Zscaler leads ZTNA on per-app segmentation maturity and digital experience monitoring (ZDX), but its ZIA/ZPA product split creates operational seams that buyers must plan for. Palo Alto Networks (Prisma Access + SCM) is the strongest enterprise choice where a hybrid on-prem/cloud estate needs a unified management plane. Cloudflare One wins on global latency and agentless access breadth — particularly for BYOD and developer-centric environments. Cato Networks delivers the cleanest single-vendor operational story for lean IT teams. Netskope leads where ZTNA access policy must be driven by data sensitivity — the only vendor that fuses DLP classification with the access grant itself.
ZTNA: Why the network is the wrong trust boundary
Traditional VPNs work like a hotel key card: once you swipe in, you're on the floor and can knock on any door. ZTNA is the concierge model — prove who you are, which room you're visiting, and what device you're carrying, for every room, every time. There's no floor-wide access.
The architectural flip: instead of routing all traffic to a corporate data center for inspection, a ZTNA cloud broker near the user makes a per-session access decision. The data center never sees the connection unless the app lives there.
In 2026, the critical extension is continuous trust. The check doesn't happen only at login. If a device is compromised mid-session — EDR fires an alert, compliance state degrades — the broker tears down that session automatically. This requires the ZTNA client to maintain an active posture feed to the broker throughout the session, which is why EDR integration depth has become the top differentiator between vendors.
Criteria at a Glance
Nine criteria evaluated. Three weighted Critical ×3, four High ×2, two Medium ×1.
Core Trust Pillars
- Device Posture (Continuous)
- Identity Integration
- Per-App Micro-Segmentation
Performance & Access
- Global PoP Latency
- Agentless Access
- Enterprise Browser Integration
- Client OS Coverage
Operational Depth
- Digital Experience Monitoring
- Legacy App Support
Vendor Summaries — ZTNA Pillar
Each card summarizes this vendor's ZTNA position. Full per-pillar analysis is in the vendor working document.
Palo Alto Networks — Prisma Access + SCM
STITCHED / INTEGRATEDThe strongest ZTNA for hybrid on-prem + cloud estates. SCM ties Prisma Access cloud ZTNA to physical NGFWs and Panorama-managed devices — a branch firewall posture, a remote user session, and an on-prem device sharing one policy framework. AI-RT behavioral anomaly detection flags session-level threats independent of EDR alerts — the deepest "continuous" posture layer in the Big Six. Prisma Access Browser (from Talon acquisition) adds a native enterprise browser in the SCM policy plane. App-ID provides 4,000+ evasion-resistant L7 signatures at the ZTNA access layer.
▲ Strengths
Best hybrid on-prem + cloud management via SCM. Strongest L7 App-ID for ZTNA enforcement. AI-RT behavioral posture — unique in Big Six. Native enterprise browser (PAB). FedRAMP High authorized. ADEM native DEM.
▼ Watch Areas
Policy coherence depends on SCM integration quality. Agent required for full capability — agentless narrower than Cloudflare. PAB + SCM integration still maturing (Q1 2026). Complexity requires trained operators.
Cato Networks — Cato SDP
NATIVE SINGLE-PASSThe cleanest single-vendor ZTNA story. Cato SDP runs on the same single-pass engine as FWaaS, SWG, and CASB — no product integration between ZTNA and security, just one stack. Private backbone (85+ PoPs, SLA-backed fiber) means ZTNA transit delivers sub-150ms globally with a contractual latency commitment. EDR integration with event-driven session teardown. ZTP deployment lets branches and ZTNA roll out as a single program. UEBA risk scoring feeds access policy without external tooling. On April 20, 2026, Cato launched the Cato Enterprise Browser as a new Universal ZTNA access method — extending zero trust enforcement to unmanaged devices through a managed browser, sharing the same policy engine as the Cato Client and Browser Extension (September 2025). Included under the existing UZTNA license.
▲ Strengths
Cleanest ZTNA + SD-WAN + SSE single-vendor story. One console, one policy engine. Private backbone SLA for ZTNA transit. Best for lean IT. ZTP simplifies joint branch + ZTNA rollout. Enterprise Browser (April 2026) closes unmanaged device gap — same policy plane, no separate SKU.
