We're a remote-first company. What's a good Zero Trust Network Access (ZTNA) solution to replace our legacy VPN?

For a remote-first company, replacing a legacy VPN with Zero Trust Network Access (ZTNA) depends heavily on your infrastructure makeup (cloud-native vs. hybrid) and how technical your workforce is. Moving away from a perimeter-centric model means connecting users directly to individual applications rather than placing them onto the corporate network.

The top ZTNA solutions break down into distinct categories based on organizational needs:

1. Best for Cloud-First & Developer-Centric Teams:

If your internal apps, dashboards, and tooling live in the cloud or SaaS environments, Cloudflare's edge-native platform is a seamless fit.

• How it works: It operates via a reverse proxy sitting in front of your applications, authenticating every request against your identity provider (IdP) before letting traffic through.
• Key Strengths: Exceptional global performance, extremely low friction for end users, and flexible clientless or client-based (WARP) options. It also features a generous free tier for smaller teams.

“The most practical ZTNA entry point for most organizations. Cloudflare Access lets you put identity-based access in front of internal applications without installing agents on user devices...”

2. Best Lightweight, Modern VPN Alternative:

If you want a clean, dedicated ZTNA tool that mirrors the simplicity of a VPN replacement without the bloat of a massive enterprise SASE suite.

• How it works: Uses isolated, component-based connectors inside your private networks/clouds with an easy-to-deploy client on user devices.
• Key Strengths: Fast deployment, granular per-resource authorization, and brilliant visibility into network flows without forcing all traffic through a centralized corporate bottleneck.

3. Best for Engineering & Highly Technical Workforces:

Built on WireGuard mesh networking principles, Tailscale is a massive favorite among engineering-heavy and remote-first tech companies.

• How it works: Creates a secure, peer-to-peer overlay network using your existing identity provider for authentication.
• Key Strengths: Incredibly fast setup, minimal configuration overhead, and works smoothly across diverse operating systems and developer environments.

4. Best Enterprise Scale & Security Consolidation:

If your remote-first organization is scaling rapidly or faces strict compliance frameworks requiring full Secure Service Edge (SSE) convergence.

• How it works: Part of the massive Zscaler Zero Trust Exchange, connecting users to specific apps via inline policy enforcement while completely shielding private apps from the internet.
• Key Strengths: Market-leading scale, comprehensive threat protection, and robust integration with data loss prevention (DLP).

“Zscaler receives praise for "scalable zero trust access that outperforms legacy VPNs." Enterprises note "strong policy enforcement for remote users."”

What to Focus on During Your Evaluation

• Identity Provider (IdP) Integration: Ensure the ZTNA hooks natively into whatever you use for IAM (e.g., Microsoft Entra ID, Okta, Google Workspace).
• Device Posture Checks: For remote workers using a mix of corporate-managed and personal machines, look for solutions that verify endpoint health (EDR/MDM status) before granting access.
• App Protocols: Make sure the tool supports everything you run—not just standard web apps (HTTP/HTTPS), but also SSH, RDP, or database connections if your engineers need them.

To help narrow down the right fit, tell me:

• Do your internal applications live mostly in the cloud (AWS/GCP/Azure/SaaS) or do you have legacy on-prem data centers?
• Roughly how many employees need access?

For a remote-first company replacing a legacy VPN, I’d shortlist Cloudflare Access, Microsoft Entra Private Access, Zscaler Private Access, and Tailscale. The right choice depends mostly on your identity stack, application mix, and how much security infrastructure you want ZTNA to absorb.

My default recommendation: Cloudflare Access

Cloudflare Access is probably the best general-purpose VPN replacement for a remote-first company.

