Zero trust network access
Asked as “ZTNA solution”, and as “zero trust remote access tool to replace a VPN”, on behalf of a mid-market B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
36%
Contested · Twingate 36%
36Cloudflare One36Twingate13Cato Networks15others
36% of first choices, contested.
Since October 2026↗new leaderNew leader since October 2026: Cloudflare One (36%) replaces Twingate (39% then, 36% now), 0 points clear, inside the 11-point floor.Cloudflare One leads at 36%, replacing Twingate, which led at 39% and stands at 36% now: 0 points clear, inside the floor, so the swap reads as unsettled.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Cloudflare One53%Clear leader▼−5Since October 2026: 58% → 53%, −5 points. Inside the 11-point floor: within noise.Standing →Mid-marketCloudflare One36%Contested↗new leaderNew leader since October 2026: Cloudflare One (36%) replaces Twingate (39% then, 36% now), 0 points clear, inside the 11-point floor.This pageEnterprise
Zscaler Private Access63%Clear leader▲+10Since October 2026: 53% → 63%, +10 points. Inside the 11-point floor: within noise.Standing →
Cloudflare One53%Clear leader▼−5Since October 2026: 58% → 53%, −5 points. Inside the 11-point floor: within noise.Standing →Mid-marketCloudflare One36%Contested↗new leaderNew leader since October 2026: Cloudflare One (36%) replaces Twingate (39% then, 36% now), 0 points clear, inside the 11-point floor.This pageEnterpriseZscaler Private Access63%Clear leader▲+10Since October 2026: 53% → 63%, +10 points. Inside the 11-point floor: within noise.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Cloudflare One36%0%64endorsed leader▼−2Since October 2026: 38% → 36%, −2 points. Inside the 11-point floor: within noise.38% → 36%
Cloudflare One36%0%64endorsed leader▼−2Since October 2026: 38% → 36%, −2 points. Inside the 11-point floor: within noise.38% → 36%02
Twingate36%0%48endorsed leader▼−3Since October 2026: 39% → 36%, −3 points. Inside the 11-point floor: within noise.39% → 36%
Twingate36%0%48endorsed leader▼−3Since October 2026: 39% → 36%, −3 points. Inside the 11-point floor: within noise.39% → 36%03
Cato Networks13%0%15accepted challenger▲+7Since October 2026: 6% → 13%, +7 points. Inside the 11-point floor: within noise.6% → 13%
Cato Networks13%0%15accepted challenger▲+7Since October 2026: 6% → 13%, +7 points. Inside the 11-point floor: within noise.6% → 13%04
Microsoft Entra Private Access4%5%20accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%
Microsoft Entra Private Access4%5%20accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%05Zscaler Private Access4%35%54criticized challenger▲+1Since October 2026: 3% → 4%, +1 point. Inside the 11-point floor: within noise.3% → 4%
Zscaler Private Access4%35%54criticized challenger▲+1Since October 2026: 3% → 4%, +1 point. Inside the 11-point floor: within noise.3% → 4%06
Check Point Harmony SASE4%28%25criticized challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%
Check Point Harmony SASE4%28%25criticized challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%Show the five products at 0%, ordered by negative rate
11
Fortinet Universal ZTNA0%36%14criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Fortinet Universal ZTNA0%36%14criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%09
Netskope Private Access0%25%24criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Netskope Private Access0%25%24criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%08
Palo Alto Networks Prisma Access0%24%33accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Palo Alto Networks Prisma Access0%24%33accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%10
NordLayer0%10%10accepted challenger▼−3Since October 2026: 3% → 0%, −3 points. Inside the 11-point floor: within noise.3% → 0%
NordLayer0%10%10accepted challenger▼−3Since October 2026: 3% → 0%, −3 points. Inside the 11-point floor: within noise.3% → 0%07
Tailscale0%4%25accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Tailscale0%4%25accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All fifteen head-to-head pages: the top six products, each against each
Cloudflare One vs Zscaler Private AccessCloudflare One vs Check Point Harmony SASETwingate vs Cato NetworksTwingate vs Microsoft Entra Private AccessTwingate vs Zscaler Private AccessTwingate vs Check Point Harmony SASECato Networks vs Microsoft Entra Private AccessCato Networks vs Zscaler Private AccessCato Networks vs Check Point Harmony SASEMicrosoft Entra Private Access vs Zscaler Private AccessMicrosoft Entra Private Access vs Check Point Harmony SASEZscaler Private Access vs Check Point Harmony SASE
