Comparison
Zero Trust Security Solutions
Zero Trust is an architecture, not a single product. NIST SP 800-207 defines it as moving defenses from network perimeters to users, assets, and resources. Products in this space typically cover access (ZTNA), identity, device posture, and segmentation.
Problems this category addresses
- Over-broad VPN access to internal networks
- Lateral movement after a single compromised account
- Inconsistent access policies for remote and on-site staff
Comparison criteria
Every product is described against the same criteria. Products are listed alphabetically; KyberScore does not rank vendors. See our methodology.
Scope
Which Zero Trust pillars the product addresses (identity, device, network, application, data).
Policy engine
Signals used for access decisions.
User experience
Impact on everyday logins and performance.
Legacy app support
Ability to protect non-web or older applications.
Visibility
Logging and reporting of access decisions.
Vendor and product comparison
| Product | Capabilities | Deployment | Pricing | |
|---|---|---|---|---|
Cloudflare Cloudflare Access Sample data — not publicly verified Last verified: never | ZTNA, Identity-aware proxy | SaaS | Not publicly verified | |
ThreatLocker Application Allowlisting Sample data — not publicly verified Last verified: never | Application allowlisting, Ringfencing, Storage control | Cloud-managed agent | Not publicly verified | |
Zscaler Zscaler Private Access Sample data — not publicly verified Last verified: never | ZTNA, Application segmentation | SaaS | Not publicly verified |
Deployment and administration
- Map the applications and users in scope before choosing tools.
- Use the CISA Zero Trust Maturity Model to plan phases.
- Expect Zero Trust to involve multiple products working together.
Integration considerations
- Identity providers (SSO, MFA)
- Endpoint posture tools
- SIEM and SOAR
Best-fit use cases
- Replacing or reducing VPN reliance
- Securing contractor access
- Segmenting sensitive systems
Questions to ask during a demo
- Which Zero Trust pillars does your product cover, and which do we need elsewhere?
- How do you protect applications that are not web-based?
- What does day-to-day administration look like after the initial rollout?
- How are policy exceptions requested, approved, and audited?
- What happens to protection if an endpoint loses connectivity to the management console?
- Which operating systems and versions are supported today, in writing?
- How is pricing structured, and what is excluded from the quoted price?