Why I like it:

• Application-level access rather than broad network access — users get access to the specific resources they're authorized for, reducing lateral movement.
• Works with self-hosted, SaaS, and non-web applications, so you're not limited to browser apps.
• Strong fit for distributed teams because Cloudflare's edge is already globally distributed.
• Supports identity, device posture, MFA, and context-aware policies.
• Migration can be incremental: put a few internal applications behind Access, prove it out, then retire portions of the VPN.
• There's a free tier for teams under 50 users, with paid plans starting at $7/user/month when billed annually.

When I'd choose something else

Microsoft Entra Private Access deserves particular attention if you're already a Microsoft shop. It extends Entra Conditional Access and MFA to private/on-prem applications and is explicitly designed to replace legacy VPNs.

Zscaler Private Access is the enterprise heavyweight: it brokers connections between authorized users and authorized applications rather than putting users onto the network.

What I'd implement

Don't simply replace:

VPN → new ZTNA VPN

Instead aim for:

User → identity/device verification → specific application → least-privilege access

I'd migrate in roughly this order:

1. Inventory VPN usage — determine which applications, servers, subnets, and protocols people actually use.
2. Integrate your IdP — Entra ID, Okta, Google Workspace, etc.
3. Start with low-risk applications and a small employee pilot.
4. Require MFA + managed-device/posture checks for sensitive resources.
5. Move applications from subnet-level permissions toward per-app policies.
6. Keep the old VPN running as a fallback during migration.
7. Analyze VPN logs for anything still being used.
8. Remove VPN access once the remaining dependencies have been migrated.

The key architectural question is whether you really need network-level connectivity. If most employees are accessing web apps, Git, SSH, RDP, internal APIs, databases, etc., ZTNA can usually give them the individual access they need without exposing the underlying network.

If you tell me your approximate company size, IdP (Microsoft/Google/Okta), where your apps live (AWS/Azure/on-prem), and whether employees need things like SSH/RDP/SMB, I can narrow this to 2–3 products and give you a concrete recommendation.

Replacing a legacy VPN with a Zero Trust Network Access (ZTNA) solution is a major step toward securing a remote-first workforce. Modern Ztna moves away from perimeter-based network access to continuous, identity- and context-aware verification.

Here are the top ZTNA solutions widely adopted by remote-first companies:

• Cloudflare One (Cloudflare Access) : Best for lightning-fast edge performance and ease of integration. It combines ZTNA, Secure Web Gateway (SWG), and DNS filtering into a unified global edge network, minimizing latency for globally distributed teams.
• Zscaler Private Access (ZPA) : An industry leader in enterprise-grade security. It connects users directly to apps rather than the network, entirely hiding internal applications from the public internet and preventing lateral movement.
• Palo Alto Networks (Prisma Access) : Excellent for organizations needing deep security inspection and advanced threat prevention. It integrates robust ZTNA 2.0 principles with comprehensive enterprise cloud security.
• BeyondCorp Enterprise (Google Cloud) : Ideal for organizations heavily invested in the Google ecosystem. It leverages device posture, user identity, and context to grant fine-grained access without a traditional client.
• Twingate : Great for small-to-medium remote teams or companies looking for an easier deployment than legacy enterprise tools. It offers granular, per-resource access controls and sets up in minutes while integrating with existing identity providers.

User Experiences

I found Cloudflare Access super easy to roll out for our remote team without needing a massive infrastructure overhaul.

Zscaler ZPA completely eliminated our reliance on traditional VPNs and made managing contractor access way less stressful.

If you'd like to narrow down the choices, let me know:

• Your current Identity Provider (IdP) (e.g., Okta, Azure AD/Entra ID, Google Workspace)
• The scale of your workforce (number of remote employees/contractors)
• Whether you host resources primarily in cloud environments (AWS/GCP/Azure) or on-premises data centers

For a remote-first company, I’d shortlist Cloudflare Zero Trust, Twingate, Tailscale, and Zscaler Private Access. The right choice depends mostly on company size, how much internal infrastructure you have, and whether you want ZTNA alone or a broader security platform.

