We're a remote-first company. What's a good Zero Trust Network Access (ZTNA) solution to replace our legacy VPN?

For a remote-first company replacing a legacy VPN, I’d shortlist Cloudflare Access, Tailscale, and Microsoft Entra Private Access. The right choice depends heavily on whether you want a lightweight VPN replacement, application-level ZTNA, or a broader enterprise security platform.

My practical recommendation

If you're a typical remote-first tech company, I'd start a POC with Cloudflare Access and Tailscale.

• Choose Cloudflare Access if your goal is "employees should reach specific internal applications, not the corporate network." It supports identity, device posture and contextual policies and is explicitly designed to replace traditional VPN access.Cloudflare+1
• Choose Tailscale if your workforce needs substantial access to infrastructure—SSH, databases, Kubernetes, internal services, etc. Its policies can specify exactly which identities/devices can reach particular resources, and it supports subnet routers for legacy systems that can't run an agent.Tailscale+1
• Choose Entra Private Access if you're already deeply invested in Microsoft Entra ID and Conditional Access. Microsoft specifically positions it as a VPN replacement and supports per-app access to private resources, including TCP/UDP applications.Microsoft Learn+1

One architectural point I'd make non-negotiable: don't simply recreate the VPN's "you're on the corporate network" model with a different product. The useful ZTNA transition is from network-level access to identity → device → application/resource → policy. Microsoft, for example, recommends moving from its initial Quick Access VPN-replacement configuration toward per-app access for greater segmentation.Microsoft Learn

A sensible migration path

1. Inventory what employees actually access through the VPN.
2. Classify resources into SaaS, web apps, SSH/admin, databases, file shares, and legacy protocols.
3. Put your IdP/MFA at the center of the policy.
4. Pilot 10–20 users with per-application access.
5. Keep the old VPN available as a fallback.
6. Measure authentication failures, latency, help-desk tickets, and which resources still require network-level connectivity.
7. Migrate the remaining legacy workloads and then shut down broad VPN access.

If you tell me roughly company size, IdP (Google Workspace/Okta/Entra), where your workloads live (AWS/Azure/on-prem), and whether employees need SSH/database access, I can narrow this to a concrete 2–3 vendor shortlist and a migration architecture.

Replacing a legacy VPN in a remote-first company requires a ZTNA solution that balances tight security with low latency and a frictionless user experience. For a distributed team, the "best" choice depends heavily on your company's size, IT infrastructure, and whether you need lightweight access or a comprehensive enterprise SASE/SSE suite.portnox.com+2

The top-tier ZTNA solutions break down into distinct categories based on your organization's profile:

1. Lightweight & Developer-Friendly (Best for Agility)

• Tailscale: Built on WireGuard, Tailscale creates a zero-trust mesh network that is exceptionally fast to set up and loved by engineering and remote-first teams. It requires minimal configuration, handles NAT traversal seamlessly, and lets you manage access via your existing identity provider (IdP).petronellatech.com+2
• Twingate: Designed specifically as a clean, modern VPN replacement, Twingate offers resource-level access control without heavy appliances or forcing traffic through a clumsy tunnel. It’s software-first, deploys in minutes, and is ideal for small-to-midmarket teams wanting a straightforward rollout.guideflow.com+3

2. Cloud-First & Edge-Delivered (Best for Global Scale)

• Cloudflare Zero Trust (Cloudflare One): Leverages Cloudflare's massive global edge network, offering ultra-low latency no matter where your remote employees are located. It supports both client-based and clientless access options alongside Secure Web Gateway (SWG) and browser isolation.petronellatech.com+2
• Zscaler (Zero Trust Exchange / ZPA): An industry benchmark and pioneer for cloud-native Security Service Edge (SSE). It connects users directly to specific applications rather than extending the network, making it a gold standard for larger, scaling remote-first enterprises.guideflow.com+1

3. Ecosystem-Aligned & Enterprise Suites (Best for Consolidation)

• Microsoft Entra ID + Intune: If your remote-first company is already deeply embedded in the Microsoft 365 ecosystem, you already possess the foundational conditional access and device posture telemetry required for a native zero-trust architecture.petronellatech.com+1
• Palo Alto Networks (Prisma Access): Best if you require heavy enterprise-grade traffic inspection and ZTNA 2.0 principles integrated into a broader, AI-driven security operations framework.portnox.com+2

Real-World Feedback

We switched from a traditional VPN to Twingate and it has been night and day. Onboarding new remote teammates takes minutes, and our helpdesk tickets for connection drops practically went to zero.

