GigaOm Radar: Zero Trust Network Access v5

Zero trust network access (ZTNA) has moved from a debated model to a purchase decision. Every product in this Radar brokers access one application at a time, on identity and device posture, instead of putting the user on the network. Nearly all are sold as the replacement for the same thing: the remote-access VPN and the flat internal network behind it. What has changed is who is selling it. The field arrives from every direction—security service edge and single-vendor SASE platforms, an identity incumbent, network access control and application-delivery lineages, VPN-era products rebuilt for cloud management, browser-isolation architectures, and a small band of software-defined-perimeter purists for whom the access architecture is the entire product.

Two pressures now organize the market. The first is platform absorption: for most of this field, ZTNA is a function of a larger converged offering rather than a product, and the capability a buyer actually receives is scattered across named, separately licensed modules. The second is architectural settlement: the outbound-only connector, the brokered session, and continuous rather than login-time evaluation have become the reference design, so the field now differentiates on how completely and how verifiably each vendor implements it. The six themes below capture where these pressures are separating the field.

The Platform Is the Purchase

Across most of this roster, the access product cannot be evaluated alone, because it is not sold alone. The strongest capabilities frequently sit in named adjacent SKUs rather than the core subscription. These separately licensed products cover privileged remote access with credential vaulting and session recording, enterprise browsers, industrial gateways and rugged appliances, risk-scoring services, remote browser isolation, and data-loss-prevention engines.The converged platforms make a genuine architectural argument for this, with one client, one inspection pass, and one policy plane spanning private, web, and SaaS traffic. The best implementations document real object sharing rather than console adjacency. The pure-play minority makes the opposite argument: a self-contained access architecture with no platform tax, at the cost of sourcing web, cloud, and data security elsewhere.

What this means for buyers: Price the SKU chain, not the demo. For every capability that matters to your evaluation, establish in writing which license carries it—the capsules in this report name these dependencies vendor by vendor. Platform buyers already committed to the surrounding suite inherit strong economics; buyers evaluating the access function alone should assume the demo showed the platform.

The Outbound-Only Connector Is the Settled Architecture

The market has converged on a deployment pattern: a lightweight connector deployed beside private applications, dialing outbound to a broker, with nothing at the customer site accepting an inbound connection. The strongest implementations make that connector available across an extensive set of form factors, including hypervisor images, cloud marketplace instances, container images, and orchestration charts. They also explicitly document egress-only network requirements. Deviation from this pattern is now the marked case: a handful of products still terminate client connections on an inbound-facing gateway or a customer-hosted server with a public address, and the capsules treat that as an architectural finding rather than a stylistic one. At the frontier sit the single-packet-authorization designs, where infrastructure refuses to answer unauthenticated traffic at all, and the reverse-proxy designs, where public hostnames answering before authentication is inherent to the model.

What this means for buyers: Make the exposure question a gating question: what listens, what answers before authentication, and what inbound firewall rules does the deployment actually require? The answers separate architecturally settled products from products still carrying their lineage, and they are verifiable from documentation before any proof of concept begins.

From Login Gate to Continuous Adjudication

The field divides sharply when trust is re-evaluated. At the front, access decisions are made per request or per transaction—every retrieval re-adjudicated, posture changes pushed over persistent channels that re-verify established sessions, and identity events such as account disablement or a risk-score change interrupting in-flight sessions rather than waiting for a token to expire. The middle of the field re-checks posture on a timer measured in minutes, which is genuine but bounded: the interval is the exposure window. At the back, posture is a gate evaluated at connection time only, and an established session outlives the conditions that authorized it. The differences are documented, specific, and material to what “zero trust” means in each product.

What this means for buyers: Ask each vendor for the trigger list. Establish precisely which events, such as posture changes, identity disablement, risk elevation, or administrator action, terminate or downgrade an established session, and how quickly that happens. A product that can only answer with a re-authentication interval is describing a shorter VPN session, not continuous evaluation.

