Index › Network and edge › ZTNA › Small business › September 2026 Edition

Zero trust network access for small business buyers

Asked as “ZTNA solution”, and as “zero trust remote access tool to replace a VPN”, on behalf of a small B2B company. 45 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Cloudflare One

Clear leader

51% of first choices, clear leader.

ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Cloudflare One51%Clear leaderThis page Mid-market

Cloudflare One35%ContestedStanding →Enterprise

Zscaler Private Access50%Clear leaderStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Cloudflare One0%43endorsed leader

Twingate5%55endorsed leader

Cloudflare Access0%10accepted challenger

Tailscale2%42accepted challenger

OpenVPN CloudConnexa7%14accepted challenger

Show the four products at 0%, ordered by negative rate

Zscaler92%12criticized challenger

Zscaler Private Access69%16criticized challenger

NordLayer8%13accepted challenger

Check Point Harmony SASE6%34accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Cloudflare One vs Twingate Cloudflare One vs Cato Networks Twingate vs Cato Networks

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative70%

Key

Cloudflare One51%

Twingate31%

Cloudflare Access9%

Tailscale4%

OpenVPN CloudConnexa4%

Check Point Harmony SASE0%

NordLayer0%

Zscaler Private Access0%

Zscaler0%

02What they warned about

Six of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

Zscaler

92%

11 of 12 labels negative · 7 of 12 models · 6 hard negative

“What to avoid as a small B2B: **Enterprise ZTNA suites (Zscaler, Netskope):** Powerful but often require professional services and opaque pricing” Kimi K2, paraphrase prompt

Palo Alto Networks Prisma Access

88%

7 of 8 labels negative · 6 of 12 models · 6 hard negative

“Avoid **enterprise‑centric, per‑user pricing platforms** (Zscaler, Palo Alto, Cisco SASE)” GLM 4.7 FlashX, negative prompt

Zscaler Private Access

69%

11 of 16 labels negative · 6 of 12 models · 3 hard negative

“Examples to be cautious of: Zscaler Private Access (ZPA)... Why to avoid them: ... built for Fortune 500 enterprises” Gemini 3.5 Flash, negative prompt

Palo Alto

100%

6 of 6 labels negative · 4 of 12 models · 1 hard negative

“Do not buy into expensive enterprise suites like Zscaler or Palo Alto” Qwen 3.7 Flash, budget prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

66 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 808 links across 190 sites, every framing counted. Ranked by the number of answers carrying the site or page.

cybersecuritynews.com

45 answers · 46 citations · 10 models

petronellatech.com

44 answers · 45 citations · 10 models

cyberpress.org

37 answers · 42 citations · 10 models

meshwg.com

vendor site · MeshWG24 answers · 25 citations · 9 models

aimultiple.com

22 answers · 23 citations · 9 models

itbusinessedge.com

18 answers · 18 citations · 9 models

portnox.com

vendor site · Portnox17 answers · 19 citations · 7 models

startwithidentity.com

16 answers · 17 citations · 8 models

saas-expert.com

16 answers · 16 citations · 8 models

blog.openvpn.net

vendor site · OpenVPN14 answers · 16 citations · 7 models

eastbaycyber.com

14 answers · 14 citations · 5 models

costbench.com

12 answers · 24 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

petronellatech.com/blog/zero-trust-vendors-compared-top-10-smbs-2026

44 answers · 10 models

cybersecuritynews.com/best-ztna-solutions

43 answers · 10 models

cyberpress.org/ztna-solutions-by-business-size

32 answers · 10 models

meshwg.com/ztna-for-small-business

23 answers · 9 models

aimultiple.com/ztna-solutions

22 answers · 9 models

itbusinessedge.com/security/smb-zero-trust-solutions

18 answers · 9 models

saas-expert.com/articles/best-zero-trust-network-access-tools-small-business

16 answers · 8 models

startwithidentity.com/articles/top-8-zero-trust-network-access-tools

15 answers · 8 models

eastbaycyber.com/content/compare-best-zero-trust-network-access-providers-2026

12 answers · 5 models

portnox.com/cybersecurity-101/zero-trust/who-are-the-best-ztna-providers

12 answers · 6 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best ZTNA solution for a small B2B company?”Paraphrase“Which zero trust remote access tool to replace a VPN would you recommend to a small business that sells to other businesses?”Comparative“What are the top ZTNA solutions for a small team and how do they differ?”Budget-constrained“What is the best ZTNA solution for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a ZTNA solution. What should we look at?”Negative“Which ZTNA solutions should a small business avoid or be cautious about?”