Tailscale is absolute magic for engineering-heavy teams. It just works in the background using WireGuard, and we didn't have to re-architect our internal subnet layouts to make it secure.

To help narrow down the right fit, tell me:

• What is the approximate size of your remote workforce?
• What identity provider (IdP) do you currently use (e.g., Okta, Google Workspace, Microsoft Entra ID)?
• Do your employees mostly access standard web apps or heavy infrastructure/SSH/RDP resources?

For a remote-first company replacing a legacy VPN, I’d shortlist Zscaler Private Access (ZPA), Twingate, and—depending on your existing security stack—Cloudflare Zero Trust.

My picks

If I had to choose one without knowing anything else: Twingate for simplicity, Zscaler for enterprise depth.

Why ZTNA is a better fit than another VPN

The key architectural difference is that employees shouldn't get "onto the corporate network." Instead, access is granted to specific applications/resources based on identity, device posture, and policy. Zscaler, for example, brokers user-to-application connections rather than putting the user on the network.Zscaler+1

Twingate takes a particularly straightforward approach: verified identity + device + policy → access to an individual resource, with no inbound ports exposed.Twingate

What I'd prioritize for a remote-first deployment

1. IdP integration — Entra ID/Okta/Google Workspace, with MFA enforced there.
2. Device posture — require managed/compliant devices for sensitive resources.
3. Application-level policies — e.g. engineering gets Git/CI, finance gets ERP, admins get SSH only when needed.
4. No network-wide access — avoid recreating the VPN's "you're inside now" model.
5. Fast offboarding — disabling the user in the IdP should immediately remove access.
6. BYOD/contractor support — ideally browser-based or agentless access for appropriate apps.
7. Logging/SIEM integration — every access decision should be attributable to a user, device, application, and policy.

For a particularly clean migration, start by duplicating your existing VPN's application access, move users to ZTNA, verify everything works, then progressively tighten policies and eliminate broad network access. Zscaler itself recommends this phased approach.Zscaler

If you tell me your company size, IdP (Okta/Entra/Google), endpoint management (Intune/Jamf/etc.), and where your apps live (AWS/Azure/on-prem), I can narrow this to a specific recommendation and migration architecture.

For a remote-first company replacing a legacy VPN, the right Zero Trust Network Access (ZTNA) solution depends heavily on your team's size, your current identity provider (IdP), and whether you need lightweight developer-focused connectivity or a heavy enterprise Security Service Edge (SSE) platform.petronellatech.com+1

Top-tier ZTNA solutions break down into categories based on company profile:

1. Modern & Lightweight (Best for Remote-First SMBs & Mid-Market)

• Twingate: Designed specifically to replace traditional VPNs with minimal friction. It offers granular, resource-level access control without requiring network re-architecture, integrates smoothly with major IdPs (Okta, Google Workspace, Microsoft Entra ID), and is famously fast to deploy for remote teams.
• Tailscale: Built on WireGuard, Tailscale is a developer-favorite mesh VPN/ZTNA hybrid. It is remarkably easy to set up, makes peer-to-peer remote device connections effortless, and requires very little networking overhead to maintain.
• Cloudflare Zero Trust: Excellent for organizations wanting edge-based security. It integrates secure web gateway (SWG), DNS filtering, and ZTNA into a blazing-fast global network, making it great for distributed teams accessing both cloud and self-hosted apps.petronellatech.com+1