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Cloudflare One36%
Cloudflare One36%02Twingate36%
Twingate36%03Cato Networks13%
Cato Networks13%04Microsoft Entra Private Access4%
Microsoft Entra Private Access4%05Zscaler Private Access4%
Zscaler Private Access4%06Check Point Harmony SASE4%
Check Point Harmony SASE4%07Tailscale0%
Tailscale0%08Palo Alto Networks Prisma Access0%
Palo Alto Networks Prisma Access0%09Netskope Private Access0%
Netskope Private Access0%10NordLayer0%
NordLayer0%11Fortinet Universal ZTNA0%
Fortinet Universal ZTNA0%What they warned about
Two of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Zscaler Private Access35%
19 of 54 labels negative · 12 of 14 models · 2 hard negative
“suggest avoiding Zscaler for mid-market organizations, citing complexity, high cost, and being designed primarily for Fortune 500 scale” Mistral Small, negative prompt
Check Point Harmony SASE28%
7 of 25 labels negative · 7 of 14 models · 3 hard negative
“warnings to avoid or delay adoption of Check Point Harmony SASE until you verify that their remediation for any security issues is architectural” Mistral Small, negative prompt
Palo Alto Networks Prisma Access24%
8 of 33 labels negative · 6 of 14 models · 1 hard negative
“Better for large enterprises already standardized on Palo Alto” Kimi K2, paraphrase prompt
Netskope Private Access25%
6 of 24 labels negative · 6 of 14 models
“Netskope suffered from cross-tenant vulnerabilities that let attackers compromise any organization using leaked enrollment tokens.” Muse Glimmer 30B, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
74 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 807 links across 208 sites, every framing counted. Ranked by the number of answers carrying the site or page. 35 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · CyberPress24 answers · 24 citations · 11 models
vendor site · Cloudflare23 answers · 35 citations · 11 models
23 answers · 23 citations · 9 models
19 answers · 20 citations · 8 models
17 answers · 29 citations · 10 models
17 answers · 18 citations · 9 models
vendor site · Portnox16 answers · 16 citations · 8 models
15 answers · 24 citations · 10 models
vendor site · Twingate13 answers · 20 citations · 7 models
vendor site · Zscaler13 answers · 19 citations · 9 models
13 answers · 13 citations · 8 models
13 answers · 13 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
21 answers · 11 models
19 answers · 9 models
17 answers · 7 models
13 answers · 8 models
13 answers · 8 models
12 answers · 7 models
12 answers · 7 models
11 answers · 7 models
11 answers · 6 models
11 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best ztna solution”, “ztna solution”, “ztna solutions”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Cloudflare parent site Cloudflare One 36% | 36% | 355 | 550,000 | 10,897 | ||||
| Twingate twingate.com | 36% | 170 | 9,900 | 126 | 119,706 | 5 | ||
| Cato catonetworks.com Cato Networks 13%, Cato Networks Universal ZTNA 0% | 13% | 133 | 5,400 | 120 | 20,161 company | 10 | ||
| Microsoft parent site Microsoft Entra Private Access 4% | 4% | 51 | 2,240,000 | 403,136 | ||||
| Zscaler zscaler.com Zscaler Private Access 4% | 4% | 166 | 60,500 | 3,104 | 103,886 company | $9,116 | 66 | 1 |
| Check Point checkpoint.com Check Point Harmony SASE 4% | 4% | 139 | 14,800 | 4,487 | 370,648 company | $255 | 48 | |
| Cisco parent site Cisco Duo 2%, Cisco Secure Access 0% | 2% | 189 | 165,000 | 48,352 | ||||
| Mamori.io's Free ZTNA Solution | 2% | |||||||
| Tailscale tailscale.com | 0% | 73 | 165,000 | 2,416 | 115,710 | 33 | ||
| Palo Alto Networks parent site Palo Alto Networks Prisma Access 0% | 0% | 111 | 40,500 | 1,088 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (aimultiple.com, cloudflare.com, portnox.com, zscaler.com). The first result for “best ztna solution” is reddit.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best ZTNA solution for a mid-market B2B company?”Paraphrase“Which zero trust remote access tool to replace a VPN would you recommend to a mid-sized B2B company?”Comparative“What are the top ZTNA solutions and how do they differ?”Budget-constrained“What is the best ZTNA solution for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a ZTNA solution. What should we look at?”Negative“Which ZTNA solutions should I avoid or be cautious about?”