The Unmanaged World: Contractors, BYOD, and OT

The populations that cannot run an agent are where ZTNA implementations diverge most. Browser-delivered access to web applications is broadly available. The harder capability is rendering RDP, SSH, and VNC sessions in a browser with per-application controls for clipboard use, uploads, downloads, watermarking, and recording. Only part of the field delivers this capability completely, while several products deliberately offer no clientless path at all.

Third-party governance shows the same spread: expiring grants, approval workflows, credential injection that keeps the target credential out of the contractor’s hands, and session recording at the front; agent-required onboarding with no bounded grant duration at the back. Operational technology extends the same question to devices that will never run software. Credible industrial offerings are relatively few and typically separately licensed. They include rugged form factors, industrial protocol awareness, and gateway-mediated sessions with approval windows.

What this means for buyers: Inventory the users and devices your agent will never reach—contractors, auditors, BYOD, kiosks, and controllers on a plant floor—before shortlisting. Several otherwise strong products exclude these groups by design. Then test the controls, not the checkbox: a browser-rendered session without clipboard, content, and recording governance moves the data-exfiltration problem rather than solving it.

Automation Decides Operability at Scale

The widest operational gap in this field is programmability. At one end sit versioned APIs with published OpenAPI specifications, vendor-maintained infrastructure-as-code providers covering the core policy objects, discovery pipelines that mine live traffic into reviewable application candidates with guided promotion, and migration tooling with staged-cutover and log-only enforcement modes. At the other end sit products, including some with otherwise credible security architecture, that publish no API, no command-line interface, and no provider at all. As a result, every application, policy, and enrollment is a console action performed one object at a time. In between, several platforms publish broad APIs that simply do not cover the private-access objects, which is easy to miss in an evaluation and expensive to discover afterward.

What this means for buyers: Require the artifacts, not the claim: the API reference that names the access objects, the provider in a public registry, the discovery report a proof of concept can generate. An access product that cannot be automated becomes a ticket queue at enterprise scale, and the migration itself—hundreds of applications, thousands of grants—is the first workload that will test it.

The Emerging Frontier Is Nearly Empty, and That Is the Signal

The two newest questions in this evaluation drew the weakest field-wide results, and both will decide the next cycle’s separation. Post-quantum cryptography is the lowest-scoring criterion on this Radar: a small number of products ship post-quantum key agreement on the access path itself—in one case on both the client and clientless legs, in another enabled by default across tunnel segments—while much of the field either publishes nothing or, more tellingly, ships post-quantum material elsewhere in the portfolio that the access product’s own documentation does not claim. Agentic AI workloads are the second frontier: first-class non-human principals with scoped, expiring, revocable credentials, workload identity federation, and registries governing agent-to-tool traffic exist at the front of the field, while much of the roster still routes automation through machine certificates or nothing at all.

What this means for buyers: Both criteria are roadmap diligence today and requirements tomorrow. Access tunnels carry credentials and long-lived secrets, which makes harvest-now-decrypt-later a live concern for regulated buyers; get each vendor’s post-quantum position on the access path in writing. And if AI agents will traverse private applications in your environment, ask now what principal they present—a product that can only lend an agent a human’s identity cannot answer the audit question that follows.

Figure 1. GigaOm Radar for Zero Trust Network Access.

Notable Patterns

Zero trust network access is foundation-building by nature. It stands between a user and an application that must never be reachable directly, so per-application authorization, deny-by-default with no inbound listener, posture checked at connection time and a logged decision are entry requirements rather than differentiators. Foundation Builders is where that settled stack is the entire proposition, expressed as continuity with an installed estate of routers, gateways and ruggedized endpoints, and accreditation and resilience as the differentiators. Where nothing else is emphasized, the release notes are bug fixes.

Agile Optimizers holds the broadest concentration of effort, all of it directed at removing the cost of adoption. Enforcement moves into firewalls the customer already owns; the endpoint client disappears in favour of clientless browser access; connectors ship as free open-source containers; entitlement arrives inside an identity licence already paid for; delivery moves to a provider billing monthly. The wager is that the addressable market is far larger than the set of organizations that could previously staff a deployment.