▼ Watch Areas
Enterprise Browser is new (April 2026) — validate production maturity vs. Island (4-year track record) and Palo Alto PAB before final positioning. L7 signatures less extensive than Palo Alto App-ID. Agentless thick-client narrower than Cloudflare. Behavioral posture detection behind Palo Alto AI-RT.
Netskope — NPA (Netskope Private Access)
SINGLE-PASS / DATA-CENTRICThe only vendor where ZTNA access decisions are informed by data sensitivity, not just identity. A user accessing an app containing PII gets a tighter policy than the same user accessing a non-sensitive app — same identity, same device, different data classification. DLP policy applies at the access grant layer, not just at inspection. User Risk Scoring aggregates behavioral, UEBA, and DLP signals for dynamic mid-session policy. Agentless ZTNA covers web apps well; non-web thick-client access requires per-protocol SSH/RDP gateway configuration.
▲ Strengths
Only vendor fusing DLP classification with ZTNA access grants. Best inline + API CASB shared policy plane with ZTNA. Natural choice for regulated industries. User risk score integrates data signals alongside behavioral.
▼ Watch Areas
DEM less mature than Zscaler ZDX. No native enterprise browser. Non-HTTP agentless requires more configuration than Cloudflare browser rendering.
Cloudflare — Cloudflare Access
EDGE-NATIVE / PERFORMANCE-FIRSTThe performance-first and agentless-first ZTNA. 330+ global PoPs — most users connect within 20–50ms. Browser Rendering renders RDP, SSH, SMB, and VNC sessions directly in a browser window via server-side rendering, with zero endpoint install. A contractor on a personal Chromebook accesses the same RDP desktop as a managed Windows device — architecturally unmatched in the Big Six for thick-client agentless access. WARP client provides compliance-based posture; no EDR-independent behavioral anomaly detection. Fastest policy deployment: API-native, Terraform-managed, sub-30-second global propagation.
▲ Strengths
Best agentless — browser-rendered RDP/SSH/VNC with zero install. Largest PoP density, best global latency. Fastest deployment. Best for BYOD-heavy, multi-cloud, high contractor populations.
▼ Watch Areas
DEX less mature than Zscaler ZDX. No native enterprise browser. No UEBA/behavioral analytics. Magic WAN is not traditional SD-WAN.
Zscaler — ZPA (Zero Trust Private Access)
IDENTITY-FIRST PROXYThe most mature per-app ZTNA segmentation in the Big Six. Inside-out connector model: the app-side connector calls out to Zscaler — no inbound ports, no network adjacency, no lateral movement risk from a compromised connector. Each application segment has its own connector group, access policy, and inspection rule. ZDX telemetry-derived risk scores feed ZPA access policy dynamically — step-up MFA or session throttling without SOAR. ZDX (separately licensed) provides sub-60-second automated fault attribution, the best DEM in the Big Six for enterprise helpdesk workflows.
▲ Strengths
Most mature per-app segmentation — inside-out connector is the reference implementation. Best DEM/ZDX for helpdesk workflows. Deepest identity + risk integration. Zero exposed inbound ports. Largest enterprise ZTNA installed base.
▼ Watch Areas
ZIA/ZPA are separate products — verify policy unification scope. Agentless narrower than Cloudflare. No native enterprise browser. ZDX separately licensed — include in TCO.
Fortinet — Universal ZTNA via FortiSASE + FortiClient
UNIFIED OS / INSTALLED BASE ADVANTAGEFortinet's Universal ZTNA is delivered through FortiSASE and enforced via FortiClient — the same agent handling ZTNA, EDR/EPP, and device posture in a unified client. ZTNA policy is managed through the FortiSASE portal and can be coordinated with on-premises FortiGate NGFWs through FortiManager, providing a hybrid ZTNA management story for organizations with existing FortiGate infrastructure. The competitive motion is the installed base: organizations running FortiGate branch firewalls add FortiSASE ZTNA to the existing FortiOS management plane without replacing hardware or re-training staff. Gartner Customers' Choice for ZTNA (2025).
