000 | ~$18,000-27,000 |
Sources: Insight.com pricing, 10four.org PA-1420 pricing ($1,900/yr bundle renewal), UnderDefense Palo Alto Pricing Guide 2026, Carahsoft MN Pricing PDF
Question 2: Azure B1ms VM Cost in West US 2
Section titled “Question 2: Azure B1ms VM Cost in West US 2”Confidence: HIGH (verified via Vantage.sh, CloudPrice.net, Microsoft Azure pricing pages)
Compute Pricing
Section titled “Compute Pricing”| Metric | Value |
|---|---|
| vCPUs | 1 |
| Memory | 2 GiB |
| Local Temp Storage | 4 GiB |
| On-Demand Hourly Rate (Linux, West US 2) | $0.0207/hr |
| On-Demand Monthly (730 hrs) | $15.11/mo |
| On-Demand Annual | $181.33/yr |
| 1-Year Reserved (est. ~37% savings) | ~$9.52/mo ($114.24/yr) |
| 3-Year Reserved (est. ~60% savings) | ~$6.04/mo ($72.48/yr) |
Note: B-series VMs are “burstable” — ideal for the NetBird management server workload which has low sustained CPU requirements but occasional spikes during peer authentication/registration.
Additional Infrastructure Costs
Section titled “Additional Infrastructure Costs”| Component | Monthly Cost | Annual Cost |
|---|---|---|
| OS Disk (P4 32GB Premium SSD) | ~$5.28 | ~$63.36 |
| Data Disk (P4 32GB for data) | ~$5.28 | ~$63.36 |
| Bandwidth (5 GB egress estimate) | ~$0.44 | ~$5.28 |
| Public IP (Static) | ~$3.65 | ~$43.80 |
| Total Infrastructure (Pay-as-you-go) | ~$29.76 | ~$357.13 |
| Total Infrastructure (1-yr Reserved) | ~$24.17 | ~$290.04 |
| Total Infrastructure (3-yr Reserved) | ~$20.69 | ~$248.28 |
Assessment: A B1ms is sufficient for 100+ peers. NetBird’s management server has minimal resource requirements — the official recommendation is “1 CPU, 2GB RAM” which the B1ms meets exactly. A B2s ($0.0416/hr, ~$30/mo) provides headroom if needed but is likely unnecessary.
Sources: CloudPrice.net (exact West US 2 pricing), Vantage.sh instances, Azure Reserved VM Instances page, multiple Azure pricing guides
Question 3: NetBird Licensing Model
Section titled “Question 3: NetBird Licensing Model”Confidence: VERY HIGH (verified via netbird.io/pricing, NetBird docs, WZ-IT comparison, LPI blog, HN discussion)
Self-Hosted: Genuinely Free for Unlimited Users
Section titled “Self-Hosted: Genuinely Free for Unlimited Users”Self-hosted NetBird Community Edition is completely free with no license fees, no per-user fees, and no hidden costs. All core features are included:
| Feature | Self-Hosted (Free) | Cloud Free | Cloud Team ($5-6/user/mo) | Cloud Business ($10-12/user/mo) |
|---|---|---|---|---|
| Users | Unlimited | 5 | Unlimited | Unlimited |
| Machines | Unlimited | 100 | 100 + 10/user | 100 + 10/user |
| P2P WireGuard | Yes | Yes | Yes | Yes |
| Access Controls | Yes | Yes | Yes | Yes |
| Network Routes | Yes | Yes | Yes | Yes |
| Private DNS | Yes | Yes | Yes | Yes |
| SSO/MFA (OIDC) | Yes (self-managed IdP) | Social SSO only | Enterprise IdP | Enterprise IdP |
| SCIM Provisioning | Enterprise license required | No | Yes | Yes |
| Device Approvals | Yes | No | No | Yes |
| MDM/EDR Integration | Yes | No | No | Yes |
| Device Posture Checks | Yes | No | No | Yes |
| Traffic Events Logging | Yes | No | No | Yes |
| Audit Events Streaming | Yes | No | No | Yes |
| Geo-distributed Relays | DIY | Yes | Yes | Yes |
| High Availability | DIY | Yes | Yes | Yes |
Features Gated Behind Enterprise License (Self-Hosted)
Section titled “Features Gated Behind Enterprise License (Self-Hosted)”- SCIM provisioning (auto-sync users from IdP) — requires commercial license for self-hosted
- Some enterprise-specific integrations may require contacting NetBird sales
What NetBird Enterprise Plan Adds (Cloud)
Section titled “What NetBird Enterprise Plan Adds (Cloud)”- Custom pricing (unlimited users + machines)
- Pay by invoice
- Custom support options with SLAs
- DORA compliance support
- On-premise installation support
- Custom integrations
License Change Note (Important)
Section titled “License Change Note (Important)”As of v0.53.0 (August 2025), NetBird’s server-side components (management/, relay/, signal/) moved from BSD-3 to AGPLv3. Client apps remain BSD-3. For self-hosters running internally, nothing changes — you can modify and run freely. The AGPL only triggers if you offer a modified NetBird as a service to others.