Enduring Innovators is the counter-bet: access as durable architecture rather than a lighter footprint. Operated global backbones, sovereign and self-hostable fabrics, enforcement fused into the switching fabric itself, unified policy planes intended to collapse the remote-access, network-admission and desktop-virtualization estates.

Disruptive Pioneers, the smallest group, changed a premise rather than improving one: connectivity embedded inside the application itself, no broker in the data path, the browser as the boundary, identity issued to workloads rather than to people. The wager is that brokering is transitional.

The quadrant descriptions and decision framework orient buyers to read this Radar from the enterprise procurement seat. The Radar plots solutions on two axes—Operational Focus ←→ Strategic Focus and Stability-Centered ↑↓ Evolution-Centered—so placement signals both what outcome a product is meant to deliver and how it approaches change. Decision responsibility is mapped to the Tech Buying Triad: the CIO owns Brown Money tradeoffs, the CTO owns Green Money tradeoffs, and the CISO owns GRCS tradeoffs; Emerging Technology inputs are treated as consulted advice across the Triad. This framework is the neutral lens the rest of the report uses to explain vendor capabilities and buyer implications.

Quadrants

Enduring Innovators are Strategic + Stability. These are long-horizon strategic bets—vendors whose value compounds over a decade rather than a quarter, often through deep architectural decisions that are expensive to reverse. The buyer in this quadrant accepts a long time-to-value and slow visible change in exchange for step-change strategic outcomes when the bet pays off. In zero trust network access, the Enduring Innovators quadrant is dominated by converged platform fabrics: global point-of-presence networks carrying private, web, and SaaS traffic through one inspection path under one policy plane. The buyer here is consolidating access, inspection, and data protection onto a single strategic vendor, accepting concentration risk and a platform-shaped bill in exchange for an architecture whose value compounds across the whole traffic estate.

Disruptive Pioneers are Strategic + Evolution. These vendors are reshaping what the category even means: leading-edge technology, fast-moving roadmaps, novel primitives that did not previously exist as commercial products. The buyer accepts elevated risk, frequent change, and immature operational maturity in exchange for capability that simply was not previously available. In zero trust network access, the Disruptive Pioneers each sell an architectural thesis, such as infrastructure that refuses to listen on the network, deployments with no vendor cloud in the traffic path, and application delivery through a remotely executed browser. These are approaches the rest of the field does not offer, with enterprise scaffolding still filling in behind the architecture.

Foundation Builders are Operational + Stability. These vendors deliver the core infrastructure and systems of record that keep the business running; the load-bearing technology that other software depends on. The buyer in this quadrant values predictability, dependability, and low-risk continuity over rapid iteration. In zero trust network access, the Foundation Builders reached the category from adjacent traditions—application delivery, VPN concentrators, network access control, endpoint management, data security—and offer disciplined operations, mature diagnostics, and deployment models that answer residency and continuity questions by construction, with thinner automation and convergence stories as the characteristic trade.

Agile Optimizers are Operational + Evolution. These are the day-to-day operational systems that are actively improving through incremental iteration on a known mission. The buyer wants compounding gains on workflows that already work—better automation, better user experience, better integrations—not a wholesale platform replacement. In zero trust network access, the Agile Optimizers range from converged platforms iterating quickly on unified policy and per-request adjudication to deliberately narrow products that do one job exceptionally well; what unites them is a buyer modernizing access already in production, one increment at a time, without an architectural rebuild.

Axes

The X-axis: Operational Focus ←→ Strategic Focus describes intent of value. Solutions placed toward the Operational Focus side are bought to keep the business running: they minimize day-to-day operational risk and administrative effort on workflows the organization already depends on. Solutions toward the Strategic Focus side are bought to change the organization’s position: their value compounds through architectural commitments rather than immediate operational relief.