Claude Haiku 4.5Cloudflare Access

Three alternatives

Check Point Harmony SASE, Microsoft Entra + Intune, Twingate

Cloudflare One, TailscaleChangedagainst: Palo Alto Networks Prisma Access, ZscalerCloudflare One, Twingate

Two alternatives

Check Point Harmony SASE, Tailscale

Cloudflare One

Four alternatives

Cisco Duo, Microsoft Entra ID, NordLayer, Twingate

no first choicenothing named

GPT-5.4 miniCloudflare Access

Three alternatives

Cisco Secure Access, Fortinet FortiSASE, Zscaler

Cloudflare AccessHeld

One alternative

Tailscale

Twingate

Three alternatives

Cloudflare Access, NetBird, Tailscale

against: Zscaler Private AccessTailscale

One alternative

Cloudflare Zero Trust / Access

no first choicenothing named

Gemini 3.5 FlashTwingate

Five alternatives

Check Point Harmony SASE, Cloudflare Zero Trust / Access, Microsoft Entra ID, Microsoft Intune, Tailscale

TwingateHeld

Two alternatives

Cloudflare Zero Trust / Cloudflare Access, Tailscale

Twingate

Three alternatives

Cloudflare One, NetBird, Tailscale

Cloudflare One

Three alternatives

NetBird, Tailscale, Twingate

Cloudflare One, Twingate

One alternative

Tailscale

against: Netskope, Prisma Cloud, Zscaleragainst: Broadcom (Symantec) Secure Access, Cisco Secure Access, Fortinet, OpenVPN, Palo Alto Networks Prisma Access, WireGuard, Zscaler Private Access

Perplexity SonarTwingate

Four alternatives

Check Point Harmony SASE, Cloudflare Zero Trust / Cloudflare Access, NordLayer, Tailscale

TwingateHeld

One alternative

Cloudflare One

against: Zscaler Private AccessTailscale, Twingate

Five alternatives

Check Point Harmony SASE, Cisco Duo, Cloudflare Zero Trust / Access, Google BeyondCorp Enterprise, Microsoft Entra ID + Intune

Cloudflare One

Three alternatives

Microsoft Entra + Intune, Pomerium, Twingate

no first choiceagainst: Sophos ZTNA, Zscaler Private Access

Grok 4.1 FastCloudflare One

Two alternatives

OpenVPN CloudConnexa, Twingate

against: Fortinet, Palo Alto, Zscaler Private AccessCloudflare OneHeld

Two alternatives

Tailscale, Twingate

against: Netskope, ZscalerCloudflare One, Twingate

Three alternatives

Check Point Harmony SASE, OpenVPN CloudConnexa, Tailscale

against: Palo Alto, ZscalerCloudflare One

Three alternatives

OpenVPN CloudConnexa, Tailscale, Twingate

against: Palo Alto, ZscalerCloudflare One, Twingate

Two alternatives

Microsoft Entra + Intune, Tailscale

against: Netskope, Zscaler Private Accessagainst: Forcepoint ZTNA, Netskope Private Access, Palo Alto Networks Prisma Access, Zscaler Private Access (ZPA) / Zero Trust Exchange

Mistral SmallOpenVPN CloudConnexa

Three alternatives

Microsoft Entra ID with Intune, NordLayer, Twingate

Cloudflare One, OpenVPN CloudConnexaChanged

Two alternatives

Tailscale, Zscaler Private Access

Tailscale, Twingate

One alternative

Check Point Harmony SASE

Cloudflare One

Two alternatives

Check Point Harmony SASE, Twingate

no first choiceagainst: Check Point Harmony SASE, Twingate

DeepSeek V4 FlashTwingate

Four alternatives

Check Point Harmony SASE, Cloudflare One, OpenVPN CloudConnexa, Tailscale

Cloudflare OneChanged

Two alternatives

Tailscale, Twingate

Cloudflare One, Tailscale, Twingate

One alternative

Check Point Harmony SASE

Cloudflare One

Four alternatives

Check Point Harmony SASE, Google BeyondCorp Enterprise, Tailscale, Twingate

no first choiceagainst: Cato, Palo Alto, Pomerium, Tailscale, Zscaler

Llama 4 MaverickCloudflare Access, Twingate

One alternative

Check Point Harmony SASE

no first choiceChangedTwingate

Three alternatives

Check Point Harmony SASE, Cloudflare One, Tailscale

Twingate

Two alternatives

Check Point Harmony SASE, Cloudflare One

no first choiceagainst: Palo Alto, Twingate, Zscaler

Qwen 3.7 FlashCloudflare One

Five alternatives

Cisco Duo, Cisco Umbrella, Microsoft Entra ID, Tailscale, Zscaler Private Access

Cloudflare OneHeld

One alternative

Tailscale

against: Zscaler Internet AccessTailscale, Twingate

Five alternatives

Check Point Harmony SASE, Cloudflare One, Google BeyondCorp Enterprise, Microsoft Entra ID + Conditional Access, Zscaler Private Access