Claude Haiku 4.5Cato Networks, TwingateTwingateChangedno first choiceCloudflare Oneno first choicenothing named
Three alternatives
Cloudflare One, Fortinet Universal ZTNA, Zscaler Zero Trust ExchangeTwo alternatives
Cloudflare One, NordLayerOne alternative
NordLayerGPT-5.4 miniZscaler Private AccessCloudflare OneChangedZscaler Private AccessCloudflare Oneagainst: Netskope Private Access, Palo Alto Networks Prisma Access, Zscaler Private Accessno first choiceagainst: Ivanti Connect Secure, Pulse Connect Secure
Four alternatives
Cato Networks Universal ZTNA, Cloudflare One, Netskope Private Access, Palo Alto Networks Prisma AccessThree alternatives
Netskope Private Access, Palo Alto Networks Prisma Access, Zscaler Private AccessFive alternatives
Cloudflare One, Microsoft Entra Private Access, NetFoundry, Tailscale, TeleportTwo alternatives
Microsoft Entra Private Access, TailscaleGemini 3.5 FlashTwingateagainst: Zscaler Private AccessTwingateHeldagainst: Palo Alto Networks Prisma Access, Zscaler Private AccessZscaler Private AccessCloudflare OneCloudflare Oneagainst: Zscaler Private Accessnothing named
Three alternatives
Cloudflare One, Harmony SASE / Perimeter 81, Microsoft Entra Private AccessThree alternatives
Check Point Harmony SASE, Cloudflare One, TailscaleSix alternatives
Cloudflare One, Fortinet Universal ZTNA, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, TailscaleFour alternatives
Headscale, NetBird, Tailscale, TwingateFour alternatives
Cisco Secure Access, Palo Alto Networks Prisma Access, Tailscale, TwingatePerplexity SonarCato Networksagainst: Microsoft Entra Private Access, Zscaler Private AccessTwingateChangedZscaler Private AccessTwingateno first choicenothing named
Three alternatives
Check Point Harmony SASE, Cloudflare One Access, TwingateFive alternatives
Cato Networks Universal ZTNA, Cloudflare One, NordLayer, Tailscale, Zscaler Private AccessSeven alternatives
Cisco Secure Access, Cloudflare One, Fortinet Universal ZTNA, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, TwingateTwo alternatives
Cloudflare One, OpenVPN CloudConnexaGrok 4.20Cloudflare One, Twingateagainst: Netskope Private Access, Palo Alto Networks Prisma Access, Zscaler Private AccessTwingateChangedagainst: NordLayer, Palo Alto Networks Prisma AccessZscaler Private AccessCloudflare Oneagainst: Prisma Access, Zscaler Private Accessno first choiceagainst: Check Point Harmony SASE, Cisco Zero Trust Solutions, Fortinet Universal ZTNA, Palo Alto Networks Prisma Access, Zscaler Private Access
One alternative
Cato Networks SASEFive alternatives
Cato SASE Cloud, Cloudflare One, Microsoft Entra Private Access, Netskope Private Access, Zscaler Private AccessSeven alternatives
Cato Networks, Check Point Harmony SASE, Cloudflare One, Forcepoint, Fortinet Universal ZTNA, Netskope Private Access, Palo Alto Networks Prisma AccessFour alternatives
Fortinet FortiClient EMS, OpenVPN CloudConnexa, Tailscale, TwingateMistral SmallCato Networksagainst: Fortinet FortiZTNACisco Duo, Zscaler Private AccessChangedno first choiceCloudflare One, Twingateno first choiceagainst: Check Point Harmony SASE, Zscaler Private Access
One alternative
Zscaler Private AccessTwo alternatives
Cloudbrink, Scalefusion OneIdPThree alternatives
GoodAccess, NordLayer, OpenVPN CloudConnexaDeepSeek V4 FlashCloudflare One, TwingateTwingateChangedagainst: OpenVPN CloudConnexaZscaler Private AccessCloudflare OneMicrosoft Entra Private Accessagainst: Zscaler Private Accessagainst: Akamai Enterprise Application Access, Check Point Harmony SASE, Fortinet Universal ZTNA, Zscaler Private Access
Two alternatives
Cato Networks, Microsoft Entra Private AccessThree alternatives
Cato Networks, Cloudflare One, TailscaleEight alternatives
Cisco Secure Access, Cloudflare One, Fortinet Universal ZTNA, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, Twingate, iboss ZTNAFour alternatives
Microsoft Entra ID + Intune, OpenVPN CloudConnexa, Tailscale, TwingateFive alternatives
