Network Security
ZTNA tools that open an app, not a flat network (2026)
A 2026 shortlist of identity-aware paths. Public docs, not a lab bake-off.
Expertise: Network Security · Level: Intermediate · 12 min read
A full-tunnel VPN is a flat network with extra steps.
The contractor needed one app and got the subnet. ZTNA is a path to a name, not a /16. PAM is the privileged session. This page is the path. Teleport and Pomerium appear on both on purpose.
Six paths. Two open planes. One mesh. One edge Access. Two commercial ZTNA shelves. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Pomerium | Identity-aware proxy you host | Apache-2.0 |
| Tailscale | WireGuard mesh with identity | BSD (clients) / commercial control |
| Cloudflare Access | Known identity-aware edge | Cloudflare Zero Trust plans |
| Twingate | Commercial connector ZTNA | Commercial |
| Zscaler Private Access | Known enterprise ZTNA | Commercial |
| Teleport | Cert plane that can replace a jump box | AGPL-3.0 / commercial |
Pomerium
Best for identity-aware proxy you host
Pomerium is also on the PAM list as a web-admin proxy. Here it is the ZTNA-shaped path.
Key features
- Policy on the route
- IdP in front
- Self-host
- Apache-2.0
Why we like it
Hidden gem for an app you already reverse-proxy.
Limits
You operate it. Not a global SASE PoP story.
Tailscale
Best for wireGuard mesh with identity
Tailscale is a WireGuard mesh. Identity from your IdP. People run it because it works. The control plane is their SaaS unless you self-host Headscale.
Key features
- WireGuard
- IdP-based nodes
- ACLs
- Headscale as a self-host cousin
Why we like it
Honest install already in the building. Treat ACLs as the ZTNA, not the happy LAN.
Limits
A mesh can still be too flat if ACLs are allow-all. Headscale is a different ops job.
Cloudflare Access
Best for known identity-aware edge
Access puts an IdP in front of an origin. Same edge as the WAF list.
Key features
- IdP policies
- Same edge as Cloudflare
- Tunnel option
- Plan-gated
Why we like it
If DNS is already Cloudflare, start here.
Limits
Plan SKUs. Not a PAM vault. Link WAF if the job is the filter.
Twingate
Best for commercial connector ZTNA
Twingate deploys connectors next to the app. Users get the app, not the subnet, if you configure it that way.
Key features
- Connectors
- IdP
- Split access they document
- Commercial
Why we like it
Commercial shelf when you will not host Pomerium.
Limits
Commercial. We did not run a tenant.
Zscaler Private Access
Best for known enterprise ZTNA
ZPA is the known enterprise name. Often bought with the Zscaler stack.
Key features
- Brokered app access
- Enterprise IdP
- Same family as ZIA
- Sales-led
Why we like it
Steering-committee shelf.
Limits
Commercial. Not Tailscale. We did not run it.
Teleport
Best for cert plane that can replace a jump box
Teleport is on the PAM list. Here it is the path to SSH and Kubernetes without a standing VPN.
Key features
- Short certs
- App and K8s access
- Audit
- Self-host or cloud
Why we like it
If the ‘app’ is SSH, this is ZTNA with a privileged flavor. Overlap declared.
Limits
AGPL core. Enterprise paid. Still need an IdP.
What the internet thinks about ZTNA tools
Tailscale threads treat identity on the mesh as the reason to drop a flat VPN. Read the ACL warnings in those threads too.
RGBCube on Hacker News, Mar 2025: “You can completely selfhost a control server, using Headscale. It’s completely OSS, just like the Android and Linux clients.”
Prove Pomerium still ships Apache-2.0
Confirm Pomerium still publishes Apache-2.0. Do not expose an internal app to the internet for this check.
curl -fsS https://raw.githubusercontent.com/pomerium/pomerium/main/LICENSE | head -n 5FAQs
Does ZTNA replace PAM?
No. ZTNA is the path. PAM expires the admin. Some products do both. The job is still two questions.
Is Tailscale ZTNA if ACLs are open?
No. That is a mesh LAN. The control is the ACL.
Does this replace the WAF?
No. WAF filters the public edge. ZTNA hides the app.
Is this a scored bake-off?
No. Order is editorial.
