Buyer's Guide: Zero Trust Network Access (ZTNA)

Executive Summary

Zero trust network access (ZTNA) is the product category that applies zero trust to remote and on-site access to private applications. A user signs in, the service checks the user and the device, and a broker connects that user to the one application the policy allows. The applications are not reachable from the internet, and the user never joins the network.

The definition of zero trust comes from NIST Special Publication 800-207. NIST describes zero trust as an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. NIST states that zero trust assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location or on asset ownership, and that authentication and authorization of both subject and device are performed before a session to an enterprise resource is established. ZTNA is the name vendors use for products that apply that rule to access to private applications.

ZTNA providers fall into six approaches, by where each vendor started: a security cloud built for web traffic, a firewall vendor’s SASE service, a networking vendor’s security service edge, an edge network, an identity platform, or a SASE platform built as one system. The table in the vendor section names eight providers across those six approaches. Most sell ZTNA as one module of a security service edge (SSE) or SASE platform, so the choice of ZTNA provider often decides the web gateway and the CASB as well.

What Is Zero Trust Network Access?

Zero trust is a set of principles, and ZTNA is one product that applies them. NIST states that zero trust focuses on protecting resources, not network segments, because network location is no longer seen as the prime component of a resource’s security posture. NIST describes zero trust as a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud-based assets that are not located within an enterprise-owned network boundary.

CISA, the US Cybersecurity and Infrastructure Security Agency, frames zero trust around access decisions. CISA states that zero trust provides concepts designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in the face of a network viewed as compromised, with the goal of making access control enforcement as granular as possible. CISA describes its Zero Trust Maturity Model as one of many roadmaps agencies can reference as they transition towards a zero trust architecture, with five pillars and three cross-cutting capabilities, and examples of traditional, initial, advanced, and optimal zero trust architectures within each pillar. ZTNA covers the access decision for users and devices reaching applications. Identity, device management and data protection are separate pillars that ZTNA reads from but does not replace.

A ZTNA service has three parts. A policy decides which user, on which device, may reach which application. An enforcement point, in the vendor’s cloud or on your premises, applies that policy to each connection. A connector beside the application opens an outbound link to the service, so the application needs no inbound port open to the internet.

A VPN gateway accepts connections from the internet, and a user it admits reaches the network behind it. CISA reported widespread and active exploitation of vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure, which allows a threat actor to move laterally, exfiltrate data and establish persistent system access. CISA required agencies running Ivanti Connect Secure or Ivanti Policy Secure to disconnect all instances of those products from agency networks no later than February 2, 2024. A ZTNA connector makes only outbound connections, and a user it admits reaches one application.

ZTNA vs VPN, and Where ZTNA Sits in SSE and SASE

A remote access VPN builds an encrypted tunnel from the device to a gateway, and the user then reaches whatever the network allows. ZTNA builds a connection from the user to one application, after a policy check, and the network stays out of reach.

Devices connect in one of two ways. Cato Networks states that ZTNA solutions can be agent-based or service-based. An agent on a managed laptop can carry any TCP or UDP traffic and report device health. A clientless, browser-based session suits contractors and personal devices, where no agent can be installed, and usually covers web applications plus browser-based SSH and RDP. Cato Networks describes a cloud-based service that supports both managed and unmanaged devices via a reverse proxy.

Enforcement can run in the vendor’s cloud or on your own premises. Cloud enforcement suits remote users. On-premises enforcement keeps traffic local for users in the office and for sites with poor internet links. Fortinet states that the ZTNA application gateway in FortiOS acts as an enforcement point and the ZTNA agent in FortiClient provides the device posture and SSO. Fortinet states that for existing Fortinet customers the ZTNA capabilities are not licensed but are incorporated into the operating system.