Axis Security, Banyan Security, Cisco Secure Access, Cloudflare One, Palo Alto Networks Prisma AccessLlama 4 MaverickCato NetworksCloudflare OneChangedno first choiceMamori.io's Free ZTNA Solutionno first choiceagainst: Netskope Private Access, Palo Alto Networks Prisma Access, Zscaler Private Access
Three alternatives
Check Point Harmony SASE, Cloudflare One, TwingateFour alternatives
Check Point Harmony SASE, Leostream Cloud, Microsoft Entra Private Access, TwingateFour alternatives
GoodAccess, Remote WorkForce ZTNA, Zscaler Private Access, banyan-securityQwen 3.7 FlashCato Networksagainst: Zscaler Private AccessTwingateChangedCloudflare One, Zscaler Private AccessCloudflare Oneno first choiceagainst: Akamai Enterprise Application Access, Check Point Harmony SASE, Fortinet Universal ZTNA, Symantec
Three alternatives
Cloudflare One, Fortinet Universal ZTNA, TwingateTwo alternatives
Cloudflare One, Zscaler Private AccessThree alternatives
Cisco, Netskope Private Access, Palo Alto Networks Prisma AccessThree alternatives
Cisco Duo, Microsoft Entra Conditional Access, TwingateKimi K2Check Point Harmony SASE, Cloudflare OneCloudflare One, TwingateChangedagainst: Palo Alto Networks Prisma Access, Tailscale, Zscaler Private AccessZscaler Private AccessCloudflare Oneno first choiceagainst: Zscaler Private Access
Three alternatives
Cato Networks, Fortinet FortiZTNA, TwingateOne alternative
Cato NetworksSeven alternatives
Cloudflare One, CrowdStrike Falcon Zero Trust, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, Twingate, iboss ZTNATwo alternatives
Tailscale, TwingateFive alternatives
Cloudflare One, Microsoft Entra Private Access, NordLayer, Twingate, Zscaler Private AccessGLM 4.7 FlashXTwingateTwingateHeldZscaler Private Access, Zscaler Zero Trust ExchangeTwingateagainst: OpenZitino first choiceagainst: Check Point Harmony SASE, Netskope Private Access, Symantec Zero Trust Network Access, Zscaler Private Access
Three alternatives
Cato Networks, Cloudflare One, NordLayerOne alternative
Cloudflare OneTen alternatives
Cato Networks SASE, Cloudflare One, CrowdStrike Falcon Zero Trust, Illumio Zero Trust Segmentation, NetFoundry, Prisma Access, Tailscale, Teleport, Twingate, iboss ZTNAThree alternatives
Cloudflare One, OpenVPN CloudConnexa, TailscaleMiniMax M2.5Cato Networks, Check Point Harmony SASECloudflare OneChangedZscaler Private AccessCloudflare One, Twingateno first choiceagainst: Check Point Harmony SASE, Fortinet Universal ZTNA, Netskope Private Access, Zscaler Private Access
Three alternatives
Cloudflare One, FortiZTNA, Okta Identity-Driven SecurityThree alternatives
Cisco Duo, Okta Access Gateway, Zscaler Private AccessSeven alternatives
Cato Networks SASE, Cisco Secure Access, Cloudflare One, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, TwingateOne alternative
Absolute Secure AccessGPT-6 LunaMicrosoft Entra Private AccessTwingateChangedno first choiceCloudflare Oneno first choicenothing named
Two alternatives
Cloudflare One, TwingateThree alternatives
Cloudflare One, Tailscale, Zscaler Private AccessTwo alternatives
Tailscale, TwingateMuse Glimmer 30BCato NetworksTwingateChangedagainst: Palo Alto Networks Prisma Access, Zscaler Private AccessZscaler Private AccessCloudflare Oneno first choiceagainst: Check Point Harmony SASE, Fortinet Universal ZTNA, Netskope Private Access, Versa SASE, Zscaler Private Access
Four alternatives
Cloudflare One, Microsoft Entra Private Access, Okta Identity-Driven Security, TwingateTwo alternatives
Cloudflare One, TailscaleSeven alternatives
BeyondCorp, Cloudflare One, Microsoft Entra Private Access, Netskope Private Access, Palo Alto Networks Prisma Access, Twingate, iboss ZTNATwo alternatives
