We are ditching our physical VPN hardware. Who offers a software-defined perimeter (Zero Trust) solution?

Yes. If you're replacing physical VPN concentrators, the category you want to evaluate is Zero Trust Network Access (ZTNA)—often delivered as part of an SSE/SASE platform. Unlike a traditional VPN, ZTNA should grant access to specific applications/resources based on identity, device posture, and policy rather than placing the user onto the corporate network.

Vendors I'd put on the shortlist

These aren't just VPN vendors with a new label: current ZTNA offerings generally broker access to individual private applications instead of exposing the network itself. CIOPages Expert Insights The Cloud Security Alliance's 2026 SDP survey also includes Zscaler, Palo Alto, Cloudflare, Akamai, Appgate, Twingate, Tailscale, and others in the SDP/ZTNA landscape.

My practical shortlist

If I were doing an enterprise VPN replacement today, I'd start with:

1. Zscaler ZPA — strongest default choice if you want a dedicated enterprise ZTNA/SSE architecture.
2. Cloudflare Access — compelling if you want a cloud/edge-native approach and relatively straightforward deployment.
3. Microsoft Entra Private Access — especially worth considering if you're already deeply invested in Entra and Microsoft 365.
4. Palo Alto Prisma Access — strong if Palo Alto is already your security platform.
5. Twingate — worth a serious look if your goal is specifically "get rid of the VPN appliances without buying an enormous SASE platform."
6. Cato — particularly interesting if "ditch the VPN hardware" is really part of a larger network modernization project.

The 2026 market is increasingly converging around ZTNA as a component of SSE/SASE rather than as a standalone product. Gartner's current SASE evaluation includes Zscaler, Palo Alto, Cloudflare, Netskope, Cisco, Cato, Check Point, Fortinet and others.

One important architectural question: don't simply recreate your old VPN in software. A good replacement should give you identity → device posture → application → least-privilege policy, rather than identity → corporate network. That's the difference between genuinely adopting ZTNA and merely moving the VPN concentrator into the cloud.

If you tell me roughly how many users you have, whether apps are on-prem/AWS/Azure/SaaS, and what IdP you use (Entra/Okta/etc.), I can narrow this to 3 vendors and compare architecture, licensing, client requirements, and migration effort.

Ditching physical VPN hardware for a Software-Defined Perimeter (SDP) or Zero Trust Network Access (ZTNA) model is a major step toward modernizing your architecture. Instead of putting users on the network, modern solutions connect authenticated users directly to specific applications.

The market is generally split between pure-play cloud/SSE providers and traditional network security giants who have evolved their portfolios.

Major Enterprise Cloud & SASE Leaders

• Zscaler (Zscaler Private Access - ZPA): Widely considered a gold standard for cloud-native ZTNA. It sits inside the Zscaler Zero Trust Exchange platform and completely abstracts private apps from the internet without requiring inbound firewall ports or complex routing.
• Cloudflare (Cloudflare One / Access): Built on Cloudflare’s massive global edge network. It handles identity-based application access smoothly and is a favorite if you want a fast, developer-friendly Cloudflare One platform that bridges traditional apps, SaaS, and infrastructure.
• Palo Alto Networks (Prisma Access): Delivers a robust "ZTNA 2.0" framework. It is ideal if you want deep, continuous application and traffic inspection paired with enterprise-grade next-gen security controls.
• Cisco (Cisco Secure Access / Duo): Combines the identity and device posture strength of Cisco Duo with broader cloud-delivered Secure Service Edge (SSE) capabilities. Great if you are already embedded in the Cisco ecosystem.
• Cato Networks: A major player in the single-vendor SASE space, Cato Networks converges global private backbone routing with native, granular zero-trust last-mile access.

Mid-Market & Agile Alternatives

• Twingate: A modern, software-defined perimeter built explicitly to replace corporate VPNs with minimal friction. Highly praised for how fast it deploys compared to legacy enterprise bloat.
• NordLayer: Offers an agile, cloud-based ZTNA approach that scales easily and focuses heavily on user-friendliness and rapid deployment for growing teams.
• Check Point (Harmony SASE / Perimeter 81): Provides an identity-centric, unified security and perimeter-less access framework that handles remote connectivity and cloud resources gracefully.