The Y-axis: Stability-Centered ↑↓ Evolution-Centered describes change posture. Stability-centered placements favor proven behavior, predictability, and low-risk continuity—change is the risk to be minimized. Evolution-centered placements treat change as the reward being purchased: frequent, useful iteration on a known mission, or a fast-moving roadmap that reshapes what the category covers.

Ring System (Leader Versus Challenger)

The Radar’s concentric rings communicate overall capability depth and maturity independent of quadrant.

Leader denotes vendors whose offerings combine broad feature depth, production-grade engineering, and sufficient operational documentation and ecosystem integration to be referenceable at scale.

The Challenger ring denotes solid capability with important areas of growth. They are useful in many deployments but likely to require more integration effort, operational validation, or feature road-mapping for specific enterprise requirements.

Use ring position as a procurement heuristic: inner-ring placements reduce integration and validation effort when the buyer’s requirements align with the vendor’s strengths; outer-ring placements demand more architectural validation, clearer SLAs during procurement, and potential pilot programs. Ring position does not change what quadrant a product targets. It only signals how far a given product’s implementation goes toward covering the full set of buyer requirements in this market.

Archetype Variants

Different buyer archetypes shift weight across the Tech Buying Triad’s accountability map. Regulated-industry buyers tilt toward GRCS, and the CISO’s accountabilities dominate procurement. Growth-led buyers shift toward Green Money and CTO leadership. Cost-pressured buyers elevate Brown Money and the CIO’s accountabilities. Succeeding with any selection in this category requires explicit Triad alignment up front: agree which bucket holds the tie-breaking veto, and define the acceptance tests that prove the deployment meets its governance and operational requirements before it carries production traffic.

Decision Matrix: Which Quadrant Fits Your Organization?

Use the per-quadrant profile below to self-identify the quadrant whose buyer most resembles your organization. Each quadrant lists the buyer who typically lands there: who they are, what they’re trying to do, how mature they are, how they think about risk, the speed they expect, and how they fund the work. Read the column that sounds like your team. That’s the quadrant whose vendors deserve your closest read.

Vendor Capsules by Quadrant

Enduring Innovators

In zero trust network access, the Enduring Innovators are the platform incumbents. Every vendor placed here sells private access as one function of a larger converged offering—a security service edge, a single-vendor SASE fabric, or, in one deliberate exception, a pure-play access architecture whose whole value is its refusal to converge. The purchase is correspondingly structural: a global point-of-presence network, a single-pass inspection path, and one policy plane spanning private, web, and SaaS traffic. Adjacent modules, including privileged remote access, enterprise browsers, and industrial gateways, are named, separately licensed dependencies. Once traffic steering, posture, and policy have been consolidated onto one of these fabrics, unwinding the decision is a multi-year project, which is exactly the commitment the buyer is choosing to make. The buyer here is an architecture owner making a strategic platform bet, trading time-to-value and vendor concentration risk for capability that compounds across the whole traffic estate.

Disruptive Pioneers

The Disruptive Pioneers in this market each sell an architectural thesis rather than a feature list. One product refuses to let anything it protects listen on the network at all, issuing cryptographic identities to every workload and offering embeddable software libraries so applications themselves become unreachable except through the fabric. Another inverts the deployment model: every component the buyer runs lives in the buyer’s own infrastructure, with no vendor cloud in the traffic path and no quorum to lose. A third delivers private applications through a remotely executed browser, so unmanaged devices receive only rendering information and never touch the application. All three are genuinely novel positions the rest of the field does not offer. The common trade is also definitional for the quadrant: enterprise scaffolding—compliance attestations, published trust pages, SCIM provisioning, administrator documentation—is still filling in behind the architecture. The buyer is betting on a design, and accepts that procurement diligence will find gaps the engineering does not have.