Tailscale, TwingateBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:03 | yes | 16 | 9 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:59 | yes | 2 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:58 | no | 0 | 18 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 16:16 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:52 | yes | 15 | 16 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 14:10 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:25 | yes | 20 | 36 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:38 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:15 | yes | 5 | 24 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:43 | yes | 5 | 23 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 17:41 | yes | 14 | 44 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:22 | yes | 5 | 25 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:59 | yes | 3 | 21 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:04 | yes | 14 | 18 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 08:51 | yes | 17 | 11 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:59 | yes | 3 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:58 | no | 0 | 17 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 18:26 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:16 | yes | 5 | 19 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 16:58 | yes | 5 | 6 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 13:02 | yes | 25 | 38 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:03 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:45 | yes | 5 | 40 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:37 | yes | 20 | 23 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 17:12 | yes | 24 | 109 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:46 | no | 0 | 18 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:02 | yes | 5 | 11 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 11:54 | yes | 15 | 25 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:41 | yes | 9 | 7 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:36 | yes | 6 | 9 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:18 | yes | 6 | 23 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 10:55 | yes | 10 | 6 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:46 | yes | 5 | 12 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:49 | yes | 5 | 6 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:48 | yes | 22 | 39 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 08:48 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:19 | no | 0 | 32 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 08:38 | yes | 19 | 53 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:42 | yes | 9 | 62 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:07 | yes | 23 | 81 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 17:51 | yes | 7 | 26 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 09:02 | yes | 13 | 26 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:37 | yes | 17 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:38 | no | 0 | 3 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 19:23 | yes | 14 | 25 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 15:16 | yes | 10 | 3 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:58 | yes | 5 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:41 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:29 | yes | 23 | 16 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 19:42 | yes | 10 | 4 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:10 | yes | 5 | 20 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:03 | yes | 9 | 43 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:52 | yes | 24 | 212 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:00 | yes | 5 | 36 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:07 | yes | 3 | 13 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:52 | yes | 15 | 18 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:15 | yes | 17 | 13 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:58 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:03 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 