# Zero trust network access: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "ZTNA solution" and as "zero trust remote access tool to replace a VPN", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/network/zero-trust-network-access/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/zero-trust-network-access/index.md

**Standing:** Cloudflare One leads with 42% of first choices; verdict clear leader. 40 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare One](https://www.gane.ai/index/it/vendors/cloudflare-one/index.md) | 42% | 0% | 50 |
| 2 | [Twingate](https://www.gane.ai/index/it/vendors/twingate/index.md) | 28% | 0% | 44 |
| 3 | [Cato Networks](https://www.gane.ai/index/it/vendors/cato-networks/index.md) | 12% | 0% | 16 |
| 4 | [OpenVPN CloudConnexa](https://www.gane.ai/index/it/vendors/openvpn-cloudconnexa/index.md) | 10% | 0% | 11 |
| 5 | [NordLayer](https://www.gane.ai/index/it/vendors/nordlayer/index.md) | 2% | 6% | 17 |
| 6 | [Zscaler Private Access](https://www.gane.ai/index/it/vendors/zscaler-private-access/index.md) | 2% | 36% | 45 |
| 7 | [Check Point Harmony SASE](https://www.gane.ai/index/it/vendors/check-point-harmony-sase/index.md) | 2% | 27% | 30 |
| 8 | [Tailscale](https://www.gane.ai/index/it/vendors/tailscale/index.md) | 0% | 11% | 19 |
| 9 | [Palo Alto Networks Prisma Access](https://www.gane.ai/index/it/vendors/palo-alto-networks-prisma-access/index.md) | 0% | 25% | 24 |
| 15 | [Fortinet Universal ZTNA](https://www.gane.ai/index/it/vendors/fortinet-universal-ztna/index.md) | 0% | 23% | 13 |
| 16 | [Netskope Private Access](https://www.gane.ai/index/it/vendors/netskope-private-access/index.md) | 0% | 28% | 25 |

Rank is by share of first choices among all 57 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cloudflare One, Twingate; alternatives Cato Networks, NordLayer, Zscaler Private Access
- GPT-5.4 mini: Cloudflare One; alternatives Microsoft Entra Private Access, Zscaler Private Access
- Gemini 3.5 Flash: Twingate; alternatives Cato Networks, Check Point Harmony SASE, Cloudflare One, Microsoft Entra Private Access
- Perplexity Sonar: Cloudflare One; alternatives Cato Networks, Cisco Duo, Twingate, Zscaler Private Access
- Grok 4.20: Cato Networks; alternatives Check Point Harmony SASE, Cloudflare One, Twingate, Zscaler Private Access
- Mistral Small: Cato Networks; alternatives Netskope Private Access, NordLayer, Twingate
- DeepSeek V4 Flash: Cato Networks; alternatives Check Point Harmony SASE, Twingate
- Llama 4 Maverick: OpenVPN CloudConnexa; alternatives Cato Networks, Microsoft Entra ID, NordLayer, Zscaler Zero Trust Exchange
- Qwen 3.7 Flash: Twingate; alternatives Cato Networks, Cloudflare One
- Kimi K2: Cato Networks; alternatives Check Point Harmony SASE, Cloudflare One, OpenVPN CloudConnexa, Twingate
- GLM 4.7 FlashX: Cato Networks; alternatives Check Point Harmony SASE, Cloudflare One, OpenVPN CloudConnexa, Twingate
- MiniMax M2.5: no first choice

## Sources the answers cite

68 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- cybersecuritynews.com: 37 answers, 39 citations
- portnox.com: 30 answers, 35 citations
- petronellatech.com: 30 answers, 30 citations
- cyberpress.org: 25 answers, 31 citations
- expertinsights.com: 25 answers, 25 citations
- aimultiple.com: 24 answers, 25 citations
- startwithidentity.com: 16 answers, 16 citations
- akamai.com: 14 answers, 14 citations

Pages named in the most answers:

- https://cybersecuritynews.com/best-ztna-solutions (36 answers)
- https://petronellatech.com/blog/zero-trust-vendors-compared-top-10-smbs-2026 (30 answers)
- https://expertinsights.com/network-security/the-top-zero-trust-network-access-solutions (24 answers)
- https://aimultiple.com/ztna-solutions (23 answers)
- https://portnox.com/cybersecurity-101/zero-trust/who-are-the-best-ztna-providers (18 answers)
- https://cyberpress.org/ztna-solutions-by-business-size (16 answers)
- https://akamai.com/site/en/documents/analyst-report/2024/kuppingercole-ztna-analyst-report.pdf (14 answers)
- https://startwithidentity.com/articles/top-8-zero-trust-network-access-tools (14 answers)
- https://zendikt.com/category/ztna-software (11 answers)
- https://cipherssecurity.com/best-ztna-platforms-2026 (10 answers)

## Warned against

- Zscaler Private Access: 16 of 45 labels negative. "CVE-2025-54982 - SAML authentication bypass; failed to validate SAML assertion signatures | Complete authentication bypass" (Kimi K2, negative prompt)
- Netskope Private Access: 7 of 25 labels negative. "Cross-tenant vulnerabilities with leaked enrollment tokens | Attackers could compromise ANY organization" (Kimi K2, negative prompt)
- Check Point Harmony SASE: 8 of 30 labels negative. "(Perimeter 81/Harmony SASE) | Hard-coded encryption keys in diagnostic logs | Customer data exposure" (Kimi K2, negative prompt)
- Palo Alto Networks Prisma Access: 6 of 24 labels negative. "Enterprise-heavy like Zscaler/Palo Alto? Avoid—custom pricing often $15+/user, no free tiers." (Grok 4.20, budget prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.