▲ Strengths
Universal ZTNA integrated with FortiOS policy plane. Single FortiClient agent for ZTNA + EPP + EDR + posture. Hybrid management alongside FortiGate NGFW via FortiManager. Gartner Customers' Choice for ZTNA (2025). Lowest friction for existing Fortinet SD-WAN/NGFW customers. Competitive pricing.
▼ Watch Areas
No behavioral posture equivalent to Palo Alto AI-RT — posture enforcement is compliance-check-based. Agentless thick-client (RDP/SSH) narrower than Cloudflare browser rendering. DEM maturity trails Zscaler ZDX. Steeper learning curve for non-Fortinet environments.
Vendor Scoring — ZTNA Pillar
Scale: 1=Poor/Missing · 3=Adequate · 5=Best-in-Class. Weight multipliers: Critical ×3 · High ×2 · Medium ×1.
Loading scores…
Persona Fit — ZTNA Pillar
| Persona | Profile | Primary ZTNA Need | Best Fit | Rationale |
|---|---|---|---|---|
| Lean IT SMB–Mid-market | Small security team, limited vendor management capacity, operational simplicity is the governing constraint | Single-vendor simplicity, ZTP deployment, minimal daily management | CATO | One console for ZTNA + SSE + SD-WAN. ZTP. No integration tax. Best value without dedicated ZTNA engineering. |
| Global Security Ops Large Enterprise | Dedicated SOC, hybrid on-prem + cloud estate, threat-prevention depth is the governing constraint | Per-app segmentation maturity, DEM, identity risk scoring, SOC integration | ZSCALER | ZPA per-app segmentation is most mature. ZDX is best-in-class DEM. Identity risk integration feeds SOC workflows natively without SOAR chain. |
| Data-First / Regulated Finance · Healthcare · Legal | Data classification governs all policy, GDPR/HIPAA/PCI obligations, DLP is board-level | ZTNA policy driven by data classification, not identity alone | NETSKOPE | Only vendor fusing DLP classification with ZTNA access grants. Same user, same identity, same device — tighter policy for PII-containing apps. |
| Platform / Network Architect 500–5,000 employees | Owns SD-WAN refresh alongside ZTNA; needs agent coverage for managed endpoints and agentless for BYOD/contractors | ZTNA integrated with SD-WAN CPE policy; global PoP coverage; agentless for BYOD | CATO CLOUDFLARE | Cato if SD-WAN + ZTNA convergence is the goal — single backbone, one policy plane. Cloudflare if cloud-first with no branch CPE and agentless contractor access is the priority. |
ZTNA in 2026: Three Defining Shifts
1. Continuous posture has replaced static posture as table stakes. Any vendor without real-time EDR integration and session teardown on posture failure is now below the enterprise minimum. Palo Alto's AI-RT behavioral anomaly layer is extending this further — detecting session-level threats independent of whether an EDR alert fires. Expect others to match this capability by late 2026.
2. Agentless access is no longer an edge case. Cloudflare's browser-rendered thick-client access — RDP/SSH/VNC in a browser with zero endpoint install — is setting a new minimum bar. Contractors, BYOD devices, and non-managed endpoints are now primary deployment targets. Vendors without a credible agentless story for non-web apps will lose deals in these segments.
3. The enterprise browser is becoming a ZTNA enforcement layer — and it's now a three-vendor race. Palo Alto Prisma Access Browser (PAB), Island, and Cato Enterprise Browser (all active in 2026) are evolving the browser from an access onramp into a full ZTNA control plane — handling identity attestation, copy/paste policy, DLP, and watermarking at the browser layer independent of network path. Cato's April 2026 launch brings single-policy-engine simplicity to the category. Island's architectural differentiator remains pre-encryption visibility — no SSL break-and-inspect required. Monitor Palo Alto's SCM + PAB integration depth, Island's full SASE stack maturity, and Cato Enterprise Browser production deployment track record through H2 2026.