Cloudflare One

One alternative

Twingate

against: Palo Alto, ZscalerCloudflare One

Two alternatives

SentinelOne Stargate, Tailscale / ZeroTier

against: Zscaler Internet Accessnothing named

Kimi K2Cloudflare One

Three alternatives

Microsoft Entra Private Access, NordLayer, Twingate

against: Palo Alto Networks Prisma Access, ZscalerTwingateChanged

Two alternatives

Cloudflare One, Tailscale

against: Netskope, ZscalerCloudflare One, Twingate

Two alternatives

Check Point Harmony SASE, Tailscale

Cloudflare One

Two alternatives

Tailscale, Twingate

Cloudflare One

Five alternatives

Check Point Harmony SASE, Google BeyondCorp Enterprise, Microsoft Entra ID + Intune, Tailscale, Twingate

against: Cisco Secure Access, Palo Alto Networks Prisma Access, Zscaler

GLM 4.7 FlashXCloudflare One

Two alternatives

Microsoft Entra ID + Intune, Twingate

TwingateChanged

One alternative

Cloudflare Access

against: BeyondTrust Remote Support, Check Point Harmony SASE, JumpCloud, NordLayer, OpenVPN CloudConnexa, Tailscale / Tailscale Netbird, Zscaler Private AccessCloudflare One, Twingate

Three alternatives

Banyan Security, Check Point Harmony SASE, OpenVPN CloudConnexa

against: Zscaler Private AccessCloudflare One

Five alternatives

MeshWG, NetBird, Pomerium, Tailscale, Twingate

against: Zscaler Private Accessno first choiceagainst: Appgate SDP, Azure Firewall + custom ZTNA, Cato Networks, Cisco Duo, Cisco Secure Access, Forcepoint ONE, Fortinet Universal ZTNA, Netskope Private Access, Okta, Palo Alto Networks Prisma Access, Zscaler Private Access

MiniMax M2.5Twingate

Three alternatives

Check Point Harmony SASE, OpenVPN CloudConnexa, Tailscale

TwingateHeld

Two alternatives

NordLayer, Tailscale

Tailscale

Three alternatives

Check Point Harmony SASE, Cloudflare Access, Twingate

Twingate

Three alternatives

Check Point Harmony SASE, Cloudflare Access, NordLayer

Cloudflare One

One alternative

Twingate

against: Palo Alto Networks Prisma Access, Twingate, Zscaler Private Access

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 09:03	yes	9	9 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 08:59	yes	4	6 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 08:29	yes	13	23 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 08:16	yes	20	6 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:44	yes	38	19 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 08:57	yes	11	9 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 08:46	yes	8	14 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 08:31	yes	5	4 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 08:42	no	0	39 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 08:38	yes	13	22 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:10	yes	12	133 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:35	yes	5	24 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 08:17	no	0	5 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 08:47	yes	3	9 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 08:18	yes	10	20 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 08:30	yes	20	6 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:24	yes	40	17 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 08:16	yes	8	8 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 08:51	yes	18	17 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 08:18	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 08:52	no	0	46 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 09:01	yes	10	55 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 08:31	yes	11	125 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:39	yes	9	56 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 08:29	yes	15	13 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 08:38	yes	7	11 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 09:12	yes	14	25 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 08:36	yes	20	10 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:20	yes	37	16 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 08:44	yes	5	7 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 08:54	yes	27	22 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 08:38	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 08:18	yes	9	43 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 08:28	yes	9	31 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 08:30	yes	29	135 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:45	yes	12	37 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 09:04	yes	9	7 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 08:25	yes	4	6 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 08:20	yes	15	22 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 08:37	yes	20	6 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:56	yes	32	14 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 08:16	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:00	yes	12	14 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 09:08	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 08:24	yes	5	41 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 08:50	yes	9	21 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:06	yes	13	23 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:45	yes	5	11 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 08:28	yes	9	9 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:05	no	0	7 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 08:27	yes	12	31 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 08:32	yes	20	11 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:19	yes	22	13 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 08:28	no	0	7 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 08:30	yes	10	13 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 08:41	yes	5	2 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 08:56	no	0	41 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 08:57	yes	13	57 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 08:37	yes	15	155 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:51	yes	5	13 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 08:23	yes	17	10 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 08:36	yes	2	6 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 09:08	yes	14	27 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 09:08	yes	20	6 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 08:19	yes	34	15 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 09:04	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 08:48	yes	19	20 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 08:16	yes	5	4 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 09:02	yes	5	50 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 08:27	yes	28	63 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:07	yes	24	117 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 08:24	yes	7	39 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Check Point read as Check Point Harmony SASE

Microsoft Entra read as Microsoft Entra ID

Unresolved, counted raw

Azure Firewall + custom ZTNA

Broadcom (Symantec) Secure Access

Cloudflare Tunnel (for internal apps)

Forcepoint ZTNA

Headscale

Microsoft Entra External Identities

Microsoft Entra ID + Conditional Access

Microsoft Entra ID with Intune

Palo Alto GlobalProtect (ZTNA mode)

SentinelOne Stargate

Sophos ZTNA

Tailscale / Tailscale Netbird

Tailscale / ZeroTier

WireGuard

Zscaler Private Access (ZPA) / Zero Trust Exchange

Discontinued, still offered

No shut-down product was recommended here.

Zero trust network access for small business buyers

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in network and edge