ZTNA providers we supply, compared

How to use this comparison

Every product on this page gives people access to private applications without putting them on the whole network, which is the core of zero trust network access (ZTNA). Beyond that they differ a great deal: some are full security service edge (SSE) or SASE platforms that also protect web and SaaS traffic, some live inside a browser, some focus on one job such as remote desktop, and some pair access with microsegmentation inside the network.

Each row is drawn from the vendor's own public material and our fact-checked licensing data. We do not rank them, score them or repeat analyst placements: the right choice depends on what you already run, how many users and devices you have, which applications need protecting and whether those devices are managed. If you are still deciding between ZTNA, SSE and SASE, read ZTNA vs SASE first, and for the vendor-neutral definition see ZTNA on our cloud security site.

ZTNA providers compared: access and enforcement

Sophos ZTNA and WatchGuard FireCloud are covered on our other sites, so they have no page here. For the SASE and SSE angle on the same vendors, see SASE providers compared.

Licensing unit and typical fit

Prices depend on users or devices, term, tier and add-ons, so ask us for a quote. What drives the total is explained on zero trust network access cost, and licensing detail is on our licensing site, for example Harmony SASE licensing and Trend Micro Zero Trust Secure Access licensing.

Four kinds of ZTNA provider

The products above fall into four broad groups, and the group usually narrows the shortlist faster than any feature list:

• SSE and SASE platforms: Check Point SASE, Cisco Secure Access, Trend Micro ZTSA, Todyl SASE, Exium SASE and WatchGuard FireCloud put private access, web protection and often a cloud firewall behind one agent and one policy. They suit organisations that want to retire a VPN and protect internet traffic at the same time.
• Browser-based ZTNA: Island Private Access delivers access inside the browser, with control over what happens to data once it is on screen. It suits contractors and unmanaged devices, and can sit alongside a network ZTNA rather than replace it.
• Network access services for smaller teams: NordLayer gives identity-based access to private gateways with dedicated IPs, without hardware, and is licensed from five users.
• Focused tools: TruGrid SecureRDP replaces a VPN or exposed RDP for remote desktop only, and Zero Networks Connect combines remote access with segmentation inside the network so remote users fall under the same least-privilege rules as everyone else.

Where a single product does not cover everything, a combination is normal: for example an SSE platform for most applications, with a focused tool for remote desktop or a browser for contractors. The options by use case are laid out on secure remote access solutions.

How to shortlist ZTNA providers

The NCSC's Zero Trust Network Access guidance, published in May 2026, includes a section on assessing ZTNA services and providers within its advice on what to do before building a ZTNA architecture. It is the fairest framework we know for choosing between products, so we use it:

1. List what has to be reached, by whom and from what. Applications and their protocols, user groups, managed and unmanaged devices, suppliers and contractors.
2. Understand the trust relationship. Write down what the provider will do on your behalf (identity checks, policy decisions, carrying traffic, logging), how critical the service becomes and what happens if it is unavailable.
3. Check integration and dependencies. Your identity provider (for example Microsoft Entra ID or Okta), device management, existing firewalls, SIEM and any connectors that must run in your network.
4. Check visibility and control. Confirm you can see allow and deny decisions with the signals behind them, export logs and change policy yourself.
5. Trial before committing. The NCSC recommends evaluation through trials or proof-of-concept deployments. Two shortlisted products in a short pilot with real users and applications usually settles it.
6. Agree shared responsibility. Be clear which tasks sit with the vendor, which with you and which with us: configuration, policy changes, incident response and service changes.

The NCSC is also clear that zero trust is an architectural approach rather than a single product, and it warns against dropping a ZTNA or SSE service in as a like-for-like VPN replacement with the old access model unchanged. Its ZTNA anti-patterns are worth reading before any trial. Our summary is on NCSC ZTNA guidance.

Other ZTNA products you may be considering

Microsoft customers often ask about Microsoft Entra Private Access, which is covered on our cloud security site. If you are comparing it with the products above, the same shortlisting questions apply.

For remote desktop specifically, TruGrid SecureRDP is one of several approaches; secure remote desktop access compares them. For contractors and BYOD, see agentless ZTNA.

How Forever Systems helps

Because we supply all of these products, our job is to match one to your requirements, not to defend a favourite. We can:

• Build the requirements list with you: applications, users, devices and the NCSC prerequisites around identity and device management
• Shortlist two or three products and explain the trade-offs in plain terms
• Run a trial or proof of concept with a pilot group and real applications
• Deploy and migrate application by application, then help you close the old VPN and legacy access routes

Scope and timescales are confirmed at quote. Planning the rollout itself is covered in how to implement zero trust network access and our VPN replacement project guide. Contact us for an independent recommendation.