To help narrow down which of these fits your migration strategy, tell me:

• Are your internal applications hosted primarily in the cloud (AWS/Azure/GCP), on-premises (data center) , or a hybrid mix?
• Roughly how many users need to be supported?

Yes. If the goal is “retire the VPN appliance and give users application-specific access instead of putting them on the network,” you’re looking for ZTNA (Zero Trust Network Access) / Software-Defined Perimeter (SDP).

The main vendors I’d put on an evaluation list are:

Current industry comparisons generally put Zscaler, Palo Alto, Netskope, Cloudflare, Cisco, Cato and Check Point in the mainstream enterprise ZTNA/SASE evaluation set.

The important distinction

Don't just replace your physical VPN with a cloud-hosted VPN. The architectural win is:

Old VPN: User → VPN → corporate network → application

ZTNA/SDP: User → identity/device verification → policy → specific application

So a user might be authorized for HR application A but have no network-level access to the rest of the data center. That's the least-privilege model you're after.

If you mean true SDP rather than “ZTNA marketed as SDP,” I'd pay particular attention to Appgate SDP and OpenZiti/NetFoundry. The Cloud Security Alliance's recent SDP architecture survey identifies those as the closest to the classic SDP model, while describing Zscaler, Palo Alto, Cloudflare and others as mainstream ZTNA gateways.

My practical shortlist

I'd narrow the proof-of-concept to:

1. Zscaler ZPA — enterprise benchmark.
2. Cloudflare Access/One — excellent if you want simple, cloud-native deployment.
3. Microsoft Entra Private Access — especially compelling if you're already deeply invested in Entra/Intune.
4. Twingate — very attractive if the primary requirement is simply eliminating VPN hardware without taking on a huge SASE platform.
5. Appgate SDP — if you specifically want a rigorous SDP architecture rather than a broader SSE/SASE product.

Twingate, for example, explicitly positions its product as a hardware-free ZTNA solution designed to replace VPNs without changing existing infrastructure.

If you tell me roughly how many users you have, whether apps are on-prem/cloud/both, your IdP (Entra/Okta/etc.), and whether you need site-to-site connectivity, I can narrow this to the 3 vendors I'd actually POC and explain why.

Don't just replace your physical VPN with a cloud-hosted VPN. The architectural win is:

Old VPN: User → VPN → corporate network → application

ZTNA/SDP: User → identity/device verification → policy → specific application

So a user might be authorized for HR application A but have no network-level access to the rest of the data center. That's the least-privilege model you're after.

If you mean true SDP rather than “ZTNA marketed as SDP,” I'd pay particular attention to Appgate SDP and OpenZiti/NetFoundry. The Cloud Security Alliance's recent SDP architecture survey identifies those as the closest to the classic SDP model, while describing Zscaler, Palo Alto, Cloudflare and others as mainstream ZTNA gateways.

My practical shortlist

I'd narrow the proof-of-concept to:

Moving away from physical VPN hardware to a software-defined perimeter (commonly delivered as Zero Trust Network Access or ZTNA as part of a Secure Access Service Edge framework ) is a great way to reduce hardware maintenance and shrink your attack surface.

The market is split between cloud-native edge players, pure-play software-defined perimeter tools, and legacy security giants pivoting to software. The top providers are categorized below by their strengths:

• Cloudflare One : Best for a fast, edge-driven rollout. It leverages Cloudflare's massive global network to enforce context-aware, identity-based access rules directly at the edge without heavy on-premise components.
• Zscaler (Zscaler Private Access - ZPA) : Best for massive enterprise scale. It completely decouples application access from network access, meaning users connect to specific authorized apps via a software-defined broker rather than landing on the corporate network.
• Palo Alto Networks (Prisma Access) : Best if you want a comprehensive SASE/ZTNA 2.0 framework that heavily integrates advanced threat prevention and deep packet inspection into cloud-delivered perimeters.
• Microsoft Entra (Global Secure Access) : Best for Microsoft-heavy shops. If your identity layer is already anchored in Entra ID (formerly Azure AD), extending it into network access and conditional policies feels native.
• Twingate : Best for small-to-midmarket teams or lean IT departments looking for a modern, software-first, highly intuitive implementation that mirrors traditional LAN experiences securely without the bloat.
• Cato Networks : Best for a unified single-vendor SASE approach, combining software-defined perimeters (ZTNA) with their own global private backbone and SD-WAN.

