Glean year-zero cost: what a 500-seat deployment actually burns before the first renewal

Field notes from customer-program conversations. The cost lines nobody quotes in the order form — paid POC, security review, identity integration, connector configuration, internal FTE — sized month by month for a hypothetical 500-seat rollout.

Publisher disclosure: This site is published by ASCENDING, which builds Jarvis AI — a competing platform. The month-by-month picture below draws on customer-program conversations we ran through late 2025 and early 2026 with both Glean customers and customers running comparable enterprise AI search platforms; the Glean line items are sized against third-party pricing analyses including Workativ's Glean pricing breakdown and the Vendr marketplace listing. Where the pattern is the same across vendors, I've said so. The Jarvis comparison appears only at the end and is flagged.

The first time I saw a Glean deployment land with the full year-zero bill itemized was a 540-seat customer in Q3 2025. The CFO had approved the order form — $45 per seat, a 10% support fee, the standard three-year ramp. License math, on the order form, came out to roughly $290K year one. The CFO believed that number. The CFO believed it until the deployment was twelve weeks in and a separate spreadsheet started landing in his inbox every two weeks with line items he'd never seen on the original quote.

Twenty-eight weeks later, when we sat down with him to review what the program had actually cost, the number was $410K. The license bill had not changed. Everything else had.

This is the field-note version of where that $120K delta lives. It's not Glean-specific in shape — every enterprise AI search platform has a year-zero picture that doesn't fit on the order form — but the line items below are specifically Glean's, and the dollar ranges are what I've seen across the customer conversations.

The cost line nobody quotes

The Glean order form quotes license. Sometimes it quotes a 10% support fee. Sometimes, on a multi-year deal, it quotes an implementation services line at 12-15% of year one license value. What it never quotes — because Glean cannot quote it on your behalf — is the work that happens on your side of the contract.

That work, on a 500-seat deployment, lands somewhere between $115K and $175K in year zero, before the license clock starts ticking on month four. It's not optional. It's the cost of getting from the signed order form to a production deployment that survives the first security review. The teams that try to skip it ship a deployment that looks fine on the launch announcement and starts unraveling around month nine.

I'm going to walk through the five major categories — the paid POC, the security review hours, the identity integration, the connector configuration, the internal FTE — and then put them in a month-by-month table for a hypothetical 500-seat rollout.

The paid POC: what $70K actually buys

Glean's reported paid POC sits at roughly $70K for a 6-8 week engagement against a 200-seat user group, with the figure consistent across third-party reads at Workativ's Glean pricing breakdown, the Vendr marketplace listing for Glean, and GoSearch's pricing explainer. The fee is non-refundable, structured as a pre-license commitment, and typically credited against year one license if you sign within 60 days of POC completion. (If you don't sign in that window, the credit usually evaporates. Read the credit language carefully.)

What $70K buys, in practice: a configured Glean tenant in your environment, two to four connectors fully indexed, a designated Glean implementation engineer on a shared Slack channel for the duration, a kickoff workshop, a midpoint review, and a closing readout with usage data. It does not buy production hardening. It does not buy connector configuration beyond the initial set. It does not buy your security review.

Where the POC genuinely earns its $70K: the indexed corpus and the usage data. By week four you have a real signal on what your team actually searches for, what the answer quality looks like against your specific Confluence and SharePoint, and whether the model surfaces the documents you'd expect. That signal is worth the fee on its own — it's the only way to size the FlexCredits pool, the connector list, and the production seat count without guessing.

Where the POC under-delivers: the connector breadth and the production architecture conversations. Two to four connectors in 6-8 weeks is fast. It's also a small fraction of what your production deployment will need, and the engineering shortcuts taken during the POC do not always survive scaling to the production connector set.

Internal FTE hours nobody invoices for

This is the category that doesn't show up on any invoice and accounts for the largest chunk of the year-zero cost delta. The work falls across four roles, and the hours are real.

Project lead. Two to three hours per week through the POC window, scaling to ten to fifteen hours per week during the production rollout. Owns the timeline, the stakeholder map, the connector prioritization, and the executive readouts. Usually pulled from IT operations or a program-management function. Annualized cost in the $150K-200K range fully loaded; the year-zero portion runs roughly $35K-50K.

Identity engineer. Concentrated burst — typically 40-80 hours over a 4-6 week window — to configure SAML SSO, set up SCIM provisioning, and reconcile the directory groups against Glean's permission model. Pulled from IT-security or platform engineering. Annualized cost in the $180K-230K range; the year-zero portion is roughly $7K-15K.