My practical ranking

ZTNA's key advantage over a traditional VPN is that users don't simply get "onto the corporate network." Access is granted to particular applications/resources based on identity and other policy signals, reducing lateral-movement risk.

🥇 I'd start with Cloudflare Zero Trust

For a remote-first organization, Cloudflare is probably the best default to evaluate first. Its architecture is particularly well suited to distributed users, and it can provide browser-based/clientless access for appropriate applications as well as private-network access. Cloudflare also publishes a specific migration architecture for replacing VPN concentrators with ZTNA.

It's especially attractive if you want to eventually combine ZTNA with secure web access, DNS security, and other SSE capabilities rather than maintaining several separate products.

When I'd choose the others

Twingate — My pick if your main goal is "get rid of the VPN without creating a giant security project." It is designed around resource-level access rather than putting users on a flat network. It's particularly compelling for small-to-mid-sized distributed organizations.

Tailscale — Excellent if your infrastructure is heavily developer-oriented and people need SSH, databases, Kubernetes, internal services, etc. It's more of an identity-aware mesh networking approach than a conventional enterprise ZTNA/SSE platform.

Zscaler Private Access (ZPA) — I'd move this to the top if you're a large organization with substantial compliance requirements, thousands of users, lots of private applications, or plans to consolidate ZTNA with a broader SSE deployment. It is one of the leading enterprise-scale options.

Prisma Access — Particularly compelling if you're already standardized on Palo Alto Networks and want ZTNA to become part of a broader SASE architecture.

What I'd evaluate in a POC

Don't just test whether employees can connect. Test these scenarios:

1. Employee → SaaS/internal web app
2. Employee → SSH/database/internal service
3. Unmanaged device → sensitive app
4. Compromised account → resources it shouldn't reach
5. Employee leaves → access revoked immediately
6. Contractor → one application, nothing else
7. Remote employee in different continents → latency
8. Admin → audit trail showing exactly who accessed what

Also make identity + device posture central to the design: your IdP/SSO, MFA, MDM, endpoint security, and ZTNA policy should work together rather than treating ZTNA as merely a new VPN client.

Bottom line: If you gave me no other information, I'd run a POC of Cloudflare Zero Trust vs. Twingate, with Zscaler added if you're enterprise-scale. If your workforce is primarily engineers accessing infrastructure, I'd substitute Tailscale for Twingate.

If you tell me your employee count, IdP (Microsoft Entra/Okta/etc.), where your apps live (AWS/Azure/on-prem), and whether you have MDM, I can narrow this to a 2–3 vendor shortlist and give you a migration architecture.

For a remote-first company, I’d shortlist Zscaler Private Access, Cloudflare One, Twingate, Netskope One Private Access, and Microsoft Entra Private Access. The right choice depends heavily on how much legacy/on-prem infrastructure you still have.

My default recommendation: Zscaler Private Access

Zscaler Zscaler Private Access (ZPA) would be my first enterprise-grade evaluation. It is purpose-built to replace VPNs: users get access to specific applications rather than the underlying network, and applications can remain invisible to the public internet. ZPA also integrates with identity providers via SAML/SCIM and supports cloud and data-center applications.

Why I'd pick it: strong security model, mature enterprise controls, good fit for a distributed workforce, and particularly good if you have a mixture of AWS/Azure and legacy internal applications.

The shortlist

Twingate is particularly attractive if your requirement is basically "make our internal resources securely reachable without maintaining a VPN." Its model binds connections to verified identity, device and resource, rather than putting the user onto a network.

Netskope One Private Access is worth serious consideration if you're also looking to consolidate ZTNA + DLP + broader SSE/security controls. It supports legacy protocols such as SSH/RDP and has agentless/browser access for unmanaged or third-party devices.