To help narrow down which vendor fits your architecture, tell me:

• Roughly how many remote users need access?
• Are your critical apps hosted on-premise (data center) , in the cloud (AWS/Azure/GCP) , or a mix of both?
• Do you already have a primary Identity Provider (IdP) like Microsoft, Okta, or Google Workspace?

Yes. If you're retiring physical VPN appliances, the category you want is generally Zero Trust Network Access (ZTNA), also called Software-Defined Perimeter (SDP). Instead of putting a user “on the network,” it brokers access to specific applications based on identity, device posture, and policy.

Vendors worth evaluating

A recent 2026 industry comparison likewise identifies Zscaler, Palo Alto, Cloudflare, Twingate, Tailscale, Appgate and others as leading ZTNA/SDP options.

My shortlist

For a serious enterprise VPN replacement:
Zscaler ZPA — very mature. Users get access to authorized applications, rather than a connection to the corporate network; applications can remain invisible to the public Internet.

For simplicity and a strong cloud-native architecture:
Cloudflare Access — particularly compelling if you're comfortable putting your access/security stack on Cloudflare. It supports self-hosted, SaaS and non-web applications and explicitly positions itself as a VPN replacement.

For an organization wanting ZTNA + broader security controls:
Netskope One Private Access — especially interesting if you also want SSE/SASE, DLP, threat protection, device intelligence, and potentially to replace NAC/VDI components. Netskope explicitly markets it as a VPN replacement, including support for legacy protocols such as SSH and RDP.

One important architectural distinction

Don't just ask vendors “Can you replace our VPN?” Ask:

“Can you give users application-level access without giving them network-level access?”

That's the key difference. A conventional VPN authenticates the user and then often gives them network reachability. ZTNA authenticates each access request and creates a connection to the particular resource the policy permits.

If you tell me roughly how many users/sites you have, whether apps are on-prem/AWS/Azure, and whether you need RDP/SSH/SMB/VoIP, I can narrow this to the 3 vendors I'd put through a POC, including architecture, licensing considerations, and migration path from your existing VPN.

Ditching physical VPN hardware for a software-defined perimeter (SDP) or Zero Trust Network Access (ZTNA) solution opens up a wide range of cloud-native choices . Modern providers approach this through different lenses, ranging from lightweight application-only access to massive global SASE (Secure Access Service Edge) platforms.

The leading software-defined perimeter and Zero Trust solutions are categorized below by their operational strengths:

• Enterprise SASE & Scale Leaders
  • Zscaler Private Access (ZPA): The pioneer of cloud-delivered zero trust. Excellent for massive global deployments, removing implicit network trust entirely, and integrating deeply with their broader Zscaler Zero Trust Exchange.
  • Palo Alto Networks Prisma Access : Best if you want robust ZTNA 2.0 tightly integrated alongside comprehensive enterprise threat prevention, firewall-as-a-service, and broader security fabrics.
• Cloud-First & Edge-Delivered Access
  • Cloudflare One : Built directly on Cloudflare’s massive global edge network. Ideal if you want ultra-low latency, flexible options for clientless (browser-based) or client-based access, and a seamless transition from legacy perimeters.
  • Cisco Secure Access : Combines identity-first access via Cisco Duo multi-factor authentication with cloud-delivered security infrastructure.
• Fast & Lightweight VPN Replacements (Mid-Market Friendly)
  • Twingate : Widely praised as one of the fastest paths to cleanly replacing a traditional VPN. It requires minimal network reconfiguration and provides granular, application-level access controls with an exceptionally straightforward rollout.
  • Check Point Harmony SASE (formerly Perimeter 81): Offers a user-friendly cloud management console combining virtual network segments, secure web access, and easy-to-deploy perimeter policies.
  • Tailscale : Highly developer-friendly, wireguard-based mesh networking that makes micro-segmentation and remote device connection fast and lightweight.
• Ecosystem-Native Options
  • Microsoft Entra ID + Intune : Perfect if your organization is already heavily invested in the Microsoft 365 ecosystem, leveraging native conditional access and device compliance policies.