Data and content owner liaisons. Variable, but a 500-seat deployment that spans engineering, sales, support, and HR will pull 80-150 hours total across content owners answering questions about which sources to connect, which sites to exclude, and how to handle sensitive content. The hours are scattered across multiple people, which makes them harder to track and easier to dismiss as overhead.

Platform admin (transitioning to ongoing role). The named owner who picks up the platform post-launch. In year zero, this is 60-100 hours during the rollout. Past month six, this transitions to the steady-state FTE pattern covered in the Glean admin staffing model, where 500 seats sits at roughly 0.5-0.75 FTE ongoing.

Total internal FTE hours in year zero on a 500-seat deployment land in the 320-450 hour range. At blended internal cost between $120 and $180 per hour, that's $40K-80K of capacity, drawn from people who already have full job descriptions elsewhere.

Security review: the 80-150 hour reality

Security review is where the timeline most often surprises the project lead. The expected version is "two-week security review, sign-off, move to production." The actual version is 80 to 150 hours of work spread across security, legal, privacy, and (in regulated industries) compliance, running concurrently with the POC and continuing past it.

The work breaks down across four threads.

Vendor security questionnaire. Glean ships a SIG Lite or a SOC 2 Type II report; your security team will still send a custom questionnaire with 80-200 questions. Expect 15-25 hours of back-and-forth for a mid-size enterprise. For a healthcare or financial services buyer, double that.

Data flow review. Where does your data go, who processes it, where does inference run, what does the retention story look like, what happens at termination. Typically 20-40 hours of legal-and-security review against the Glean documentation, with one or two structured calls with Glean's security team to clarify edge cases.

BAA or DPA negotiation. For healthcare buyers, the BAA negotiation lands in the 25-60 hour range across legal and privacy, depending on whether you're on Glean's standard BAA or pushing for the Protect Plus BAA scope (which I covered separately at Glean Protect Plus governance audit). For non-healthcare US enterprises, a DPA negotiation runs lighter — 15-25 hours.

Penetration test and architecture review. Some enterprises require an architecture review before signing; some require a third-party pen test on the tenant configuration. Either adds another 20-40 hours of internal time plus, occasionally, an external vendor fee in the $10K-25K range.

Total: 80-150 hours of internal time, with external fees adding $0-40K depending on whether the architecture review pulls in outside counsel or an external pen test. The blended internal cost lands at $15K-30K; the external fees vary widely.

Identity integration: the invisible quarter

The identity integration story is where the timeline can stretch unexpectedly. The happy path is simple: connect Glean to Okta or Entra via SAML, configure SCIM provisioning, map the directory groups to Glean permission scopes, and ship. Two weeks, done.

The unhappy path, which is what most enterprises actually run, is the quarter-long version. The reasons it stretches: legacy directory data that doesn't map cleanly to current org structure, group membership that's been drifting since the last reorg, SCIM provisioning that conflicts with another tool's provisioning model, an MFA enforcement that needs custom configuration for the Glean callback URL, or a contractor-population identity story that's never been formalized and now has to be.

In the customer conversations I've sat in on, the identity integration timeline median is six weeks for a clean enterprise, ten to twelve weeks for an enterprise with directory debt. The hours total runs 40-80 in the clean case, 80-160 in the messy case. The dollar cost lands in the $7K-30K range, depending on whether the work is internal or whether an external Okta or Entra partner gets pulled in.

The reason identity integration matters more than the hours suggest: Glean's access-control model is downstream of your directory. Every Confluence space, SharePoint site, and Salesforce record that Glean indexes inherits its access rules from your identity provider. A messy directory at the identity layer produces messy access at the Glean layer, and the cleanup work that should have happened before launch instead happens as a series of access-control incidents in month five.

Year-zero P&L for a 500-seat deployment

The month-by-month picture, for a hypothetical 500-seat deployment kicking off in January with production launch targeted for July.

The cash portion of the year-zero P&L lands at roughly $300K-425K. The internal capacity portion lands at $115K-175K. Combined, the year-zero burn on a 500-seat Glean deployment runs $415K-540K, against a $290K license-only quote on the order form.

The month-by-month rhythm matters as much as the totals. Month 1: order form signs, security review kicks off, identity engineering scopes. Months 2-3: paid POC runs concurrently with security review; data-flow questions surface. Month 4: production kickoff, license clock starts, identity integration in flight. Months 5-6: connector rollout, content-owner workshops, first access-control incidents. Month 7: most enterprises declare "production" here — the announcement, the all-hands, the email from the CEO. Months 8-12: optimization, the FlexCredits pool true-up, the first quarterly governance review, the connector queue, the first user complaints about answer quality.

The teams that hit month seven on budget and on timeline are the teams that mapped the full picture above into the business case before the order form signed. The teams that hit month seven over budget are the teams that read "year one license $290K" and stopped reading.