2. Identity-First & Ecosystem-Aligned (Best if you're already deeply invested in an ecosystem)

• Microsoft Entra ID (with Global Secure Access): If your remote workforce lives inside Microsoft 365 and uses Entra ID (formerly Azure AD) for identity and Intune for device compliance, Microsoft’s native zero-trust network access keeps everything under one single pane of glass.petronellatech.com+1
• Google BeyondCorp Enterprise: The ideal choice if your remote-first organization is standardized entirely on Google Workspace, utilizing Chrome Enterprise and Google's context-aware access policies.petronellatech.com+1

3. Enterprise-Grade / SASE Platforms (Best for Large Scale / Complex Infrastructure)

• Zscaler Private Access (ZPA): The gold standard for massive enterprise consolidation. It completely decouples application access from network access, ensuring users never touch your actual network perimeter.
• Palo Alto Prisma Access: A comprehensive SASE/ZTNA choice if you need heavy-duty traffic inspection, advanced threat prevention, and deep control over enterprise data flows.portnox.com+1

Real-World Perspectives

To help narrow down the best fit, tell me:

• What identity provider (Google, Microsoft, Okta) do you currently use?
• Are your internal apps hosted in the cloud (AWS/GCP/Azure) or on-premises in a private datacenter/office?
• Roughly how many employees need access?

For a remote-first company replacing a legacy VPN, my default shortlist would be Cloudflare Access, Twingate, and Zscaler Private Access—with the right choice depending mainly on your size, identity stack, and how much legacy infrastructure you need to support.

My pick: Cloudflare Access

For a typical 50–1,000-person remote-first company, I'd start with Cloudflare Access. It is explicitly designed to replace legacy VPN access with per-application, identity-aware access, rather than putting employees onto the corporate network. Cloudflare also supports clientless access for contractors and unmanaged devices, which is particularly useful for distributed organizations.Cloudflare+1

Its current published pricing starts at $0 for up to 50 users and $7/user/month for the pay-as-you-go tier, though enterprise requirements can change the economics.Cloudflare

cloudflare.com

When I'd choose something else

• Twingate: I'd favor this if your primary requirement is "make all our existing private servers/apps accessible without exposing the network" and you want a focused VPN replacement with minimal infrastructure changes.Expert Insights
• Zscaler Private Access: Stronger candidate if you're a large enterprise and are also looking toward a broader SSE/SASE architecture.Start with Identity
• Tailscale: Excellent if the majority of your use case is developers accessing SSH, Kubernetes, databases, and cloud infrastructure. Its mesh architecture is different from traditional brokered ZTNA, so I'd evaluate the access-control and centralized-logging requirements carefully.TechnologyMatch
• Entra Private Access: Worth putting near the top if your company is deeply invested in Microsoft 365/Entra and wants to consolidate identity and private-access controls.Deepak Gupta

One important architectural rule

Don't simply replace your VPN with a product that gives users access to the same subnets. That's essentially a VPN with a new name. The target architecture should be:

User → IdP/MFA → device/posture checks → specific application/resource → short-lived session

rather than:

User → VPN → corporate network

That distinction is what gives you meaningful least-privilege and limits lateral movement.SecureCoding

If you tell me rough employee count, IdP (Google Workspace/Okta/Entra), major apps (SaaS + on-prem), and whether you have developers needing SSH/Kubernetes access, I can narrow this to a 2–3 vendor recommendation with a migration plan from your existing VPN.