ZTNA is one service in a security service edge (SSE), next to the secure web gateway and the cloud access security broker (CASB). SASE adds the network: SD-WAN for branches, under the same policy. Buying ZTNA from an SSE or SASE vendor commits the web gateway and CASB decisions too. The CASB guide covers SaaS and data controls, the SD-WAN guide covers the network side of SASE, and the enterprise browser guide covers browser-based access for unmanaged devices.

How do you evaluate Zero Trust Network Access (ZTNA)?

Start with the identity provider. The policy is only as good as the groups and sign-in signals it reads, so test each provider with your own identity provider, your MFA and your groups, not a demo tenant.

Then test protocol coverage. Web applications are the easy case. Thick clients, RDP, SSH, file shares, and traffic that starts from the server, such as VoIP calls and software distribution, decide whether the VPN can be switched off. List every application that still runs over the VPN and test the hardest ones first.

Device posture comes next. Ask which signals each provider reads (disk encryption, firewall state, an EDR agent, a corporate certificate), whether it checks them only at sign-in or again during the session, and what it does when a check fails mid-session.

Placement and resilience close the list: where the enforcement points are relative to your users and applications, whether users in the office can be enforced locally, and what users can reach if the provider’s cloud is unreachable.

Vendors in Zero Trust Network Access (ZTNA)

Representative vendors include Cato Networks, Check Point Harmony SASE, formerly Perimeter 81 (Check Point SASE), Cisco Secure Access, Cloudflare Access / Cloudflare One, Microsoft Entra Private Access, Netskope One Private Access, Palo Alto Prisma Access (Palo Alto Networks) and Zscaler Private Access / ZPA. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The ZTNA providers below are grouped by where each vendor started. Ask every vendor to confirm in writing which modules, regions and support levels the quote includes.

Two vendors built ZTNA on a security cloud they first ran for web traffic. Zscaler states that ZPA brokers direct, one-to-one connections between authorized users and specific apps, and that unlike with a VPN, users never access the corporate network and apps are never exposed to the public internet. Zscaler offers remote workers and third parties clientless remote access to RDP, SSH, and VNC production systems. Zscaler states that it discovers applications automatically and gives AI-generated recommendations on app segments and policies. Netskope describes Netskope One Private Access as the foundation of Netskope’s Universal ZTNA, replacing outdated VPNs, as well as complex network access control and virtual desktop systems. Netskope states that Netskope One Private Access supports SSH and RDP, as well as server-initiated traffic such as voice over IP (VoIP) and Microsoft system center configuration manager (SCCM). Netskope states that it performs continuous posture assessment, checking for markers such as disk encryption, active firewalls, or corporate certificates. Netskope states that its Local Broker extends ZTNA to on-prem and OT environments and avoids cloud hairpinning.

Firewall vendors deliver ZTNA from their SASE services. Palo Alto Networks describes ZTNA 2.0 as fine-grained, least-privileged access combined with continuous trust verification and deep, ongoing security inspection. Palo Alto Networks states that once access to an app is granted, trust is continually monitored to identify changes in device posture, user behavior and app behavior, with App-ID, User-ID and Device-ID technologies. Palo Alto Networks states that ZTNA Connector for Prisma Access provides automatic app discovery, automated onboarding and tunnel management to connect organizations to their private applications. Check Point announced the completion of its acquisition of Perimeter 81, a Security Service Edge (SSE) company. A request for perimeter81.com is answered by sase.checkpoint.com, the Check Point SASE site. Check Point now names the product Check Point SASE Platform, formerly Harmony SASE. Check Point offers Full-Mesh Private Access: zero trust private access from any user or site to any user, site, or resource. Check Point states that Check Point SASE uses a hybrid architecture with on-device and cloud security inspection options.