What I'd actually pilot

For a typical remote-first company, I'd run a 2–3 week pilot with Zscaler + Twingate + Cloudflare and test:

1. Identity: Okta/Entra integration, MFA and conditional access.
2. Device posture: block unmanaged/noncompliant endpoints.
3. Application coverage: SaaS, web apps, SSH, RDP, databases, file shares, etc.
4. Least privilege: can you give Alice access to one application without exposing its subnet?
5. User experience: latency, reconnect behavior, sleep/wake, roaming between networks.
6. Admin experience: policy creation, troubleshooting and audit logs.
7. BYOD/contractors: browser-based access without installing a VPN client.
8. Migration: whether you can run ZTNA alongside the legacy VPN and migrate application-by-application.

The key architectural test is "application access, not network access." If the product essentially recreates a VPN by giving users broad access to subnets, you're not getting the full benefit of ZTNA.

Bottom line:

• Enterprise/security-first → Zscaler
• Cloud-first + good economics → Cloudflare
• Simple and developer-friendly → Twingate
• Heavy DLP/SSE requirements → Netskope
• Deep Microsoft environment → Entra Private Access

If you tell me roughly employee count, IdP (Okta/Entra/etc.), AWS/Azure/on-prem mix, and whether you need SSH/RDP/database access, I can narrow this to a 2-vendor recommendation and give you a migration architecture.

Replacing a legacy VPN with Zero Trust Network Access (ZTNA) is one of the highest-impact moves a remote-first company can make . Instead of placing remote employees "on the network" (which creates massive lateral movement risks if a laptop is compromised), modern ZTNA connects users exclusively to the specific applications they are authorized to see, verified via identity and device posture.

The best ZTNA solution depends heavily on your team's size, your current tech stack, and whether your engineering culture demands high speed and minimal friction. Top-tier options are categorized below by their strengths for remote-first organizations:

• • Best For: Fast, cloud-native deployment and teams already leveraging web/cloud apps.
  • Standout Feature: Acts as a reverse proxy with a massive global edge network (over 300 points of presence). It supports both agent-based access (via the WARP client) and fully clientless, browser-based access (ideal for third-party contractors or BYOD). There is also a generous free tier for smaller teams to pilot.
• Twingate
  • Best For: Modern, developer-focused, or mid-market teams looking for an effortless drop-in VPN replacement without changing network architecture.
  • Standout Feature: Extremely praised for user experience and simple administration. It provides granular, resource-level network segmentation without routing all traffic through a heavy corporate tunnel, and integrates smoothly with major identity providers like Okta, Google Workspace, and Microsoft Entra ID.
• Zscaler Private Access (ZPA)
  • Best For: Scale-focused or fast-growing distributed enterprises that want a comprehensive Security Service Edge (SSE) platform.
  • Standout Feature: Part of the massive Zscaler Zero Trust Exchange. It connects users directly to private apps via a cloud-native broker without ever exposing internal IPs or allowing lateral traversal. It is robust, highly compliant, and ideal if you also need deep data loss prevention (DLP) and inline threat protection.
• Tailscale
  • Best For: Highly technical, engineering-driven, or developer-heavy remote teams.
  • Standout Feature: Built on a peer-to-peer WireGuard mesh overlay. It is blazing fast, incredibly lightweight to install across Mac, Windows, Linux, and mobile, and handles complex multi-cloud or home-lab style server access with minimal configuration overhead.
• Microsoft Entra Private Access
  • Best For: Organizations deeply embedded in the Microsoft 365 / Entra ID ecosystem.
  • Standout Feature: An identity-centric ZTNA solution that natively plugs into your existing Microsoft Conditional Access policies, making adoption seamless if your users already authenticate via Entra ID.

If you want to narrow this down, tell me:

• What Identity Provider (IdP) do you use (Google Workspace, Okta, Microsoft Entra ID)?
• Are your internal apps mostly web-based , or do you heavy-lift legacy protocols like RDP, SSH, or SMB?
• Roughly how many users need access?

I can give you a tailored recommendation and migration path.