Sources: netbird.io/pricing, docs.netbird.io/manage/settings/plans-and-billing, docs.netbird.io/about-netbird/self-hosted-vs-cloud, netbird.io/knowledge-hub/netbird-agpl-announcement, WZ-IT comparison article (March 2026), LPI blog (March 2026)
Question 4: Microsoft Entra ID P1 Licensing
Section titled “Question 4: Microsoft Entra ID P1 Licensing”Confidence: VERY HIGH (verified via Microsoft official pricing page, SAMexpert guide, Microsoft Learn)
Pricing
Section titled “Pricing”- Standalone: $6.00/user/month (annual commitment)
- Entra ID P2: $9.00/user/month (standalone)
Included in These Bundles (No Additional Cost)
Section titled “Included in These Bundles (No Additional Cost)”| License Bundle | Price/user/mo | Entra ID Plan Included |
|---|---|---|
| Microsoft 365 Business Premium | $22.00 | P1 included |
| Microsoft 365 E3 | $36.00 | P1 included |
| Microsoft 365 F1 | $2.25 (rising to $3.00 July 2026) | P1 included |
| Microsoft 365 F3 | $8.00 | P1 included |
| Microsoft 365 E5 | $57.00 | P2 included |
| Enterprise Mobility + Security E3 | $10.60 | P1 included |
| Enterprise Mobility + Security E5 | $16.40 | P2 included |
| Office 365 E1/E3/E5 | $7.80-$35.80 | Free only (NO P1) |
GSISG Assessment
Section titled “GSISG Assessment”If GSISG uses Microsoft 365 Business Premium ($22/user/mo) or M365 E3 ($36/user/mo), Entra ID P1 is already included at no additional cost. This is common for companies with 100+ users in the engineering/construction sector.
If GSISG is on Office 365 E1/E3/E5 (NOT Microsoft 365), they only have Entra ID Free and would need to purchase P1 standalone at $6/user/month or upgrade to Microsoft 365.
SSPR (Self-Service Password Reset) requires P1 minimum — this is confirmed and well-documented.
Sources: microsoft.com/en-us/security/business/microsoft-entra-pricing, SAMexpert.com Entra ID licensing guide, learn.microsoft.com Entra licensing docs, Microsoft 365 Enterprise pricing page
Question 5: Total Cost of Ownership (TCO) Comparison
Section titled “Question 5: Total Cost of Ownership (TCO) Comparison”Confidence: MEDIUM-HIGH (based on verified component pricing, some estimates for labor)
Assumptions
Section titled “Assumptions”- 100 active users
- GSISG already has M365 Business Premium (Entra ID P1 included)
- No hardware refresh budget for PA-2020 replacement
- Internal IT labor: $75/hr loaded cost
- NetBird migration: ~80 hours initial setup, ~4 hours/month ongoing
- Current GlobalProtect: ~8 hours/month maintenance (on unsupported hardware)
Option A: Keep GlobalProtect on PA-2020 (Status Quo)
Section titled “Option A: Keep GlobalProtect on PA-2020 (Status Quo)”| Cost Category | Year 1 | Year 3 Cumulative | Year 5 Cumulative |
|---|---|---|---|
| Hardware (PA-2020, fully depreciated) | $0 | $0 | $0 |
| Subscriptions (expired, no renewal available) | $0 | $0 | $0 |
| IT Labor (maintenance, firefighting, 8 hrs/mo) | $7,200 | $21,600 | $36,000 |
| Risk-adjusted cost (see Q11) | $25,000-75,000 | $75,000-225,000 | $125,000-375,000 |
| Direct Cost Total | $7,200 | $21,600 | $36,000 |
| Risk-Adjusted Total | $32,200-82,200 | $96,600-246,600 | $161,000-411,000 |
Note: Direct costs appear low but ignore the enormous risk exposure of running unsupported, unpatched hardware with no active threat protection.