Foundation Builders

Foundation Builders is where the market’s operational heritage lives. The vendors here reached zero-trust access from somewhere else—application delivery, VPN concentrators, network access control, endpoint resilience, data security, regional networking—and their products carry that lineage as both their strength and their boundary. The strengths are operational: mature diagnostics that name the rule that decided, disciplined endpoint-agent management across UEM platforms, customer-hosted deployment models that answer residency questions by construction, and migration machinery built for the installed bases these vendors already own. The boundaries are equally characteristic: thinner automation surfaces, point-in-time rather than continuous risk evaluation in several cases, and convergence stories that depend on another vendor’s product or on adjacent modules. The buyer here runs an estate that must keep working through the transition, whether that means a workforce moving off a VPN, a contractor population to govern, or a regulated deployment that must remain in-country. This buyer values predictability over novelty.

Agile Optimizers

Agile Optimizers is the most contested quadrant on this Radar, holding a third of the field. What unites its vendors is the buyer motion: an operational team modernizing access it already runs—replacing a VPN, consolidating point tools, extending posture control it has today—through steady, incremental delivery rather than an architectural rebuild. The range inside the quadrant is wide. At one end sit converged platforms iterating fast on unified policy engines, per-request adjudication, and included-rather-than-sold access proxies; at the other, deliberately narrow products that do one job—browser-rendered sessions, developer-friendly VPN replacement, last-mile performance—and decline to grow a platform around it. Several vendors here ship named MSP portals and cross-tenant administration, reflecting the channel through which much of the mid-market buys. The buyer is pragmatic: the evaluation question is not which architecture wins the decade, but which product improves the workflows already in production without disrupting them.

Market-Level Velocity Story

Velocity on this Radar measures market momentum: the pace at which a vendor is shipping capability that moves the category, judged against the market’s direction of travel rather than feature count. It is rendered on the chart as the color of each vendor’s dot—Outpacing, Fast Following, or Slow Following—never as an arrow. Of the 32 pairs assessed, five earn Outpacing, twenty-five are Fast Following, and two are Slow Following. At 16% of the field, the Outpacing band sits inside the discipline this methodology imposes: the designation requires shipped, category-moving evidence, not general corporate health.

What the Outpacing five share is position on the market’s leading edges. Four of the five are converged platforms, and the group holds the field’s most complete shipped answers to the questions the rest of the roster is still reaching for: generally available post-quantum key agreement on both access legs, first-class non-human principals and registries for agentic workloads, inline inspection of agent traffic, discovery pipelines that promote observed traffic into governed application segments with explicit approval, and identity-event machinery that terminates established sessions when risk changes. The sixth is the deliberate architectural pure-play, whose momentum shows in the steady deepening of the access architecture itself—scriptable policy extensibility, event-driven risk evaluation, and an infrastructure-as-code surface that outbuilds vendors many times its size. Each of the six shipped something in the evidence window that the rest of the field now has to answer.

Fast Following is the market’s healthy center, and at twenty-five vendors it is where most of this roster lives. The label is not a consolation prize: this band contains vendors that lead the field outright on individual criteria—industrial coverage, clientless session governance, migration tooling, multi-tenant hierarchy, diagnostics that show the operator the reasoning rather than the result—and several of the field’s most distinctive architectures. Their shipping pace tracks the market’s direction without setting it on the emerging fronts where the Outpacing group is defining what comes next.

Slow Following, under this methodology, is never a euphemism for missing data; it requires affirmative trailing evidence. The pattern among the three is concrete: programmatic surfaces that have not grown to cover the access objects, access paths still gated at connection time rather than continuously evaluated, heritage integration endpoints frozen at a predecessor product’s specification, emerging-technology criteria resting at the floor across the set, and in one case a public technical record too thin to verify the product’s claims. For buyers, a trailing mark is a diligence instruction—verify the roadmap, the documentation currency, and the SKU’s standing inside its own portfolio—not a verdict on whether the installed product works today.

Technical Support Quality and Responsiveness

Availability commitments are now a genuine differentiator in this field’s public record. The strongest platforms publish 99.999% commitments with graduated credit tables, per-service or per-point-of-presence status pages with retained incident histories, and in the best cases a dated public advisory record that lets a buyer audit the vendor’s operational candor. The other end of the field is starkly different: one commitment sits below the threshold this research credits, at least one major vendor publishes no availability commitment for its security services at all, and several smaller vendors publish neither a commitment nor a status page. Redundancy documentation follows the same split — from quorum arithmetic and explicit failure-tolerance tables to a recommended backup instance with no failure detection described. Buyers should treat support and availability terms as a negotiation item and require recovery behavior in writing wherever the public record is silent.