For a remote-first company, replacing a legacy VPN with a Zero Trust Network Access (ZTNA) solution depends heavily on your team's size, technical DNA (e.g., heavy engineering vs. standard corporate apps), and existing identity stack.

Top-tier ZTNA solutions break down by company profile and use case:

• Cloudflare Zero Trust — Best for Cloud-First & Budget-Conscious Teams: Highly scalable, fast global edge network, and offers a robust free tier that covers essential ZTNA, Secure Web Gateway (SWG), and DNS filtering. Excellent for both clientless browser access and user-authenticated connections via their WARP client.
• Zscaler Private Access (ZPA) — Best for Enterprise Scale & SASE: The market leader for large or heavily regulated footprints. It routes traffic through a massive global cloud exchange, making internal applications completely invisible to the public internet by using outbound-only connectors. Premium pricing, but unmatched for comprehensive compliance and threat protection.
• Twingate — Best for a Clean, Lightweight VPN Replacement: Known for a frictionless, consumer-grade user experience with an exceptionally straightforward administrative rollout. It provides granular, application-level segmentation without forcing traffic through cumbersome enterprise bloat.
• Tailscale — Best for Developer-Friendly / Engineering-Heavy Teams: Built on WireGuard, this mesh-VPN/ZTNA hybrid is lightweight, fast to configure, and loved by engineering organizations that need precise, identity-based access to infrastructure and private subnets without heavy corporate overhead.
• Microsoft Entra ID + Intune — Best for Microsoft 365 Shops: If you already live inside the Microsoft ecosystem, leveraging Entra Private Access alongside conditional access policies provides a native, identity-driven zero trust perimeter.

To help narrow down the right fit, tell me:

• Roughly how many remote employees do you have?
• What is your primary identity provider (e.g., Okta, Google Workspace, Microsoft Entra ID)?
• Are your internal apps hosted primarily in the cloud (AWS/GCP/Azure) or on-premises/datacenter?

For a remote-first company, the "best" ZTNA platform depends more on your identity provider, cloud footprint, and security maturity than on any single feature. The biggest shift from a legacy VPN is that users receive access to specific applications—not the entire corporate network—based on identity, device health, and context.

Here's how I'd think about the leading options:

Recommendations by company profile

• 50–500 employees, cloud-first, Google Workspace or Okta: Cloudflare Access or Twingate are often the quickest path to eliminating VPNs while keeping administration simple.
• Microsoft 365 + Entra ID shops: Microsoft Entra Private Access is compelling because it extends existing Conditional Access, MFA, and identity policies to private applications.
• Large enterprise with compliance requirements: Zscaler, Netskope, or Prisma Access offer more mature capabilities around policy, auditing, and large-scale deployments.

Features worth prioritizing

When evaluating vendors, I'd look for:

• Integration with your identity provider (Okta, Entra ID, Google Workspace, etc.)
• Device posture checks (managed device, OS version, endpoint protection)
• Application-level segmentation instead of network-level access
• Continuous authentication and adaptive policies
• Support for contractors and BYOD
• Simple deployment and user experience
• Comprehensive logging and SIEM integration
• High availability with globally distributed points of presence

Migration strategy

A gradual rollout is usually smoother than a "big bang" replacement:

1. Inventory applications users currently access over VPN.
2. Move web-based internal apps to ZTNA first.
3. Integrate with your identity provider and enforce MFA.
4. Add device posture policies.
5. Migrate SSH, RDP, databases, and file shares.
6. Keep the VPN available temporarily for legacy applications until they're modernized. This phased approach is commonly recommended because some legacy protocols and specialized applications may still require VPN access during the transition.

If you can share:

• your approximate employee count,
• whether you use Microsoft 365/Entra, Okta, or Google Workspace,
• and whether most of your apps are SaaS, on-premises, or in AWS/Azure/GCP,

I can narrow this down to two or three solutions that are the best fit for your environment.