Option A-alt: Replace PA-2020 with New Palo Alto (PA-1420)
Section titled “Option A-alt: Replace PA-2020 with New Palo Alto (PA-1420)”| Cost Category | Year 1 | Year 3 Cumulative | Year 5 Cumulative |
|---|---|---|---|
| Hardware (PA-1420) | $5,000-8,000 | $5,000-8,000 | $5,000-8,000 |
| Subscription Bundle (annual) | $5,000-7,000 | $15,000-21,000 | $25,000-35,000 |
| Premium Support | $2,000-3,000 | $6,000-9,000 | $10,000-15,000 |
| IT Labor (8 hrs/mo) | $7,200 | $21,600 | $36,000 |
| Total | $19,200-25,200 | $47,600-59,600 | $76,000-94,000 |
Option B: Self-Hosted NetBird on Azure
Section titled “Option B: Self-Hosted NetBird on Azure”| Cost Category | Year 1 | Year 3 Cumulative | Year 5 Cumulative |
|---|---|---|---|
| Azure VM (B1ms, 1-yr reserved) | $290 | $870 | $1,450 |
| Azure Storage + Network | $112 | $336 | $560 |
| NetBird Software License | $0 | $0 | $0 |
| Migration Labor (80 hrs one-time) | $6,000 | $6,000 | $6,000 |
| Ongoing IT Labor (4 hrs/mo) | $3,600 | $10,800 | $18,000 |
| Entra ID P1 (assumed included in M365) | $0 | $0 | $0 |
| Total | ~$10,002 | ~$18,006 | ~$26,010 |
Option C: NetBird Cloud Managed (Team Plan)
Section titled “Option C: NetBird Cloud Managed (Team Plan)”| Cost Category | Year 1 | Year 3 Cumulative | Year 5 Cumulative |
|---|---|---|---|
| NetBird Team Plan (100 users x $5/mo) | $6,000 | $18,000 | $30,000 |
| Additional Machines (if >1100) | $0-600 | $0-1,800 | $0-3,000 |
| Migration Labor (60 hrs one-time) | $4,500 | $4,500 | $4,500 |
| Ongoing IT Labor (2 hrs/mo) | $1,800 | $5,400 | $9,000 |
| Entra ID P1 (assumed included in M365) | $0 | $0 | $0 |
| Total | ~$12,300 | ~$27,900 | ~$43,500 |
TCO Summary
Section titled “TCO Summary”| Option | Year 1 | Year 3 | Year 5 | 5-Year Savings vs PA-1420 |
|---|---|---|---|---|
| A: Keep PA-2020 (direct only) | $7,200 | $21,600 | $36,000 | — |
| A-alt: New PA-1420 | $22,200 | $53,600 | $85,000 | Baseline |
| B: Self-Hosted NetBird | $10,002 | $18,006 | $26,010 | ~69% savings |
| C: NetBird Cloud (Team) | $12,300 | $27,900 | $43,500 | ~49% savings |
Question 6: Compliance & Regulatory Requirements
Section titled “Question 6: Compliance & Regulatory Requirements”Confidence: HIGH (verified via CMMC/ITAR/SOC 2 documentation, state privacy law trackers)
Federal Compliance Frameworks
Section titled “Federal Compliance Frameworks”| Framework | Applicability to GSISG | VPN Relevance |
|---|---|---|
| SOC 2 | Voluntary but increasingly expected by clients | Requires encryption in transit, access controls, monitoring. Both GlobalProtect and NetBird satisfy this if properly configured. |
| CMMC | Only if GSISG handles DoD Controlled Unclassified Information (CUI) or Federal Contract Information (FCI). Common in engineering firms with government contracts. | CMMC Level 2 requires NIST 800-171 compliance: encrypted communications, MFA, access logging, incident response. NetBird with WireGuard encryption + Entra ID MFA meets these requirements. |
| ITAR | Only if GSISG handles defense-related technical data. Unlikely for general engineering/construction but possible if they serve defense clients. | Requires controlling access to technical data, encrypting data in transit, restricting access by citizenship/clearance. Self-hosted NetBird provides superior data sovereignty vs. cloud-managed solutions. |
State Data Protection Laws
Section titled “State Data Protection Laws”Hawaii:
- The Hawaii Consumer Data Protection Act (SB 1037) was introduced January 2025 but has not yet been enacted as of March 2026.
