IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Network and edge September 2026 Edition

Zero trust network access

Asked as “ZTNA solution”, and as “zero trust remote access tool to replace a VPN”, on behalf of a mid-market B2B company. 40 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
35% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Cloudflare One35%0%29endorsed leader
02Twingate28%0%44accepted challenger
03Cato Networks12%0%16accepted challenger
04OpenVPN CloudConnexa10%0%11accepted challenger
05NordLayer2%6%17accepted challenger
06Check Point Harmony SASE2%27%30criticized challenger
07Zscaler2%62%16criticized challenger
Show the six products at 0%, ordered by negative rate
13Netskope0%47%15criticized challenger
08Zscaler Private Access0%21%29accepted challenger
11Palo Alto Networks Prisma Access0%12%16accepted challenger
09Tailscale0%11%19accepted challenger
10Cloudflare Access0%0%14accepted challenger
12Netskope Private Access0%0%10accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Cloudflare One35%
02Twingate28%
03Cato Networks12%
04OpenVPN CloudConnexa10%
05NordLayer2%
06Check Point Harmony SASE2%
07Zscaler2%
08Zscaler Private Access0%
09Tailscale0%
10Cloudflare Access0%
11Palo Alto Networks Prisma Access0%
12Netskope Private Access0%
13Netskope0%

02What they warned about

Two of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Zscaler
62%
10 of 16 labels negative · 7 of 12 models · 2 hard negative
“CVE-2025-54982 - SAML authentication bypass; failed to validate SAML assertion signatures | Complete authentication bypass” Kimi K2, negative prompt
Netskope
47%
7 of 15 labels negative · 7 of 12 models · 1 hard negative
“Cross-tenant vulnerabilities with leaked enrollment tokens | Attackers could compromise ANY organization” Kimi K2, negative prompt
Check Point Harmony SASE
27%
8 of 30 labels negative · 6 of 12 models · 1 hard negative
“(Perimeter 81/Harmony SASE) | Hard-coded encryption keys in diagnostic logs | Customer data exposure” Kimi K2, negative prompt
Zscaler Private Access
21%
6 of 29 labels negative · 5 of 12 models · 1 hard negative
“they are generally not recommended for mid-sized B2B companies” Gemini 3.5 Flash, paraphrase prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

68 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 851 links across 212 sites, every framing counted. Ranked by the number of answers carrying the site or page.