Professional Services Depth

Formal professional-services practices are largely undocumented in this field’s public materials; what the capsules evidence instead is migration machinery, and it is some of the best tooling in the market. The strongest implementations pair discovery — mining live VPN or tunnel traffic into reviewable application candidates with user counts — with staged-cutover guides that move one group at a time while the legacy VPN keeps running, log-only enforcement modes that show what would have been denied before anything is, and bulk import paths for applications and grants. At the other end, migration is undocumented entirely: no procedure, no coexistence guidance, and hand-authored applications one console action at a time. Organizations with large estates should size the migration workload against the tooling evidence in each capsule, and treat the managed-service channel — which several vendors serve with dedicated portals — as the effective services arm for the mid-market.

Partner and Channel Ecosystem Breadth

The managed-service channel is well built out across the operational quadrants: named MSP portals spanning customer tenants, genuine parent-child tenant hierarchies with inherited configuration and per-tenant administrator credentials, tenant lifecycle automation through published APIs, and cross-tenant usage and billing reporting all appear in the field’s documentation. Cloud marketplace presence is broad—connector and gateway images across the major clouds recur throughout the roster—and technology alliances cluster at three integration points: identity providers, where multi-IdP and SCIM coverage is the front of the field; endpoint detection and posture, where third-party risk scores feed access conditions and one platform names more than thirty risk providers; and SIEM platforms, where published log schemas and streaming export separate auditable products from opaque ones.

Workforce Skills Availability

Skills transfer in this market runs along the infrastructure-as-code seam. Containers, orchestration charts, and declarative providers recur across the field’s connector architectures, so platform and DevOps teams bring existing practice directly to the access estate; several products are operable entirely through the same pipelines that manage the rest of the infrastructure. Open protocol and open-source foundations at the fabric layer of some products let buyers inspect and hire against public technology. Where products are identity-led, the scarce skill is identity engineering rather than networking; where they are appliance-led, existing firewall and VPN operational skills carry over almost unchanged—which is precisely the appeal of those products to their installed bases. The counterweight is the console-only tail of the field, where no programmatic surface exists and operational knowledge remains product-specific by construction.

Training and Certification Programs

Formal, named certification paths for the access products themselves are rare in this field’s public record; the large platform vendors fold ZTNA modules into their existing certification ladders, and the specialists publish administrator documentation rather than curricula. What the field does ship is deployment enablement: per-UEM installation guides across the major device-management platforms, silent-install references, staged rollout guidance, and user-facing diagnostic tools that reduce the support burden a rollout generates. Documentation currency and completeness vary more than any curriculum could compensate for—the strongest estates are complete, public, and versioned, while others are login-gated or partially stale. Buyers planning large rollouts should request training catalogs directly and weight the public documentation estate heavily: for most of this field, it is the training program.

Community Health

Community health in this market tracks documentation transparency, and the assessment repeatedly found that opacity, not absence, was the binding constraint on what could be verified. The healthiest ecosystems publish their architecture to be checked: security target documents under formal evaluation schemes, reference builds with standards bodies, published threat-model and data-flow papers, open protocol specifications, and complete public documentation portals a practitioner can read before ever engaging sales. The other end is gated: support portals behind sign-in walls, admin documentation unreachable in public, trust pages that resolve to placeholders, and attestations asserted on marketing pages without a certificate, scope, or request path behind them. Two vendors in this evaluation could not be substantially verified from public material at all—a fact the scoring records explicitly. Prospective buyers should treat the public record itself as a diligence signal: a vendor that cannot be verified before contact will be harder to audit after purchase.

No organization weights all 28 criteria in this evaluation equally. The placements in this report reflect the market’s center of gravity, not your architecture. The table below indicates when to promote specific criteria to first-order requirements and when to let them recede.