- Hawaii has no comprehensive state privacy law in effect.
- Standard data breach notification requirements apply.
- VPN Impact: Minimal — no specific VPN requirements beyond standard data protection.
Colorado:
- The Colorado Privacy Act (CPA) has been in effect since July 1, 2023.
- As of January 2026: 60-day cure period expired (immediate enforcement), universal opt-out mechanisms required.
- The Colorado AI Act (regulating algorithmic decisions) delayed to June 30, 2026.
- Colorado added precise geolocation and neural data as sensitive data categories.
- VPN Impact: The CPA applies to data controllers/processors handling Colorado residents’ data. VPN usage itself is not regulated, but the VPN must support the organization’s ability to protect personal data, honor opt-out requests, and maintain security controls. Both GlobalProtect and NetBird can support these requirements.
Construction/Engineering Industry Requirements
Section titled “Construction/Engineering Industry Requirements”- OSHA and construction safety regulations: No specific VPN requirements.
- AEC (Architecture/Engineering/Construction) firms with government contracts face increasing CMMC compliance pressure per Stambaugh Ness advisory (2025).
- If GSISG bids on federal projects, CMMC Level 1 (17 practices, self-assessment) or Level 2 (110 practices, third-party assessment) may apply.
Key Finding: Neither GlobalProtect nor NetBird has inherent compliance advantages. What matters is the implementation: encryption strength, MFA enforcement, access logging, and audit trails. NetBird with WireGuard encryption (ChaCha20-Poly1305 or AES-256-GCM) and Entra ID integration meets all applicable compliance requirements.
Sources: secureframe.com ITAR cybersecurity guide, stambaughness.com CMMC for AEC firms, vanta.com CMMC vs SOC 2, bakerdonelson.com 2026 privacy laws, hinshawlaw.com Colorado privacy regulations, wilmerhale.com state privacy law update (Hawaii SB 1037)
Question 7: Data Residency Implications
Section titled “Question 7: Data Residency Implications”Confidence: VERY HIGH (verified via NetBird architecture documentation, self-hosting guide, community articles)
NetBird Architecture — Control Plane vs. Data Plane Separation
Section titled “NetBird Architecture — Control Plane vs. Data Plane Separation”Management Server (Azure West US 2)├── Peer Registration & Authentication ← Metadata only├── Network Policy Distribution ← Metadata only├── STUN/TURN Coordination ← Metadata only└── Signal Service ← Connection setup signaling ↓ (metadata only, no user traffic)Peer-to-Peer WireGuard Tunnels ↓ (direct connections, encrypted end-to-end)User Traffic (never touches management server)What Passes Through the Management Server
Section titled “What Passes Through the Management Server”- Peer registration metadata: Machine name, IP assignment, group membership, last seen timestamp
- Authentication tokens: OIDC/OAuth tokens from Entra ID (short-lived)
- Network policy configurations: ACL rules, route configurations
- Signal exchange: ICE candidates (IP:port pairs) for connection establishment
- Connection events: Peer connected/disconnected timestamps
What Does NOT Pass Through the Management Server
Section titled “What Does NOT Pass Through the Management Server”- User traffic: ALL data traffic flows peer-to-peer via WireGuard tunnels. Even if direct P2P fails and traffic is relayed (via Coturn/WebSocket relay), the relay cannot decrypt the WireGuard-encrypted payload.
- File contents, application data, browsing activity: None of this touches the management server.
- Passwords or credentials: Authentication is handled by the IdP (Entra ID), not the NetBird management server.
Data Residency Assessment
Section titled “Data Residency Assessment”- Hosting the management server in Azure West US 2 keeps all metadata within US jurisdiction.
- With Entra ID as IdP, authentication data stays within Microsoft’s infrastructure (also US-hosted).