36 answers · 38 citations · 10 models
26 answers · 26 citations · 10 models
vendor site · Portnox25 answers · 30 citations · 9 models
24 answers · 30 citations · 10 models
vendor site · Expert Insights24 answers · 24 citations · 10 models
22 answers · 23 citations · 10 models
15 answers · 15 citations · 7 models
vendor site · Akamai14 answers · 14 citations · 6 models
11 answers · 12 citations · 6 models
vendor site · OpenVPN11 answers · 11 citations · 7 models
10 answers · 11 citations · 9 models
10 answers · 10 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best ZTNA solution for a mid-market B2B company?”Paraphrase“Which zero trust remote access tool to replace a VPN would you recommend to a mid-sized B2B company?”Comparative“What are the top ZTNA solutions and how do they differ?”Budget-constrained“What is the best ZTNA solution for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a ZTNA solution. What should we look at?”Negative“Which ZTNA solutions should I avoid or be cautious about?”
Claude Haiku 4.5Cloudflare One, Twingate
Three alternativesCato Networks, NordLayer, Zscaler Private Access
ZscalerChanged
Two alternativesCloudflare One, Twingate
Cloudflare One, Zscaler Private Access
Two alternativesPalo Alto Networks Prisma Access, Tailscale
Cloudflare One
Four alternativesAppgate SDP, NordLayer, Tailscale, Twingate
no first choiceagainst: Check Point Harmony SASE, Netskope, Zscaler
GPT-5.4 miniCloudflare One
Two alternativesMicrosoft Entra Private Access, Zscaler Private Access
Cloudflare Access / Cloudflare OneChanged
One alternativeZscaler Private Access
Zscaler Private Access
Three alternativesCloudflare Access, Fortinet Universal ZTNA, Palo Alto Networks Prisma Access
Cloudflare Zero Trust / Cloudflare Access
One alternativeTwingate
against: Zscaler Private Access
no first choicenothing named
Gemini 3.5 FlashTwingate
Four alternativesCato Networks, Check Point Harmony SASE, Cloudflare Zero Trust / Cloudflare Access, Microsoft Entra Private Access
against: Palo Alto Networks, Zscaler
TwingateHeld
Three alternativesCheck Point Harmony SASE, Cloudflare One / Cloudflare Access, Tailscale
against: Palo Alto Networks Prisma Access, Zscaler Private Access
Zscaler Private Access
Four alternativesCloudflare One, Fortinet Universal ZTNA, Netskope Private Access, Palo Alto Networks
Cloudflare One
Four alternativesNetBird, Pomerium, Tailscale, Twingate
no first choice
Five alternativesCloudflare One, Microsoft Entra Private Access, Tailscale, Twingate, Zscaler
against: Check Point Harmony SASE, Netskope, Zscaler
Perplexity SonarCloudflare Access / Cloudflare One
Four alternativesCato Networks, Cisco Duo / Secure Access, Twingate, Zscaler Private Access
Cloudflare OneChanged
Four alternativesCato Networks, NordLayer, Twingate, Zscaler
no first choiceCloudflare One
Three alternativesCheck Point Harmony SASE, Microsoft Entra + Intune, Twingate
no first choicenothing named
Grok 4.1 FastCato Networks
Four alternativesCheck Point Harmony SASE, Cloudflare One, Twingate, Zscaler Private Access
Cloudflare OneChanged
Three alternativesCheck Point Harmony SASE, Tailscale, Twingate
against: Zscaler Private Access
Zscaler Private Access
Five alternativesCloudflare Access, Fortinet Universal ZTNA, Netskope Private Access, Palo Alto Networks Prisma Access, Twingate
Cloudflare One
Two alternativesTailscale, Twingate
against: NordLayer, Palo Alto, Zscaler
no first choice
Two alternativesCheck Point Harmony SASE, Twingate
against: Check Point Harmony SASE, Cisco, Netskope, Zscaler
Mistral SmallCato Networks
Three alternativesNetskope, NordLayer, Twingate
NordLayer, OpenVPN CloudConnexaChanged
Two alternativesCheck Point Harmony SASE, OpenVPN
Zscaler Private Access
Eight alternativesAkamai Enterprise Application Access, Appgate SDP, Check Point Harmony SASE, Cloudflare Access, Fortinet FortiNAC, Netskope Private Access, Okta Access Gateway, Palo Alto Networks Prisma Access
OpenVPN CloudConnexa, Twingate
One alternativeTailscale
no first choicenothing named
DeepSeek V4 FlashCato Networks
Two alternativesCheck Point Harmony SASE, Twingate
against: Zscaler Private Access
TwingateChanged
Two alternativesCloudflare One, Tailscale
against: Check Point Harmony SASE
Zscaler Private Access
Eight alternativesCisco Secure Access, Cloudflare One, Netskope Private Access, NordLayer, Palo Alto Networks Prisma Access, Tailscale, Teleport, Twingate
Cloudflare One
Three alternativesMicrosoft Entra ID + Intune, Tailscale, Twingate
no first choiceagainst: Check Point Harmony SASE, Defined.net / Nebula-based solutions, Netskope, Tailscale, Zscaler
Llama 4 MaverickOpenVPN CloudConnexa
Four alternativesCato Networks, Microsoft Entra ID, NordLayer, Zscaler Zero Trust Exchange
Check Point Harmony SASEChanged
Four alternativesCloudflare Access, NordLayer, OpenVPN CloudConnexa, Twingate
no first choiceCloudflare One
One alternativeCisco Duo
no first choicenothing named
Qwen 3.7 FlashTwingate
Two alternativesCato Networks, Cloudflare One
TwingateHeld
Two alternativesCloudflare Access, Tailscale
Zscaler Private Access
Six alternativesAppgate SDP, Cisco Secure Access, Cloudflare Access, Fortinet FortiClient / FortiNAC, Palo Alto Networks Prisma Access, Twingate
Cloudflare One
Three alternativesCheck Point Harmony SASE, Tailscale, Twingate
against: Palo Alto, Zscaler
no first choice
One alternativeTunic/Secure Link
against: Cisco
against: Fortinet, Netskope, Palo Alto Networks, Tailscale, Zscaler
Kimi K2Cato Networks
Four alternativesCheck Point Harmony SASE, Cloudflare One, OpenVPN CloudConnexa, Twingate
TwingateChanged
One alternativeCloudflare Access
Cloudflare Access / Cloudflare One, Twingate
Five alternativesAppgate SDP, Cisco Duo, Cisco Secure Access, Palo Alto Networks Prisma Access, Zscaler Private Access
Cloudflare One
Two alternativesTailscale, Twingate
no first choice
Four alternativesAxis Security, Banyan Security, GoodAccess, Twingate
against: Check Point Harmony SASE, Cisco, Fortinet
against: Check Point Harmony SASE, Fortinet, Netskope, Zscaler
GLM 4.7 FlashXCato Networks
Four alternativesCheck Point Harmony SASE, Cloudflare One, OpenVPN CloudConnexa, Twingate
Cloudflare One, TwingateChanged
Three alternativesCheck Point Harmony SASE, OpenVPN CloudConnexa, Zscaler Private Access
Zscaler Private Access
