# Zero trust network access: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "ZTNA solution" and as "zero trust remote access tool to replace a VPN", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/network/zero-trust-network-access/2026-11

**Standing:** Cloudflare One (tied with Twingate) leads with 36% of first choices; verdict contested. 53 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare One](https://www.gane.ai/index/it/vendors/cloudflare-one/index.md) | 36% | 0% | 64 |
| 2 | [Twingate](https://www.gane.ai/index/it/vendors/twingate/index.md) | 36% | 0% | 48 |
| 3 | [Cato Networks](https://www.gane.ai/index/it/vendors/cato-networks/index.md) | 13% | 0% | 15 |
| 4 | [Microsoft Entra Private Access](https://www.gane.ai/index/it/vendors/microsoft-entra-private-access/index.md) | 4% | 5% | 20 |
| 5 | [Zscaler Private Access](https://www.gane.ai/index/it/vendors/zscaler-private-access/index.md) | 4% | 35% | 54 |
| 6 | [Check Point Harmony SASE](https://www.gane.ai/index/it/vendors/check-point-harmony-sase/index.md) | 4% | 28% | 25 |
| 9 | [Tailscale](https://www.gane.ai/index/it/vendors/tailscale/index.md) | 0% | 4% | 25 |
| 10 | [Palo Alto Networks Prisma Access](https://www.gane.ai/index/it/vendors/palo-alto-networks-prisma-access/index.md) | 0% | 24% | 33 |
| 11 | [Netskope Private Access](https://www.gane.ai/index/it/vendors/netskope-private-access/index.md) | 0% | 25% | 24 |
| 13 | [NordLayer](https://www.gane.ai/index/it/vendors/nordlayer/index.md) | 0% | 10% | 10 |
| 24 | [Fortinet Universal ZTNA](https://www.gane.ai/index/it/vendors/fortinet-universal-ztna/index.md) | 0% | 36% | 14 |

Rank is by share of first choices among all 78 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cato Networks, Twingate; alternatives Cloudflare One, Fortinet Universal ZTNA, Zscaler Zero Trust Exchange
- GPT-5.4 mini: Zscaler Private Access; alternatives Cato Networks Universal ZTNA, Cloudflare One, Netskope Private Access, Palo Alto Networks Prisma Access
- Gemini 3.5 Flash: Twingate; alternatives Cloudflare One, Harmony SASE / Perimeter 81, Microsoft Entra Private Access
- Perplexity Sonar: Cato Networks; alternatives Check Point Harmony SASE, Cloudflare One Access, Twingate
- Grok 4.20: Cloudflare One, Twingate; alternatives Cato Networks SASE
- Mistral Small: Cato Networks; alternatives Zscaler Private Access
- DeepSeek V4 Flash: Cloudflare One, Twingate; alternatives Cato Networks, Microsoft Entra Private Access
- Llama 4 Maverick: Cato Networks; alternatives Check Point Harmony SASE, Cloudflare One, Twingate
- Qwen 3.7 Flash: Cato Networks; alternatives Cloudflare One, Fortinet Universal ZTNA, Twingate
- Kimi K2: Check Point Harmony SASE, Cloudflare One; alternatives Cato Networks, Fortinet FortiZTNA, Twingate
- GLM 4.7 FlashX: Twingate; alternatives Cato Networks, Cloudflare One, NordLayer
- MiniMax M2.5: Cato Networks, Check Point Harmony SASE; alternatives Cloudflare One, FortiZTNA, Okta Identity-Driven Security
- GPT-6 Luna: Microsoft Entra Private Access; alternatives Cloudflare One, Twingate
- Muse Glimmer 30B: Cato Networks; alternatives Cloudflare One, Microsoft Entra Private Access, Okta Identity-Driven Security, Twingate

## Sources the answers cite

74 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- cyberpress.org: 24 answers, 24 citations
- cloudflare.com: 23 answers, 35 citations
- cybersecuritynews.com: 23 answers, 23 citations
- expertinsights.com: 19 answers, 20 citations
- costbench.com: 17 answers, 29 citations
- slashdot.org: 17 answers, 18 citations
- portnox.com: 16 answers, 16 citations
- ncsc.gov.uk: 15 answers, 24 citations

Pages named in the most answers:

- https://cyberpress.org/ztna-solutions-by-business-size (21 answers)
- https://cybersecuritynews.com/best-ztna-solutions (19 answers)
- https://expertinsights.com/network-security/the-top-zero-trust-network-access-solutions (17 answers)
- https://aimultiple.com/ztna-solutions (13 answers)
- https://zerotrust.cio.com/wp-content/uploads/sites/64/2024/08/Gartner-Reprint.pdf (13 answers)
- https://petronellatech.com/blog/zero-trust-vendors-compared-top-10-smbs-2026 (12 answers)
- https://portnox.com/cybersecurity-101/zero-trust/who-are-the-best-ztna-providers (12 answers)
- https://ciopages.com/buyer-guides/zero-trust-network-access (11 answers)
- https://peerspot.com/categories/ztna-as-a-service (11 answers)
- https://slashdot.org/software/zero-trust-network-access-ztna/f-mid-size-business (11 answers)

## Warned against

- Zscaler Private Access: 19 of 54 labels negative. "suggest avoiding Zscaler for mid-market organizations, citing complexity, high cost, and being designed primarily for Fortune 500 scale" (Mistral Small, negative prompt)
- Check Point Harmony SASE: 7 of 25 labels negative. "warnings to avoid or delay adoption of Check Point Harmony SASE until you verify that their remediation for any security issues is architectural" (Mistral Small, negative prompt)
- Palo Alto Networks Prisma Access: 8 of 33 labels negative. "Better for large enterprises already standardized on Palo Alto" (Kimi K2, paraphrase prompt)
- Netskope Private Access: 6 of 24 labels negative. "Netskope suffered from cross-tenant vulnerabilities that let attackers compromise any organization using leaked enrollment tokens." (Muse Glimmer 30B, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
New leader: Twingate (39%) to Cloudflare One (36%). Margin 0 points, within noise.

- Cato Networks: 6% to 13%, +7. Inside the floor by 4 points · rank 3 of 78, unchanged.
- Microsoft Entra Private Access: 0% to 4%, +4. Inside the floor by 7 points · rank 12 → 4 of 78.
- Twingate: 39% to 36%, −3. Inside the floor by 8 points · rank 1 → 2 of 78.
- NordLayer: 3% to 0%, −3. Inside the floor by 8 points · rank 4 → 13 of 78.
- OpenVPN CloudConnexa: 3% to 0%, −3. Inside the floor by 8 points · rank 5 → 14 of 78.
- Cloudflare One: 38% to 36%, −2. Inside the floor by 9 points · rank 2 → 1 of 78.
- Check Point Harmony SASE: 2% to 4%, +2. Inside the floor by 9 points · rank 8 → 6 of 78.
- Tailscale: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 9 of 78.
- Netskope Private Access: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 11 of 78.
- Zscaler Private Access: 3% to 4%, +1. Inside the floor by 10 points · rank 6 → 5 of 78.
- Palo Alto Networks Prisma Access: 0% to 0%, ±0. Inside the floor by 11 points · rank 22 → 10 of 78.
- Fortinet Universal ZTNA: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 24 of 78.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.