For a remote-first company, ditching a legacy VPN for Zero Trust Network Access (ZTNA) is one of the highest-impact security moves you can make. It stops lateral movement, eliminates agonizing VPN bottlenecks, and gives remote employees a seamless connection without trusting their entire home network.youtube.com+1

The "best" solution depends heavily on your current tech stack (Microsoft, Google, or cloud-agnostic) and company size. Top-tier ZTNA solutions are categorized below by what they do best:

1. Best for Microsoft-Heavy Environments: Microsoft Entra Private Access

• Why it shines: If you are already paying for Microsoft 365 and using Entra ID (formerly Azure AD) for identity, Microsoft Entra Private Access extends Conditional Access policies straight down to private apps and legacy on-prem resources.
• The vibe: Identity-centric, highly integrated, and requires minimal new tooling if you're already in the Microsoft ecosystem.youtube.com+1

2. Best for Speed, Simplicity & Lightweight Deployments: Cloudflare One (Cloudflare Access) or Twingate

• Why they shine:
  • Cloudflare Access leverages their massive global edge network, making it remarkably fast. It offers great clientless (browser-based) access options alongside client-based connectors.
  • Twingate is frequently praised by lean remote teams because it takes minutes to set up, behaves like a modern software overlay on your existing infrastructure, and isolates access down to specific resources rather than opening up subnets.portnox.com+3
• The vibe: Developer-friendly, incredibly fast rollout, and low administrative overhead.

3. Best for Pure Enterprise Scale & SASE/SSE Consolidation: Zscaler Private Access (ZPA)

• Why it shines: Part of the massive Zscaler Zero Trust Exchange, ZPA is the gold standard for larger or scaling remote organizations that want to bundle ZTNA with Secure Web Gateways (SWG) and comprehensive cloud security. It completely hides internal apps from the public internet.
• The vibe: Robust, enterprise-grade, but heavier to implement if you just want a simple VPN replacement.petronellatech.com+2

4. Best Open/WireGuard-Based Mesh Alternative: Tailscale

• Why it shines: Built on WireGuard, Tailscale makes setting up a zero-trust, peer-to-peer software-defined mesh network frictionless. It doesn't require managing complex gateway appliances and handles NAT traversal brilliantly for remote workers on messy home Wi-Fi.petronellatech.com+1
• The vibe: Extremely popular with engineering-driven or hyper-distributed remote teams who want something that "just works" out of the box.

To help narrow down the ideal fit, tell me:

• What identity provider (IdP) do you use (e.g., Okta, Google Workspace, Microsoft Entra ID)?
• Are your internal apps hosted primarily in cloud environments (AWS/GCP/Azure) or on-premises data centers / offices?

For a remote-first company replacing a legacy VPN, I’d shortlist Cloudflare Access, Zscaler Private Access (ZPA), Twingate, and Tailscale. The right choice depends mainly on your company size, application mix, and whether you want ZTNA to become part of a broader security platform.

My shortlist

What I'd pick

For a typical 100–1,000-person remote-first company, I'd start with Cloudflare Access. It gives you a relatively clean migration path while moving the security model from:

"Employee authenticated → employee is on the corporate network" to:

"Employee authenticated + trusted device + appropriate context → employee can access this specific application." That distinction is the important part of ZTNA.Cloudflare+1

I'd choose Zscaler ZPA instead if you're a larger enterprise, have complex compliance requirements, lots of private applications, or expect to consolidate ZTNA with a broader SSE/SASE deployment. ZPA's architecture is explicitly based on brokering one-to-one connections between users and applications rather than giving users network access.Zscaler

I'd choose Twingate if the primary goal is "replace our VPN quickly and make it much easier to administer." And I'd lean toward Tailscale when the majority of the use case is engineers reaching infrastructure.

One important migration rule

Don't simply recreate your VPN with a different product.

During the migration, inventory resources such as:

• SaaS and internal web applications
• SSH/RDP/admin interfaces
• databases and internal APIs
• file shares
• development environments
• production infrastructure
• third-party/contractor access

Then create identity → device posture → application/resource → action policies. Avoid policies like "employees can access 10.0.0.0/8." That gives you a newer VPN, not meaningful ZTNA.securecoding.com

If you tell me your employee count, identity provider (Entra/Okta/Google), endpoint management (Intune/Jamf/etc.), and what kinds of internal apps you have, I can narrow this to 2–3 choices and give you a concrete migration architecture and rough cost comparison.