Six alternativesCato Networks, Cloudflare Access, NordLayer, Palo Alto Networks Prisma Access, Twingate, Zero Networks
OpenVPN CloudConnexa, Twingate
Nine alternativesCloudflare Access, Microsoft Entra ID (formerly Azure AD) Conditional Access, Microsoft Intune, NetBird, NordLayer, Octelium, OpenZiti, Pomerium, Tailscale
against: Zscaler Private Access
no first choiceagainst: Fortinet FortiClient EMS, Zscaler Private Access
MiniMax M2.5no first choiceagainst: Akamai – Enterprise Threat Protection (ETP) + Edge DNS, Cisco – Duo + Cisco ISE, Palo Alto Networks Prisma AccessTwingateChanged
Two alternativesCato Networks, Check Point Harmony SASE
Zscaler Private Access
Five alternativesAppgate SDP, Cloudflare Access, Microsoft Entra Private Access, Palo Alto Networks Prisma Access, Twingate
Cloudflare One
Two alternativesNordLayer, Twingate
no first choiceagainst: Check Point Harmony SASE, Netskope, Zscaler
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:36yes1310 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:28yes47 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:04yes1829 s
Direct recommendationPerplexity Sonarsonar2026-09-17 08:36yes208 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:42yes3023 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 09:09yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:33yes812 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:35yes54 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:10yes534 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:04yes719 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:55yes13130 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:47no070 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:49yes189 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:59yes27 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:56yes921 s
ParaphrasePerplexity Sonarsonar2026-09-17 08:53yes206 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:55yes3416 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 08:16yes57 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:50yes1822 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:40yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:59yes534 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:37yes2033 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:23yes1171 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:40yes537 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:21yes2714 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:20yes69 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:21yes2229 s
ComparativePerplexity Sonarsonar2026-09-17 08:32yes199 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:28yes3516 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 08:30yes1818 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:11yes1920 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:03yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:30yes522 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:03yes1536 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:06yes1082 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:42yes1437 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:50yes1511 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:52yes56 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:20yes1924 s
Budget constrainedPerplexity Sonarsonar2026-09-17 08:47yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:27yes3314 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 08:42yes55 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:28yes812 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:23yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:31yes533 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:05yes1447 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:28yes1476 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:41yes526 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:24yes1814 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:11no07 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:24yes1226 s
Scale constrainedPerplexity Sonarsonar2026-09-17 08:22yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:37yes2011 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 08:27no011 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:11yes1020 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:04yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:13no046 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:41yes1061 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:54yes3085 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:23yes520 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:10yes179 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:45yes56 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:24yes1825 s
Negative framingPerplexity Sonarsonar2026-09-17 09:08yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:07yes3516 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 08:17yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:37yes2929 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:35yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:14yes27149 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:29yes1525 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:56yes1543 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:02yes518 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Check Point read as Check Point Harmony SASE
Check Point (Harmony SASE/Perimeter 81) read as Check Point Harmony SASE
Check Point Harmony read as Check Point Harmony SASE
Microsoft Entra read as Microsoft Entra ID
Unresolved, counted raw
Absolute Secure Access
Akamai – Enterprise Threat Protection (ETP) + Edge DNS
Axis Security
Check Point Quantum/Harmony SASE
Cisco Duo / Secure Access
Cisco – Duo + Cisco ISE (Zero Trust)
Cyolo
Defined.net / Nebula-based solutions
Firezone
Fortinet FortiClient EMS
Fortinet FortiNAC
Fortinet ZTNA/FortiGate/FortiClient
Ivanti ZTNA
Microsoft Entra ID (formerly Azure AD) Conditional Access
Microsoft – Azure AD Conditional Access + Microsoft Defender for Cloud Apps
NetFoundry
Octelium
Tunic/Secure Link
Discontinued, still offered
No shut-down product was recommended here.
← WAFASM →