08:55 | yes | 10 | 8 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 13:46 | yes | 5 | 11 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 15:20 | no | 0 | 6 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:28 | yes | 21 | 40 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 17:51 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:46 | yes | 8 | 36 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:55 | yes | 14 | 23 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:06 | yes | 15 | 39 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 16:01 | no | 0 | 15 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 17:45 | yes | 3 | 15 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 09:59 | no | 0 | 1 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:21 | yes | 16 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:34 | yes | 3 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 15:28 | yes | 12 | 23 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 13:25 | yes | 10 | 4 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:14 | yes | 5 | 13 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:06 | yes | 5 | 7 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 13:59 | yes | 23 | 28 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:19 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:02 | yes | 9 | 52 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:01 | yes | 21 | 28 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:38 | yes | 24 | 25 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 16:28 | yes | 17 | 54 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 19:43 | yes | 3 | 14 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 13:32 | yes | 14 | 21 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Akamai read as Akamai Enterprise Application Access
Akamai (Prolexic/Akamai Cloud Web Security) read as Akamai Enterprise Application Access
Cato read as Cato Networks Universal ZTNA
Check Point read as Check Point Harmony SASE
Check Point (Perimeter 81) read as Check Point Harmony SASE
Check Point Harmony read as Check Point Harmony SASE
Cloudflare read as Cloudflare One
Cloudflare Access read as Cloudflare One
Cloudflare Access (Cloudflare One) read as Cloudflare One
Cloudflare Access (part of Cloudflare One) read as Cloudflare One
Cloudflare Access / Cloudflare One read as Cloudflare One
Cloudflare Access / Cloudflare Zero Trust read as Cloudflare One
Cloudflare One / Cloudflare Access read as Cloudflare One
Cloudflare Zero Trust / Cloudflare Access read as Cloudflare One
Fortinet read as Fortinet Universal ZTNA
Fortinet (FortiClient/ZTNA) read as Fortinet Universal ZTNA
Fortinet (FortiZTNA) read as Fortinet Universal ZTNA
Fortinet FortiClient ZTNA read as Fortinet Universal ZTNA
Netskope read as Netskope Private Access
Okta read as Okta Access Gateway
Okta (with Access Gateway) read as Okta Access Gateway
Okta Platform read as Okta Access Gateway
Palo Alto read as Palo Alto Networks Prisma Access
Palo Alto Networks read as Palo Alto Networks Prisma Access
Palo Alto Networks (Prisma Access ZTNA 2.0) read as Palo Alto Networks Prisma Access
Palo Alto Networks (Prisma Access) read as Palo Alto Networks Prisma Access
Zscaler read as Zscaler Private Access
iboss read as iboss ZTNA
Unresolved, counted raw
Cato Networks SASE
Cisco Zero Trust Network Access
Cisco Zero Trust Solutions (e.g., Duo with Secure Access or Umbrella integrations)
Cloudflare One Access
Cyolo
FortiZTNA
Fortinet FortiClient EMS
Fortinet FortiGate ZTNA
GoodAccess Enterprise ZTNA
Harmony SASE / Perimeter 81 (by Check Point)
Ivanti Neurons ZTNA
Keeper Connection Manager
Leostream Cloud
Mamori.io Free ZTNA Solution
Mamori.io's Free ZTNA Solution
Netskope SSE
Pulse Connect Secure
Remote WorkForce ZTNA
Scalefusion OneIdP
Skyhigh
Symantec Zero Trust Network Access
banyan-security
Discontinued, still offered
No shut-down product was recommended here.