- No user traffic routes through Azure — it goes peer-to-peer between company devices.
- Self-hosting provides complete control over metadata residency, unlike cloud-managed solutions where metadata resides on NetBird’s infrastructure (currently hosted in the US/EU).
Sources: docs.netbird.io/about-netbird/how-netbird-works, docs.netbird.io/selfhosted/selfhosted-guide, dev.to/patrickbloemit self-hosting article, docs.netbird.io/selfhosted/selfhosted-quickstart
Question 8: NetBird Support Model for Self-Hosted
Section titled “Question 8: NetBird Support Model for Self-Hosted”Confidence: HIGH (verified via NetBird pricing page, docs, community forum, HN discussion)
Self-Hosted Support Tiers
Section titled “Self-Hosted Support Tiers”| Support Channel | Availability | Response Time | Cost |
|---|---|---|---|
| Community Forum (forum.netbird.io) | 24/7 (community-driven) | Hours to days (no SLA) | Free |
| Slack Community | 24/7 (community-driven) | Hours to days (no SLA) | Free |
| GitHub Issues | Bug reports accepted | Varies (no SLA) | Free |
| Documentation | Comprehensive self-hosting guides | Self-service | Free |
| Enterprise License | Contact sales@netbird.io | Custom SLA available | Custom pricing |
Cloud Plan Support Tiers (for comparison)
Section titled “Cloud Plan Support Tiers (for comparison)”| Plan | Support Type | Expected Response |
|---|---|---|
| Free | Community only | No SLA |
| Team ($5-6/user/mo) | Ticketing system | Business hours |
| Business ($10-12/user/mo) | Priority support | Faster response |
| Enterprise (custom) | Custom SLA, dedicated support | Contractual SLA |
Self-Hosted Enterprise Support
Section titled “Self-Hosted Enterprise Support”- NetBird offers a Commercial License for self-hosted deployments with enterprise needs
- Includes: SCIM provisioning, SLAs, custom support, on-premise installation assistance
- Pricing: Contact sales (not publicly listed)
- Third-party managed options exist: WZ-IT offers managed NetBird starting at €249.90/month with SLA guarantees
Risk Assessment
Section titled “Risk Assessment”- Community support is active but not guaranteed
- HN comments note that ~10-15% of users may experience intermittent client issues with self-hosted deployments
- NetBird has 10,000+ GitHub stars and active development (v0.61.0 as of January 2026)
- The AGPL license ensures the project remains open source
- Mitigation: For a 100-user deployment, consider purchasing the Enterprise license or a managed support agreement as insurance
Sources: netbird.io/pricing, forum.netbird.io, news.ycombinator.com discussion, WZ-IT managed NetBird pricing, docs.netbird.io/about-netbird/self-hosted-vs-cloud
Question 9: Top 5 Migration Risks and Mitigations
Section titled “Question 9: Top 5 Migration Risks and Mitigations”Confidence: HIGH (synthesized from VPN migration best practices, NetBird-specific considerations, industry reports)
Risk 1: Service Interruption During Transition
Section titled “Risk 1: Service Interruption During Transition”| Attribute | Detail |
|---|---|
| Likelihood | Medium |
| Impact | High (productivity loss for 100+ users) |
| Description | Users lose VPN connectivity during cutover, unable to access internal resources |
| Mitigation | Run NetBird and GlobalProtect in parallel for 2-4 weeks. Both can coexist on endpoints (different WireGuard interface vs. GlobalProtect adapter). Migrate users in waves (10-20 at a time). Keep GlobalProtect active until all users verified on NetBird. |
| Rollback | Simply reinstruct users to use GlobalProtect client (no uninstall needed) |
Risk 2: Authentication Failures with Entra ID Integration
Section titled “Risk 2: Authentication Failures with Entra ID Integration”| Attribute | Detail |
|---|---|
| Likelihood | Medium |
| Impact | High (users locked out of VPN entirely) |