Three things that go wrong in year one if year zero was skimped

The pattern repeats often enough to call it out.

Access-control incidents in month five. If the identity integration was the rushed three-week version instead of the proper six-week version, the access-control inheritance from your directory into Glean lands wrong. Documents surface to people who shouldn't see them. The incident response burns a week of platform-admin time and surfaces with HR, legal, or the CISO — usually all three. The cost is two weeks of remediation and a slow-burn loss of trust in the platform that takes months to repair.

FlexCredits overrun in month nine. If the POC didn't size the credit pool against realistic production usage (which it usually doesn't, because the POC user group is 200 seats and the production deployment is 500), the FlexCredits pool runs out faster than planned and the overage charges hit at 1.5x the in-pool rate. A pool sized at $50K that should have been $75K produces a $37K-50K overage by year end, against a number the CFO never approved.

Renewal leverage evaporates in month eleven. Year-two renewal conversations start at the 60-day mark before year-one anniversary, which on a January start is November. If the deployment is still ramping in November because year zero was skimped and production didn't actually land until October, you have no usage data to negotiate against and no credible walk-away threat. The renewal quote lands with the standard 7-12% escalator and you sign because the alternative is another 90 days of evaluation work you didn't budget for.

The deeper read on each of these is in the broader pricing teardown at Glean pricing in 2026 and the cheaper paths to the same outcome, which sizes the line-by-line three-year TCO and the per-seat math against several alternatives. The 100-seat-minimum question — and what it means for organizations that fall below the floor and try to over-provision their way past it — is covered at the Glean 100-seat minimum analysis. The platform-admin FTE math that picks up where this article leaves off, including the 0.5-0.75 FTE steady state at 500 seats and what the role actually does week to week, is at the Glean admin staffing model. And for the broader pricing teardown including how the three-year TCO lands at roughly $350K-480K once year zero is amortized into a 500-seat deployment with the agentic add-on at $15 per seat and the 7-12% renewal escalator baked in, see again Glean pricing alternatives.

The honest version of the year-zero pitch: if you're building the business case, the right number to bring to the CFO is not the order form. It's the order form plus the cash side of the table above plus the internal-FTE side. Bring all three. The CFO will appreciate the honesty more than the surprise.

FAQ

Why doesn't Glean quote the paid POC as creditable against year-one license upfront? They often do, with conditions. The catch is the credit usually requires signing within 60 days of POC completion, and the credit terms are negotiable. The conditions are typically in the order form annex rather than the headline price, which is why they get missed.

Can the security review run in parallel with the paid POC? Usually yes, and it should. The teams that try to run security review after the POC end up with a six-to-ten-week gap before production kickoff that nobody budgeted for. Running them in parallel compresses the timeline by a quarter.

Is the $70K POC fee negotiable? On smaller deals, yes — we've seen 30-50% reductions. On a 500-seat deal with a multi-year commit, the more common move is to keep the $70K and negotiate a bigger credit against year-one license. Either way, ask. The fee is a starting position.

How does the internal FTE picture change for a 100-seat deployment? The hours scale down, but not linearly. A 100-seat deployment still runs 200-300 internal hours in year zero because the security review, identity integration, and connector configuration don't shrink proportionally. The per-seat year-zero internal cost is actually higher for smaller deployments, which is part of why the 100-seat minimum becomes punitive — see the Glean 100-seat minimum analysis.

What's the equivalent year-zero picture for a Jarvis-class platform? Different shape, and worth detailing because the comparison is where the year-zero budgeting work actually gets pressure-tested. The cash side typically runs lower because there is no $70K paid POC fee (ASCENDING does free pilots at the Starter and Pro tiers on the AWS Marketplace listing), the support fee structure is different from Glean's 10% standard, and the identity integration is broadly similar in hours since the SAML SSO and SCIM provisioning steps don't change much by vendor. The internal FTE side runs roughly the same — the security review, content-owner engagement, and platform-admin ramp aren't vendor-specific in shape, even if the deliverables they produce differ. The honest version is that year-zero burn on a registry-and-gateway architecture lands $50K-100K below Glean's at comparable seat counts, with the gap coming primarily from the POC fee and the support-fee math. We publish the full pricing detail on the Jarvis product page.

About ASCENDING

ASCENDING is an AWS Advanced Consulting Partner founded in 2018 in Fairfax, Virginia. We build Jarvis AI — a governance-first, MCP-native agent platform — and we publish this site as an independent industry resource. If you want to pressure-test the year-zero P&L above against your specific deployment, talk to us. We'd rather you do the math than take our word.