The best ZTNA solutions give each person access to the specific apps they need, after checking who they are and what device they're on, instead of dropping them onto the whole network like a traditional VPN. Small teams usually want something quick to set up, while large firms want ZTNA inside a wider security platform. Eleven options follow in no particular order.
Most small businesses met remote access through a VPN: connect once and you can reach almost everything. That was fine when the office was the centre of the world. Now staff work from home, cafes and client sites, apps live in several clouds, and one stolen login can open far too many doors.
Zero trust network access, or ZTNA, flips that around. The eleven tools below are listed alphabetically and in no particular order, from open source projects to the big security platforms, and every description comes from the vendor's own site, read this week. If you're still weighing up a VPN, my guide to the best VPNs for business covers that side.
ZTNA tools at a glance
In the free plan column, Yes means the tool's own site names a free plan, a free edition or an open source version. Trial only means a time-limited trial. Not stated means the pages I read named neither, even where there's a button inviting you to try it or book a demo.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Appgate | ZTNA for IT and OT | Remote access to plant and OT systems | Not stated |
| Cloudflare Access | ZTNA inside a wider zero trust suite | Teams already using Cloudflare for their sites | Not stated |
| GoodAccess | Zero trust architecture as a service | Small teams with no network specialist | Trial only |
| NetBird | Open source zero trust networking | Replacing a VPN with open source | Yes |
| Netskope Private Access | Universal ZTNA | Larger firms consolidating security tools | Not stated |
| Pomerium | Identity-aware access proxy | Private web apps without a VPN | Yes |
| Prisma Access | Cloud-delivered secure access (SASE) | Existing Palo Alto Networks customers | Not stated |
| Tailscale | Secure connectivity and business VPN | Connecting laptops, servers and cloud workloads | Not stated |
| Timus | SASE platform for MSPs | Managed service providers protecting clients | Not stated |
| Twingate | Identity-based access | Retiring an old VPN quickly | Not stated |
| Zscaler Private Access | Zero trust private app access | Large enterprises with many private apps | Not stated |
Eleven zero trust network access tools to look at
Appgate
Best for: Organisations that need identity-based access for IT systems plus secure remote access to plant and OT systems without exposing them online.
Cloudflare Access
Best for: Businesses already running their websites through Cloudflare that want app access controls added from the same dashboard.
GoodAccess
Best for: Small and mid-sized companies that want a zero trust network set up without needing deep networking skills in-house.
NetBird
Best for: IT and engineering teams that want an open source, identity-based alternative to a traditional VPN for remote users and hybrid cloud.
Netskope Private Access
Best for: Larger organisations that want private app access delivered as part of a broader security platform from one vendor.
Pomerium
Best for: Engineering teams that want private web apps protected in a browser, with no VPN and no broad network access handed out.
Prisma Access
Best for: Companies already invested in Palo Alto Networks security that want remote access delivered from the same vendor's cloud.
Tailscale
Best for: Technical teams that want quick, secure connections between laptops, servers, cloud workloads and IoT devices with very little setup.
Timus
Best for: Managed service providers that want a zero trust secure access platform built for looking after many client networks at once.
Twingate
Best for: Firms that want identity-based access for staff, services and AI agents that deploys in minutes and lets them retire the VPN.
Zscaler Private Access
Best for: Large enterprises that want staff connected straight to private apps rather than to the whole network, at global scale.
What zero trust network access changes
NIST's zero trust architecture guidance, SP 800-207, says zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location, or on whether the device belongs to the company or to the person using it.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
In plain English: sitting in the office no longer earns you any extra trust. A ZTNA tool checks the person and their device every time they ask for an app, and only opens that one app. If a laptop is stolen or a password leaks, the damage is far smaller than with a VPN that lets people roam the network.
ZTNA, VPN or both?
You don't have to rip out a VPN overnight. Plenty of businesses start by moving their most sensitive apps, such as finance, HR and admin consoles, behind ZTNA, and leave the VPN in place for older systems that need it. Once those first apps run smoothly, the rest usually follows.
The bigger the business, the more likely ZTNA arrives as part of a secure access service edge, or SASE, bundle alongside web filtering and other tools. A small team rarely needs all of that on day one, so don't let a long feature list push you into a bigger product than you'll use.
Pair access control with web filtering software.
Questions to ask a ZTNA vendor
- Which identity providers do you work with, and do you check device health too?
- Do users need an app installed, or can some apps open in a browser?
- How do you handle older apps that weren't built for the web?
- Can we roll out one app at a time, alongside our current VPN?
- Where are your connection points, and how will that affect speed for remote staff?
- What logs do we get to see who accessed what, and when?
Identity providers are weighed up in my identity platform comparison.
Signs your VPN is holding you back
- Everyone can see everything. One login reaches the whole network.
- Remote staff complain about speed. All traffic squeezes through one gateway.
- Contractors get full access. Nobody wants to set up separate rules.
- Nobody knows who opened what. Access logs are thin or missing.
Do you make ZTNA software? Tool makers can ask to be considered for a featured place on this list.
My plain advice on choosing a ZTNA tool
List the five apps that would hurt most if the wrong person got in, and start there. If a tool can protect those quickly without upsetting the people who use them every day, it's a good sign, and you'll learn far more from that pilot than from any demo.
Then match the tool to who'll run it. A business with no network specialist needs something that sets itself up in an afternoon; an IT team that loves control may prefer an open source option it can host. For the people side, my guide to securing a remote working business is a useful companion.
Frequently asked questions
What is ZTNA?
Zero trust network access is a way of giving people access to specific apps after checking who they are and what device they're using, rather than connecting them to a whole network.
Is ZTNA better than a VPN?
For most modern apps it's safer, because it limits each person to the apps they need. Many businesses still keep a VPN for older systems while they move over.
Do small businesses need ZTNA?
Not always on day one, but any team with remote staff and cloud apps benefits from tighter access, and several tools are built to be set up without a network specialist.
Is there free ZTNA software?
Some open source tools can be self-hosted for free. Hosted services usually offer a trial, so check the table above and each vendor's site.
What is the difference between ZTNA and SASE?
ZTNA controls access to private apps. SASE is a wider bundle that usually adds web filtering, firewall and other security services delivered from the cloud.
How long does it take to roll out ZTNA?
A first app can often be protected in a day or two. Moving every app usually happens in stages over several weeks.