Adapting the Radar to Your Organization. Start from your three or four non-negotiable criteria and re-read the vendor capsules against those alone. Let that reading reorder the field before you consider overall placement. A vendor positioned modestly on this Radar may be the outright leader for your weighting, and the reverse is equally true.

Capabilities Likely to Become Table Stakes (12–24 Months)

Several capabilities that still separate vendors today are on a clear path to assumption within 12 to 24 months. The outbound-only connector delivered as a container image with orchestration support is nearly there already—the field’s strongest implementations publish it across every major form factor, and inbound-facing deviations now read as findings. Multi-IdP support with SCIM provisioning is close behind, as is the published status page with retained incident history. Discovery-driven onboarding — mining observed traffic into reviewable application candidates rather than hand-authoring FQDN objects—is spreading fast enough that manual-only onboarding will shortly be a disqualifier at enterprise scale. Browser-rendered RDP and SSH with at least clipboard and download controls is becoming the expected floor for the contractor population, and infrastructure-as-code coverage of the core access objects—applications, connectors, policies, groups—is moving from differentiator to procurement checkbox among engineering-led buyers. Posture re-evaluation that responds to change mid-session, rather than at the next login, is the quiet one: the vendors that still gate only at connection time are now a visible minority, and buyers have begun to ask the trigger-list question unprompted.

Capabilities Likely to Emerge as Differentiators

The next cycle’s separation is already legible in this cycle’s weakest criteria. Post-quantum key agreement on the access path itself has its first shipped implementations, and the gap between vendors that publish post-quantum material for other products and vendors that ship it on the private-access legs will become a standing diligence question long before it becomes common. Agentic workload identity is the widest-open front: agent registries, scoped and expiring non-human credentials, workload identity federation, and governed agent-to-tool traffic exist in shipped form at only a few vendors, and every enterprise AI initiative that touches private applications will force the question. AI-driven policy automation will differentiate on the enforcement loop, not the assistant—a vendor-computed risk score that policy can act on, and recommendations that become reviewable policy objects, against natural-language summaries that produce nothing enforceable. Identity-event session termination—consuming disablement, credential-reset, and risk signals and interrupting established sessions on them—remains rare enough to decide evaluations. And the deepening industrial stories, with protocol-level control and purpose-built form factors, will separate the universal-access claims from the remote-worker products that borrowed the language.

Expected Market Consolidation or Fragmentation

This roster is itself a consolidation record. Several of its products are acquisitions rebuilt onto their acquirers’ platforms, others are cloud-managed successors to VPN-era product lines, one platform’s lineage runs through two prior corporate identities, and one vendor’s convergence story now depends on a partnership because its own sibling service was retired. The absorption pressure is structural: SSE and SASE platforms treat private access as an attachable module, the identity layer treats it as an extension of conditional access, and the standalone half of the field is already the smaller half. Expect both motions to continue—platform vendors acquiring for architecture and installed base, and the deliberately narrow specialists either growing their enterprise scaffolding fast enough to stay independent or becoming the next module. For buyers, the costs of consolidation are observable in this report’s capsules rather than hypothetical: documentation still hosted on predecessor domains, capabilities that ship first in a sibling SKU, APIs frozen at the acquired product’s specification, and packaging that changes around an unchanged engine. An ownership change is not a defect—some of the strongest platform inheritance here comes from exactly these events—but it should trigger explicit diligence on documentation currency, module boundaries, and the roadmap standing of the specific SKU you are buying.

Zero trust network access sits in the middle of an identity-to-application value chain. It consumes identity, device, and risk context from systems the organization already runs, refines them into per-session access decisions and governed connectivity, and feeds the platforms where security operations, automation, and audit happen. No product in this report operates alone, and much of the differentiation lives at the two seams.

