Published October 28, 2026
Zero trust network access (ZTNA) gives users access to specific private applications after checking their identity and device, instead of placing them on the corporate network as a VPN does. In the products covered here, a cloud service brokers each connection. Vendors sell it on its own and as part of security service edge (SSE) and secure access service edge (SASE) platforms.
Where the market stands
NIST published SP 800-207, Zero Trust Architecture, in August 2020. It says zero trust grants no implicit trust to users or devices based on their network location.
On January 26, 2022, the Office of Management and Budget issued memorandum M-22-09, a federal zero trust strategy with goals due by the end of fiscal year 2024. It says users should log into applications, not networks. It says multifactor authentication should sit at the application layer, not in network authentication such as a VPN.
In June 2025, NIST published SP 1800-35, Implementing a Zero Trust Architecture. For it, NIST's National Cybersecurity Center of Excellence worked with 24 collaborators to build 19 example implementations.
On January 19, 2024, CISA issued Emergency Directive 24-01 on vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure. Ivanti sells Connect Secure as a remote access VPN. A supplemental direction issued January 31, 2024 ordered federal agencies to disconnect all instances of both products from agency networks by 11:59 p.m. on February 2, 2024.
Launches and acquisitions
- Cisco announced Cisco Secure Access, its SSE service, on June 6, 2023, and said it would be generally available in October 2023. On November 3, 2025, Cisco said all its SD-WAN offerings, including Meraki, now integrate with it.
- Check Point completed its acquisition of Perimeter 81, an SSE company, on September 13, 2023. Check Point now names its product Check Point SASE, formerly Harmony SASE.
- Palo Alto Networks completed its acquisition of Talon Cyber Security, an enterprise browser company, on December 28, 2023.
- Microsoft made Entra Private Access and Entra Internet Access generally available on July 11, 2024, alongside the Microsoft Entra Suite.
- Netskope went public in September 2025. Its Form 8-K gives September 19, 2025 as the date its initial public offering closed. Its Class A common stock is listed on Nasdaq as NTSK.
Agents, portals and browsers
NIST SP 800-207 describes several deployment models. Two of them differ on whether the device runs an agent.
- Device agent and gateway. Each enterprise device runs an agent, and a gateway sits in front of the resource. NIST says this suits organizations with strong device management, and that access is possible only from devices that carry the agent.
- Resource portal. No software needs to be installed on client devices, which NIST says is more flexible for personally owned devices and work with other organizations. NIST notes the trade-offs: the organization learns little about the device, sees it only while it is connected, and exposes the portal to discovery and denial-of-service attacks.
Several products offer both. Cloudflare offers a browser-based terminal for SSH, RDP and VNC without a client. Users who install the Cloudflare One Client reach applications as if they were on the private network. Zscaler sells a ZPA Clientless Platform add-on for third-party users and unmanaged devices. Cisco says Secure Access uses client and clientless methods, and offers VPN as a Service for applications that ZTNA does not cover. Palo Alto Networks sells Prisma Browser, an enterprise browser that gives access to web, SaaS and private applications and isolates enterprise applications from untrusted endpoints.
Where ZTNA sits in a platform
- Identity-led. Microsoft Entra Private Access applies Entra Conditional Access policies to each application. With Entra Internet Access it makes up Microsoft's SSE. Microsoft says it can run side by side with other vendors' SSE products.
- Part of an SSE suite. Zscaler sells Private Access in bundles with its Internet Access gateway and data security, or standalone. Cisco says Secure Access combines secure internet access, VPN as a Service and ZTNA to private applications in one SSE platform, with a single console and a unified client. Cisco also sells DNS-layer security alone as Secure Access DNS Defense.
- Part of a SASE platform. SASE adds the branch network. Cato says its cloud converges networking and security, with Socket devices connecting sites and a Client connecting remote users to the nearest Cato point of presence. Cisco says its SD-WAN offerings now integrate with Secure Access to make a complete SASE offering. Check Point says Check Point SASE combines internet access, ZTNA and SaaS security, adds SD-WAN, and accommodates any employee, third party or branch office.
If you plan to buy a secure web gateway, CASB or SD-WAN in the next few years, price ZTNA as part of that decision, not on its own.
What it costs where prices are published
List prices as published on each vendor's page on October 17, 2026.
- Microsoft Entra Private Access. $5 per user per month standalone, paid yearly on an annual commitment. The Microsoft Entra Suite, which includes Private Access and Internet Access, is $12 per user per month. Microsoft says Private Access users need an Entra ID P1 or P2 license. The Suite requires Entra ID P1, listed at $7 per user per month, or a package that includes it.
- Cloudflare Access. The free plan has a 50-user limit. Pay-as-you-go is $7 per user per month, paid annually, without enterprise support. Contract plans have a custom per-user price, paid annually.
- Zscaler Private Access. Zscaler publishes its bundles but no prices. A limited ZPA comes in the Essentials Platform for 5% of users. Full ZPA comes in the Zscaler Platform bundle or as a standalone ZPA Platform. Clientless access and business continuity are add-ons.
- Cisco and Check Point. Their product pages list no prices.
Ask each vendor which modules the quote includes, what the per-user rate becomes at renewal, and what clientless access and legacy protocol support cost on top.
What a deployment requires
Microsoft and Cloudflare link each private network to their cloud through software that makes outbound connections only.
- Microsoft. The private network connector runs on Windows Server 2016 or later and needs outbound ports 80 and 443. Microsoft says connectors send only outbound requests and recommends at least two connectors in each group for high availability. Kerberos single sign-on requires the connector and application servers to be in the same Active Directory domain or trusting domains.
- Cloudflare. The cloudflared daemon creates outbound-only connections to Cloudflare, so the firewall can block all inbound traffic.
- Zscaler. Zscaler says its inside-out connections mean applications and their IP addresses are never exposed, and users are never put on the network.
Microsoft documents a two-stage move off the VPN. Quick Access first publishes broad network ranges, giving the same access a VPN gives, and feeds an application discovery report showing who reaches what. Microsoft calls Quick Access a migration bridge and recommends moving high-value applications to per-application access afterward.
Keep the VPN running until each application works through ZTNA. Test the hard cases in the pilot: thick clients, RDP and SMB, and access from unmanaged contractor devices.
Questions to settle first
Settle these before choosing a product.
- Which private applications do users reach today, over which protocols, and who owns each one?
- Which users work from devices you do not manage, and is browser-only access enough for them?
- Is ZTNA a standalone purchase, or the first module of an SSE or SASE platform you will also use for web security, CASB or SD-WAN?
- Which identity provider and device management tools will the access policy depend on?
- What happens to access if the vendor's cloud is unreachable?