| Description | OIDC misconfiguration, token expiry issues, Conditional Access policies blocking NetBird auth flow |
| Mitigation | Test OIDC integration thoroughly in staging with 5-10 pilot users. Document exact Entra ID app registration settings. Configure Conditional Access to explicitly allow NetBird. Test token refresh cycles over 24-48 hours before rollout. |
| Rollback | NetBird supports multiple IdP configurations. Fallback to local user accounts in emergency. |
Risk 3: Network Routing Conflicts
Section titled “Risk 3: Network Routing Conflicts”| Attribute | Detail |
|---|---|
| Likelihood | Medium-Low |
| Impact | Medium (some resources unreachable) |
| Description | NetBird WireGuard routes conflict with existing GlobalProtect routes or corporate subnet addressing. Split-tunnel configurations differ between platforms. |
| Mitigation | Map all current GlobalProtect split-tunnel routes before migration. Configure equivalent NetBird network routes. Test access to all critical internal resources (file shares, ERP, project management) from pilot group. Document IP overlap between WireGuard overlay (100.x.x.x) and corporate subnets. |
| Rollback | Remove NetBird client routes; GlobalProtect routes restore automatically |
Risk 4: User Productivity Loss / Change Management
Section titled “Risk 4: User Productivity Loss / Change Management”| Attribute | Detail |
|---|---|
| Likelihood | High |
| Impact | Medium (temporary productivity reduction) |
| Description | Users accustomed to GlobalProtect workflow resist change. Help desk ticket volume spikes. Non-technical construction/field users struggle with new client. |
| Mitigation | Create step-by-step installation guides with screenshots for Windows, macOS, iOS, Android. Record a 3-minute video walkthrough. Schedule a 30-minute training session per team. Designate per-team “VPN champions.” Provide dedicated help desk queue for first 2 weeks. |
| Rollback | N/A (user training is incremental, not reversible) |
Risk 5: Rollback Complexity if NetBird Fails
Section titled “Risk 5: Rollback Complexity if NetBird Fails”| Attribute | Detail |
|---|---|
| Likelihood | Low |
| Impact | High (return to unsupported PA-2020 or total VPN loss) |
| Description | If NetBird proves unsuitable post-migration and GlobalProtect has been fully decommissioned, reversing the change requires rebuilding the GlobalProtect infrastructure. |
| Mitigation | Do not decommission GlobalProtect until NetBird has been running successfully for 30+ days. Maintain GlobalProtect configuration backups. Document the PA-2020’s current configuration before any changes. Keep the PA-2020 powered on (but inactive) during transition period. |
| Rollback | Re-enable GlobalProtect on PA-2020 (same credentials, same config). Maximum RTO: 1 hour. |
Sources: exam-labs.com VPN failure anatomy, linkedin.com infrastructure migration risks, sentinelone.com VPN security risks, zscaler.com VPN replacement guide, general VPN migration best practices
Question 10: Insurance & Liability Considerations
Section titled “Question 10: Insurance & Liability Considerations”Confidence: HIGH (verified via Synergy Insurance/Accretive, Coalition Cyber Threat Index, Corvus Insurance, Zscaler VPN Risk Report)
Critical Finding: Self-Managed VPNs INCREASE Insurance Risk
Section titled “Critical Finding: Self-Managed VPNs INCREASE Insurance Risk”At-Bay reports that companies using self-managed VPNs are 11x more likely to experience a direct ransomware attack. Claims frequency for ransomware jumped 64% year-over-year.
Coalition’s Cyber Threat Index 2025 found that 58% of ransomware claims started with threat actors compromising perimeter security appliances (VPNs or firewalls), and 60% of cyber insurance claims from ransomware involved VPN exploitation.