In the identity stack, ZTNA is the enforcement layer for everything federation alone cannot govern: the identity provider decides who the user is, and the access fabric decides what that identity may reach right now, from this device, in this posture. The strongest integrations make those two layers one system—directory groups driving entitlements, identity events interrupting live sessions, deprovisioning that revokes reachability rather than only login. The boundary with the network stack is under equal pressure from the other side: SD-WAN, firewall, and SSE portfolios all claim the same connective tissue, and buyers should decide deliberately whether they are purchasing an access product, a platform module, or the platform itself.

On lifecycle timing, buy or replace when the estate changes shape: a VPN refresh or end-of-life, an identity-platform migration, a merger that doubles the contractor population, a cloud or OT expansion the current perimeter cannot follow, or an AI-automation program that needs governed non-human access. Two choices are the durable ones and deserve the decade view: the connector and brokerage architecture, which determines your exposure model, and the policy engine, which accumulates your organization’s access logic. Clients, consoles, and even the inspection stack around them are more replaceable than they appear; the migration tooling documented across this field is genuinely good, and the capsules note where it is not.

The evaluation used 28 analyst-authored decision criteria with 0–5 scoring rubrics, grouped by lens. Scores of record for each vendor–product pair were assessed against these rubrics on published, verifiable evidence, then adjusted through fact-check adjudication where vendor-submitted evidence demonstrably satisfied a rubric’s requirements.

Green Money (Innovation & Growth)

• Automation and Orchestration API

• Single Packet Authorization

• SSE/SASE Platform Integration

• Application Discovery and Onboarding

• Clientless Access Architecture

• Policy Engine Architecture

• Connector and Relay Architecture

Brown Money (Operations & Efficiency)

• Session Reliability and Failover

• Identity Provider Integration Depth

• Endpoint Agent Manageability

• Access Troubleshooting and Diagnostics

• OT and Non-Standard Endpoint Coverage

• Multi-Tenant and Distributed Org Management

• VPN Migration Tooling

• Access Provisioning Automation Depth

GRCS (Governance, Risk, Compliance & Security)

• Service Resilience and Availability

• Third-Party and Contractor Access Governance

• Zero Trust Architecture Integrity

• Data Residency and Sovereignty Controls

• Supply Chain and Infrastructure Security

• Continuous Session Risk Evaluation

• Access Audit Trail and Forensics

• Regulatory Compliance Mapping

Emerging Technology

• Unified ZTNA and SSE Convergence

• Quantum-Resistant Cryptography

• Universal ZTNA for OT/IoT

• AI-Driven Policy Automation

• ZTNA for Agentic AI Workloads

*Vendors marked with an asterisk did not participate in our research process for the Radar report, and their capsules and scoring were compiled via desk research.

For more information about our research process for Radar reports, please visit our Methodology.

Chris Ray is a veteran of the cyber security domain. He has a collection of experiences ranging from small teams to large financial institutions. Additionally, Chris has worked in healthcare, manufacturing, and tech. More recently, he has acquired an extensive amount of experience advising and consulting with security vendors, helping them find product-market fit as well as deliver cyber security services.

GigaOm provides technical, operational, and business advice for IT’s strategic digital enterprise and business initiatives. Enterprise business leaders, CIOs, and technology organizations partner with GigaOm for practical, actionable, strategic, and visionary advice for modernizing and transforming their business. GigaOm’s advice empowers enterprises to successfully compete in an increasingly complicated business atmosphere that requires a solid understanding of constantly changing customer demands.

GigaOm works directly with enterprises both inside and outside of the IT organization to apply proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation. Research methodologies include but are not limited to adoption and benchmarking surveys, use cases, interviews, ROI/TCO, market landscapes, strategic trends, and technical benchmarks. Our analysts possess 20+ years of experience advising a spectrum of clients from early adopters to mainstream enterprises.

GigaOm’s perspective is that of the unbiased enterprise practitioner. Through this perspective, GigaOm connects with engaged and loyal subscribers on a deep and meaningful level.

© Knowingly, Inc. 2026 "GigaOm Radar: Zero Trust Network Access" is a trademark of Knowingly, Inc. For permission to reproduce this report, please contact sales@gigaom.com.