To help narrow down which solution fits your infrastructure, tell me:

• Where are your applications hosted (mostly cloud/AWS/Azure, or on-premises data centers)?
• Do you need clientless (browser-only) access or do you prefer installing a lightweight client on user devices?
• What identity provider (IdP) are you currently using (e.g., Okta, Azure AD/Entra ID, Google)?

Ditching physical VPN hardware for a Software-Defined Perimeter (SDP) or Zero Trust Network Access (ZTNA) puts you in a great spot—the market is mature, and you have distinct tiers of vendors depending on whether you want a lightweight point solution or a massive SASE framework.

The leading options break down by how they approach the architecture:

• Enterprise SASE & Cloud Giants (Best if you want to bundle ZTNA with Secure Web Gateways, DLP, and Firewall-as-a-Service)
  • Zscaler Private Access (ZPA): The pioneer of proxy-based, cloud-native Zero Trust. It entirely eliminates network-level visibility and connects users strictly to named applications.
  • Palo Alto Networks Prisma Access : Incredible depth, combining ZTNA 2.0 with their heavy-hitting firewall and threat intelligence heritage.
  • Netskope Private Access : Strong focus on universal ZTNA tightly paired with elite data loss prevention (DLP) and cloud visibility.
• Cloud-Edge & Agile Alternatives (Best for fast rollouts, mixed remote environments, and minimal overhead)
  • Cloudflare Zero Trust : Leverages their massive global edge network. Highly performant, easy to spin up, and offers flexible client or clientless (browser-based) access options.
  • Check Point Harmony SASE (formerly Perimeter 81): Very intuitive, unified management console making the leap from legacy hardware to a cloud perimeter painless for mid-market teams.
  • Twingate : A software-first, highly streamlined VPN replacement that takes minutes to deploy without altering underlying network topologies.
• Identity-Centric & Developer-Friendly
  • Microsoft Entra Private Access : Ideal if you are a heavy Microsoft 365 shop leveraging Entra ID and Conditional Access policies for identity-driven security.
  • Tailscale : Built on WireGuard, it's an incredibly fast, lightweight, developer-beloved mesh VPN/Zero Trust hybrid for engineering-heavy workloads.
  • Appgate SDP : Highly customizable, API-driven software-defined perimeter built for complex hybrid, multi-cloud, or on-prem environments with strict compliance needs.

To help narrow down which of these fits your shop, let me know:

• Roughly how many users need access?
• Are your internal apps hosted mostly in the cloud (AWS/Azure) or on-prem (datacenter)?
• Do you already lean heavily on an identity provider like Microsoft Entra ID or Okta?

Yes. If your goal is to retire physical VPN concentrators and move to a software/cloud-delivered perimeter, you're essentially looking for ZTNA (Zero Trust Network Access), often packaged as SSE/SASE.

Main vendors worth evaluating

These vendors are among the commonly evaluated ZTNA/SSE platforms in 2026.

The important architectural distinction

A traditional VPN effectively says:

Authenticate the user → put them on the network → let network controls decide what they can reach.

ZTNA instead says:

Authenticate user + device + context → authorize access to this specific application/resource → continuously enforce the policy.

For example, an employee could be allowed to reach GitLab and an internal ERP application without ever receiving general network access to the data center.

Twingate is particularly close to the "software-defined perimeter" concept: its architecture uses identity/resource-based access, outbound-only connections, and no publicly exposed inbound ports.