Current Insurance Impact (Staying on PA-2020)
Section titled “Current Insurance Impact (Staying on PA-2020)”- Running an end-of-life, unsupported VPN appliance is a significant underwriting concern
- Insurers are increasingly requiring:
- Phishing-resistant MFA on VPN
- Regular patching (impossible on EOSL hardware)
- Zero Trust architecture or ZTNA adoption
- Endpoint security integration
- Network segmentation
- Companies with self-managed VPNs face: higher scrutiny, additional security assessments, increased premiums, or coverage limitations
- Some policies include open source software exclusions that could restrict coverage for OSS-related vulnerabilities
Migration Impact on Insurance
Section titled “Migration Impact on Insurance”| Factor | PA-2020 (Current) | NetBird (Post-Migration) |
|---|---|---|
| Supported software | No (EOSL 2020) | Yes (active development) |
| Encryption standard | Aging (IPsec) | Modern (WireGuard, ChaCha20/AES-256) |
| MFA integration | Limited | Full Entra ID integration |
| Zero Trust architecture | No (perimeter-based) | Yes (identity-based, P2P) |
| Attack surface | Large (exposed VPN gateway) | Minimal (no listening ports, NAT traversal) |
| Patching posture | Unpatched (EOSL) | Auto-updates available |
| Underwriter perception | Negative | Neutral to Positive |
Recommendations for Insurance
Section titled “Recommendations for Insurance”- Document the migration as a security improvement initiative
- Notify your cyber insurance broker of the migration to ZTNA — this may result in premium reduction
- Maintain documentation of NetBird’s security controls (WireGuard encryption, Entra ID MFA, access policies)
- Consider the open source risk: While NetBird uses open source, the key risk factors insurers evaluate are patching cadence, vulnerability management, and MFA — not whether the software is open source per se
- The 2025 Zscaler ThreatLabz VPN Risk Report found 96% of organizations are adopting zero trust strategies — migration aligns GSISG with industry direction
Sources: synergy-ins.com VPN Security Risks & Cyber Insurance, accretive-ins.com VPN insurance article, insurance-canada.ca Coalition Cyber Threat Index 2025, corvusinsurance.com open source cybersecurity risks, coverlink.com VPN vulnerabilities, zscaler.com 2025 VPN Risk Report, responsivetechnologypartners.com cyber insurance evolution
Question 11: Opportunity Cost of NOT Migrating
Section titled “Question 11: Opportunity Cost of NOT Migrating”Confidence: HIGH (verified via GreyNoise credential-spraying data, industry breach cost data, EOSL risk analysis)
Active Threat: Credential-Spraying Campaign
Section titled “Active Threat: Credential-Spraying Campaign”In December 2025, GreyNoise detected a massive credential-spraying campaign specifically targeting Palo Alto Networks GlobalProtect portals:
- 1.7 million login attempts in a 16-hour window
- 10,000+ unique source IPs (primarily from 3xK GmbH, Germany)
- Targets: US, Mexico, Pakistan infrastructure
- Method: Automated scripted credential probing
- Goal: Identify weakly protected GlobalProtect portals
This campaign is ongoing and specifically targets the exact technology GSISG is running.
Risk-Adjusted Cost of Staying on PA-2020
Section titled “Risk-Adjusted Cost of Staying on PA-2020”| Risk Scenario | Probability (Annual) | Impact | Expected Loss |
|---|---|---|---|
| Successful credential compromise | 15-25% | $50,000-150,000 | $7,500-37,500 |
| Ransomware via VPN exploitation | 5-10% | $200,000-500,000 | $10,000-50,000 |
| Data breach (client/project data) | 3-5% | $100,000-300,000 | $3,000-15,000 |
| Regulatory penalty (if PII exposed) | 1-2% | $50,000-200,000 | $500-4,000 |
| Cyber insurance claim denial (EOSL) | 10-20% | $100,000-300,000 | $10,000-60,000 |
| Annual Expected Risk Cost | $31,000-166,500 |
Probability estimates are based on:
- At-Bay: Self-managed VPNs = 11x ransomware risk
- Coalition: 58% of ransomware claims involve VPN/firewall compromise
- GreyNoise: Active targeting of GlobalProtect specifically
- EOSL: No patches available for any future CVE
Compounding Factors
Section titled “Compounding Factors”- No security updates: Any new CVE affecting PAN-OS 8.1 or the PA-2020 hardware will NEVER be patched
- No threat intelligence: Without active Threat Prevention/WildFire subscriptions, the device provides zero content inspection
- Increasing attack sophistication: AI-powered credential spraying is making attacks more targeted
- Insurance exposure: Running EOSL hardware may void cyber insurance coverage or result in claim denial
- Compliance gap: EOSL hardware cannot meet CMMC, SOC 2, or other framework requirements for current/patched systems
Bottom Line
Section titled “Bottom Line”The risk-adjusted cost of staying on the PA-2020 is $31,000-166,500 per year. Compare this to the NetBird migration cost of ~$10,000 in year 1 and ~$4,000/year ongoing. Every month of delay increases cumulative risk exposure.