A networking vendor sells ZTNA as part of its security service edge. Cisco states that ZTNA applies least-privilege principles, contextual insights, and client or clientless-based methods to deny access by default and allow access to apps when granted, and that VPN as a Service (VPNaaS) extends coverage to non-ZTNA-enabled apps. Cisco states that Secure Access is augmented by Duo and identity intelligence. Cisco states that Cisco Secure Access achieves FedRAMP class D (HIGH) certification, and describes a unified Secure Service Edge (SSE) platform for Secure Internet Access, VPNaaS and ZTNA to private applications. Cisco states that Experience Insights, powered by ThousandEyes, delivers end-to-end digital experience monitoring for users and apps.

An edge network provider runs ZTNA as a proxy in front of each application. Cloudflare states that Cloudflare Access acts as an identity-aware proxy that sits in front of an application and checks each request against Access policies before allowing it through. Cloudflare lists protection for self-hosted, SaaS, and non-web (SSH, VNC, RDP) apps, internal IPs and hostnames, or any arbitrary L4–7 TCP or UDP traffic. Cloudflare lists clientless access for web apps and browser-based SSH or VNC. Cloudflare describes Cloudflare One as its single-vendor SASE platform, which converges zero trust security services with network services, including Magic WAN and Firewall.

An identity platform extends its sign-in policy to network access. Microsoft states that Microsoft Entra Internet Access and Microsoft Entra Private Access comprise Microsoft’s Security Service Edge (SSE) solution. Microsoft states that Microsoft Entra Private Access builds on Microsoft Entra application proxy and extends access to any private resource, port, and protocol, and that the service offers per-app adaptive access based on Conditional Access policies. Microsoft states that users of Microsoft Entra Private Access need a Microsoft Entra ID P1 or Microsoft Entra ID P2 license.

A SASE platform built as one system runs ZTNA beside its other services. Cato Networks states that its Single Pass Cloud Engine (SPACE) converges NGFW, threat prevention, and CASB/DLP/ZTNA into one cloud-native stack. Cato Networks states that NGFW, CASB, DLP, ZTNA, threat prevention, and AI controls run on a single policy engine. Cato Networks states that with SASE the ZTNA controller function becomes part of the SASE PoP and there is no need for an SDP connector.

Eight ZTNA providers across six approaches; the first two approaches have two each. The approaches were written before any provider was placed in one, and every provider from the previous edition of this guide was kept. A row in this table cannot be bought. Fortinet, Akamai, Google and Versa Networks were also checked for this edition, and any ZTNA provider can present its own case in the Spotlight below.

How much should you budget for Zero Trust Network Access (ZTNA)?

ZTNA is sold as a subscription per user per year. Most providers sell it inside an SSE or SASE bundle, so the per-user price depends on which other modules are in the bundle: web gateway, CASB, DLP, digital experience monitoring. Compare quotes for the same modules and the same number of users.

Two providers in the table publish list prices in US dollars. Cloudflare lists a Free Plan at $0, best for teams under 50 users or enterprise proof-of-concept tests, and Pay-as-you-go at $7 per user/month, paid annually. Cloudflare lists its Contract Plan at a custom price. Microsoft lists the Microsoft Entra Suite at $12.00 user/month, paid yearly. Microsoft states that Microsoft Entra Private Access capabilities are included in the Microsoft Entra Suite license and standalone.

Licensing terms matter as much as the rate. Palo Alto Networks allows customers to exceed their purchased mobile user license for temporary emergencies without preventing connections or charging for emergency usage. Ask each provider what happens when users exceed the licensed count, and whether contractors count as users.

Costs outside the subscription are connector hosts in each data center and cloud, the identity and device management licenses the policy depends on, and the staff time to write a policy for each application.

How long does implementation take for Zero Trust Network Access (ZTNA)?

A ZTNA rollout runs alongside the VPN, one group of applications at a time, until nothing is left on the VPN.

What should you ask vendors about Zero Trust Network Access (ZTNA)?

Ask each provider to answer in writing and to demonstrate on your own identity provider and applications.

Zero Trust Network Access (ZTNA) RFP package: 115 questions, 10 demo scenarios and a vendor scorecard

RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.

Related Resources