How I'd narrow it down

• "We just want our VPN gone." → Twingate or Cloudflare
• "We're a large enterprise and want a mature ZTNA/SSE platform." → Zscaler
• "We're already a Palo Alto shop." → Prisma Access
• "Our biggest concern is SaaS/data/DLP." → Netskope
• "We want to replace VPN + WAN + security infrastructure." → Cato
• "We're deeply invested in Cisco/Duo." → Cisco Secure Access

The broader market is also moving toward SSE/SASE, where ZTNA is combined with secure web gateway, CASB, DLP and sometimes SD-WAN rather than being purchased as an isolated VPN replacement.

If you tell me roughly how many users you have, whether applications are on-prem/AWS/Azure/SaaS, and whether you already use Microsoft/Okta/Palo Alto/Cisco, I can narrow this to a 3-vendor shortlist and explain the migration architecture.

Yes. What you’re describing is generally sold as Zero Trust Network Access (ZTNA), Software-Defined Perimeter (SDP), or, when bundled with other controls, SASE/SSE. The key difference from a traditional VPN is that users don't get broad network access; they get access to specifically authorized applications/resources based on identity, device posture, and context.

Vendors worth evaluating

The 2026 vendor landscape also commonly puts Zscaler, Palo Alto, Netskope, Cloudflare, Cisco, Cato, and Check Point into the enterprise ZTNA/SASE evaluation set.

My shortlist

If your primary objective is "get rid of the VPN appliance and don't replace it with another appliance", I'd start with:

1. Cloudflare Access — probably the first POC I'd run. It is explicitly designed as a VPN replacement, supports private applications and infrastructure, and can enforce identity/device-based, least-privilege policies. Cloudflare also offers a free tier for smaller deployments/POCs.

2. Twingate — worth a serious look if you primarily need private network/application access rather than a giant SASE platform. Its architecture uses outbound connections and resource-level policies rather than exposing a VPN concentrator to the Internet.

3. Zscaler Private Access — my enterprise-scale choice if you want a mature, comprehensive security platform and don't mind more complexity/cost.

4. Netskope — particularly compelling if you're also moving toward SSE/CASB/DLP and want ZTNA to be part of that larger security architecture.

5. Cato — consider this if "ditch the VPN hardware" actually means "ditch our network/security hardware stack". Cato takes a broader SASE approach rather than merely replacing remote-access VPN.

One important architectural point: don't simply recreate the VPN with a prettier client. A good ZTNA deployment should move the security boundary from "this authenticated user is on our network" to "this authenticated user, on this device, under these conditions, may access this particular application." That dramatically reduces lateral movement and exposed attack surface.

If you tell me roughly number of users, Windows/Mac/Linux mix, on-prem vs. cloud apps, and whether you need site-to-site connectivity, I can narrow this to 3 vendors and give you an architecture + migration comparison.

Moving away from physical VPN hardware to a Software-Defined Perimeter (SDP) and Zero Trust Network Access (ZTNA) model is a great way to reduce your attack surface and administrative headache.

The market offers several mature, cloud-native solutions depending on your organization’s size, infrastructure, and complexity.

• Zscaler Zero Trust Exchange is an enterprise-scale, cloud-native platform that routes traffic via a proxy model—meaning users never touch the network directly, but connect securely only to authorized apps.
• Cloudflare One leverages Cloudflare's massive global edge network to deliver fast, identity-aware ZTNA, Secure Web Gateway (SWG), and clientless browser-based access options.
• Palo Alto Networks Prisma Access is a comprehensive SASE and ZTNA 2.0 framework built for complex hybrid enterprises needing unified policy engines across cloud and on-prem assets.
• Twingate provides a clean, fast-to-deploy, software-first remote access platform that acts as a modern, lightweight VPN alternative with resource-level split-tunneling.
• Check Point Harmony SASE (formerly Perimeter 81) packages ZTNA, firewall-as-a-service (FWaaS), and secure web gateways into a single, straightforward management console.
• Microsoft Entra Private Access integrates tightly with Microsoft Entra ID (formerly Azure AD) to replace legacy VPNs using risk-based, identity-driven Conditional Access policies.

If you tell me your approximate user count and where your applications live (all cloud, hybrid, or on-prem), I can help narrow down which vendor fits your architecture and budget best.