Sources: bleepingcomputer.com password spraying attacks, cybersecuritydive.com credential-based hacking, blog.intelligencex.org credential-spraying campaign, greynoise.io credential campaign analysis, mojoauth.com VPN attack reporting, ampcuscyber.com credential stuffing analysis
Gaps & Uncertainties
Section titled “Gaps & Uncertainties”| Gap | Impact | How to Resolve |
|---|---|---|
| GSISG’s exact M365 licensing tier | Determines if Entra ID P1 is already included (affects TCO by $0-7,200/yr) | Ask GSISG IT admin for current M365 licensing |
| Exact PA-2020 subscription status | Cannot confirm which (if any) subscriptions are still active | Check Palo Alto support portal or ask GSISG admin |
| GSISG’s current cyber insurance policy | Cannot assess specific exclusions or EOSL impact | Request current policy from GSISG broker |
| CMMC/ITAR applicability | Unknown if GSISG holds DoD contracts requiring CMMC | Ask GSISG about federal contract portfolio |
| Azure B1ms reserved pricing (exact) | Azure pricing pages load dynamically; used calculated estimates based on documented % savings | Verify via Azure pricing calculator for exact current rates |
| Internal IT labor rate | Used $75/hr estimate; actual may vary | Confirm with GSISG finance/HR |
| NetBird Enterprise license cost | Not publicly listed | Contact sales@netbird.io for quote |
| Hawaii privacy law status | SB 1037 introduced Jan 2025, current status unclear | Check Hawaii state legislature website |
Sources & Tool Usage Log
Section titled “Sources & Tool Usage Log”Tavily Search (14 queries)
Section titled “Tavily Search (14 queries)”- Palo Alto PA-2020 subscription costs and renewal pricing
- Azure B1ms VM pricing West US 2
- NetBird self-hosted licensing model
- Microsoft Entra ID P1 licensing and M365 bundling
- Engineering/construction compliance (SOC 2, CMMC, ITAR)
- Cyber insurance and open source VPN considerations
- PA-2020 end of life/end of sale dates
- NetBird management server architecture and data residency
- NetBird self-hosted support model
- Hawaii and Colorado state data protection laws
- GlobalProtect credential-spraying attacks and legacy VPN risks
- VPN migration risks and mitigations
- Azure B1ms reserved instance pricing
- NetBird self-hosted vs cloud feature comparison
Exa Web Search (2 queries)
Section titled “Exa Web Search (2 queries)”- Palo Alto PA-2020 subscription bundle pricing
- Cyber insurance + open source VPN + self-managed VPN risk
WebFetch (2 attempts)
Section titled “WebFetch (2 attempts)”- Azure VM pricing page (failed — dynamic content)
- itprice.com PA-2020 pricing (failed — 403)
Key Source URLs
Section titled “Key Source URLs”- PA-2020 EOSL: https://www.parkplacetechnologies.com/eosl/palo-alto-networks/pa-2020/
- Azure B1ms Pricing: https://cloudprice.net/vm/Standard_B1ms
- NetBird Pricing: https://netbird.io/pricing
- NetBird Self-Hosted vs Cloud: https://docs.netbird.io/about-netbird/self-hosted-vs-cloud
- NetBird Architecture: https://docs.netbird.io/about-netbird/how-netbird-works
- Entra ID Pricing: https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
- Entra ID Licensing Guide: https://samexpert.com/entra-id-licensing-guide/
- Credential-Spraying Campaign: https://www.bleepingcomputer.com/news/security/new-password-spraying-attacks-target-cisco-pan-vpn-gateways/
- VPN Insurance Risk: https://www.synergy-ins.com/news-and-insights/vpn-security-risks-and-cyber-insurance/
- Coalition Cyber Threat Index: https://insurance-canada.ca/2025/03/17/coalition-cyber-threat-index-vpn-devices/
- CMMC for AEC Firms: https://www.stambaughness.com/blog/why-government-contractors-must-act-now-for-cmmc-compliance/
- 2026 State Privacy Laws: https://www.bakerdonelson.com/privacy-laws-ring-in-the-new-year-state-requirements-expand-across-the-us-in-2026
- NetBird AGPL Announcement: https://netbird.io/knowledge-hub/netbird-agpl-announcement
- Zscaler 2025 VPN Risk Report: https://www.zscaler.com/learn/2025-vpn-risk-report