Replacing a legacy VPN with a Zero Trust Network Access (ZTNA) solution for a remote-first company is one of the best ways to improve security, reduce lateral movement risks , and speed up onboarding.

The leading ZTNA solutions suited for remote teams depend heavily on your organization's infrastructure and technical depth:

• Cloudflare Zero Trust (Cloudflare One) — Ideal for cloud-first teams wanting a fast rollout and clientless or lightweight access options. It routes traffic securely through a global edge network and verifies every request against your identity provider. Read more on the Cloudflare Zero Trust Guideflow Overview.
• Twingate — Best for organizations looking for a clean, modern VPN replacement that is exceptionally easy to deploy without altering existing network architecture. It abstracts private networks into application-specific entries. See its review in the OpenVPN Secure Remote Access Guide.
• Zscaler Private Access (ZPA) — Best for larger or rapidly scaling distributed workforces requiring mature, enterprise-grade app microsegmentation. It establishes secure, direct, one-to-one connections to specific apps rather than placing users on the network. Explore details on Zscaler Private Access via Veza.
• Tailscale — Best for developer and engineering-heavy remote teams that prefer a mesh networking approach built on WireGuard principles with minimal administrative overhead. Check out the OpenVPN Blog on Secure Access for context.
• Microsoft Entra Private Access — Best for remote organizations heavily invested in the Microsoft 365 ecosystem, allowing unified identity and network access controls via native Conditional Access. Review the platform breakdown on the DevOpsSchool ZTNA Guide.

If you share a bit more about your environment, I can help narrow down the ideal fit:

• What is your primary Identity Provider (IdP) (e.g., Okta, Google Workspace, Microsoft Entra ID)?
• Roughly how many remote employees need access?
• Are your resources hosted primarily in cloud environments (AWS, GCP, Azure) or on-premises data centers?

For a remote-first company, a modern ZTNA platform can provide a much better user experience than a traditional VPN by granting access to individual applications instead of placing users on the corporate network. The best choice depends largely on your existing identity provider, cloud footprint, and security requirements.

Here are the solutions I'd shortlist:

Industry comparisons consistently place Cloudflare Access, Twingate, Zscaler, Microsoft Entra, and Prisma Access among the leading options for replacing legacy VPNs.

What I'd recommend by company size

• 50–500 employees: Twingate or Cloudflare Access. Both are straightforward to deploy, offer excellent user experience, and minimize operational overhead.
• 500–5,000 employees: Microsoft Entra Private Access (if you're a Microsoft shop) or Zscaler ZPA.
• Large global enterprise: Zscaler ZPA or Prisma Access, especially if you also want broader Secure Access Service Edge (SASE) capabilities.

Features worth prioritizing

When evaluating vendors, I'd look beyond "VPN replacement" and verify they support:

• Identity-provider integration (Okta, Microsoft Entra ID, Google Workspace)
• MFA enforcement
• Device posture checks (managed device, OS version, encryption, EDR status)
• Application-level access instead of network-level access
• Just-in-time or least-privilege access
• Browser-based access for contractors
• Comprehensive audit logging
• High availability with nearby points of presence

Migration strategy

The smoothest migrations usually happen in phases:

1. Integrate your identity provider and MFA.
2. Publish a few internal web apps through ZTNA.
3. Move engineering and IT users.
4. Replace VPN access for remaining applications.
5. Keep the VPN only for workloads that genuinely require full network connectivity, such as certain legacy protocols or infrastructure administration.

Many organizations run VPN and ZTNA side by side during the transition rather than attempting a single cutover. Community experience suggests this staged approach reduces disruption and helps identify applications that still need network-level access.

If you can share:

• approximately how many employees you have,
• whether you use Microsoft 365, Google Workspace, or Okta,
• and whether most of your internal apps are SaaS, on-premises, or in AWS/Azure/GCP,

I can narrow the recommendation to the two or three platforms that are likely to fit your environment best.