Zero trust is not a product category that one purchase can complete. It is an operating model in which every request is evaluated against identity, device condition, destination, data sensitivity and current risk. The right cloud security service depends on which part of that decision chain is missing.
Key Takeaways
- Zero trust is an operating model that evaluates requests based on identity, device condition, and risk.
- Choosing the right cloud security service depends on identifying control gaps in your zero trust strategy.
- Key services for zero trust include Fortinet, Zscaler, and Microsoft Defender for Cloud, each serving specific roles.
- Zero trust networks require five connected control layers to ensure security and compliance across applications and user access.
- Organizations should close control gaps before rollout and continuously test their zero trust policies for effectiveness.
Table of contents
- TL;DR: Zero Trust Service Map
- Zero Trust Service Comparison at a Glance
- 1. Fortinet: secure SD-WAN with zero trust controls
- 2. Zscaler: direct identity-led application access
- 3. Cloudflare One: modular controls on a global edge
- 4. Cato Networks: one cloud-delivered network and security fabric
- 5. Netskope: data-aware access and inspection
- 6. Versa Networks: adaptable cloud and on-premises SASE
- 7. Sophos: private access conditioned by endpoint health
- 8. Skyhigh Security: data-first security service edge
- 9. Akamai: segmentation plus private application access
- 10. Microsoft Defender for Cloud: posture and workload protection
- 11. Darktrace: adaptive detection across cloud activity
- Zero trust networks need five connected control layers
- Close the control gaps before rollout
- Practical zero trust questions
- Build the control chain before choosing the stack
TL;DR: Zero Trust Service Map
- Fortinet is good for combining secure SD-WAN and zero trust controls at distributed edges.
- Microsoft Defender for Cloud fits multicloud posture and workload protection.
- Choose by the control gap, then test telemetry and policy handoffs.
The services below include complete SASE platforms, focused ZTNA products, security service edge offerings, segmentation technology, cloud workload protection and adaptive detection. Comparing them as interchangeable bundles would hide important deployment and ownership differences.
Zero Trust Service Comparison at a Glance
| Service | Primary zero-trust role | What remains to test |
|---|---|---|
| Fortinet | Secure branch transport and access policy | Component scope and policy flow |
| Zscaler | Direct user-to-application access | Connector and protocol coverage |
| Cloudflare One | Modular edge security services | Regional routing and traffic processing |
| Cato Networks | Unified cloud network and security | Migration and routing ownership |
| Netskope | Data-aware SSE and SASE | Inspection depth by traffic type |
| Versa Networks | Flexible SASE deployment | Skills required for each model |
| Sophos | Endpoint-conditioned ZTNA | Controls beyond private apps |
| Skyhigh Security | Information-centered SSE | Networking supplied elsewhere |
| Akamai | Microsegmentation and private access | Integration between two services |
| Microsoft Defender for Cloud | Posture and workload protection | Separate access enforcement |
| Darktrace | Behavioral detection and response | Preventive controls supplied elsewhere |
1. Fortinet: secure SD-WAN with zero trust controls
Best fit: distributed organizations combining branch connectivity, local inspection and identity-aware access. Fortinet Secure SD-WAN converges application-aware routing and next-generation firewall functions on FortiGate. Centralized orchestration and analytics can support branches, campuses, data centers and cloud-connected locations.
The same operating environment can connect SD-WAN with SSE and universal ZTNA. User identity, device identity and posture can inform application access, while branch traffic uses performance and security policy at the edge. This combination is useful when separate network and access teams currently maintain overlapping rules.
Fortinet positions secure SD-WAN for zero trust as part of a broader architecture, not a substitute for every control. Buyers should identify which functions need FortiGate, FortiSASE, FortiClient or other components and verify licensing, log flow and administrative boundaries.
2. Zscaler: direct identity-led application access
Focused strength: replacing broad network access with brokered connections to specific applications. Zscaler Private Access evaluates identity and context, then connects an authorized user to an application rather than placing that user on the network.
This architecture can reduce application exposure and limit lateral movement from a compromised session. Zscaler also extends zero-trust services to workloads, branches and third parties, which suits organizations moving away from VPN and perimeter-centered access.
Test connector placement, non-web protocols, privileged sessions, inspection requirements and continuity during service disruption. Direct application access remains only one layer; workload protection and cloud configuration management still matter.
3. Cloudflare One: modular controls on a global edge
Focused strength: adopting private access, secure web gateway, DLP and network services in stages. Cloudflare One combines Access, Gateway, Tunnel, CASB, browser isolation, email security and other controls through a common control plane.
Outbound-only tunnels can publish private applications without inbound exposure. Identity and context policies govern requests, while Gateway can inspect internet traffic. The modular approach fits teams that prefer APIs and gradual replacement of point products.
Validate regional traffic processing, private network routing, endpoint-client behavior and the exact logs available from each module. A shared control plane does not mean every service has identical policy objects or investigation workflows.
4. Cato Networks: one cloud-delivered network and security fabric
Focused strength: carrying sites, remote users and applications through a shared SASE service. Cato SASE Cloud combines a private backbone, SD-WAN, internet security and universal ZTNA with centralized management.
Its points of presence broker access and inspect traffic for connected locations and users. Organizations can connect branches, cloud environments and data centers through Cato appliances, virtual instances, clients or other supported on-ramps.
The main question is operating-model fit. Examine how existing routing, local breakout, resilience and network troubleshooting would move into the service. A common fabric can simplify handoffs only when teams agree on migration and ownership.
5. Netskope: data-aware access and inspection
Focused strength: applying zero-trust decisions with detailed cloud and data context. Netskope One combines SSE services with SD-WAN options, including private access, secure web gateway, CASB, cloud firewall and DLP.
Policies can consider user, device, application, activity and data characteristics. This is relevant when the central risk is not merely who reached an application, but what information they viewed, uploaded, downloaded or shared.
Proof-of-concept traffic should include sanctioned and unsanctioned SaaS, private applications and representative file types. Buyers should also verify how endpoint, inline and API-based controls differ in coverage and response speed.
6. Versa Networks: adaptable cloud and on-premises SASE
Focused strength: supporting cloud-delivered, on-premises and mixed enforcement models. Versa Unified SASE places secure SD-WAN and ZTNA beside web security, firewall, CASB and DLP functions within a common software and policy architecture.
This range can suit enterprises or service providers that cannot move every location to one cloud-delivered pattern. Identity, device posture and application context can influence access across users, branches and resources.
Flexibility also increases design responsibility. Clarify who operates gateways, upgrades software, manages routing and resolves incidents in each deployment model. Compare the planned configuration, not the longest possible feature list.
7. Sophos: private access conditioned by endpoint health
Focused strength: using endpoint condition in application-specific access decisions. Sophos ZTNA verifies identity, requires multifactor authentication and can use Sophos Security Heartbeat to evaluate device health before granting access.
Integration with Sophos Endpoint, Firewall and Central can help existing customers isolate a compromised device and restrict its private-application access. Gateway services may run in the cloud, locally or as a hybrid design to meet different latency and control requirements.
Sophos ZTNA remains a focused access service. Teams also needing full SaaS governance, DLP, web inspection, branch transport or cloud workload security should document the additional products and consoles.
8. Skyhigh Security: data-first security service edge
Focused strength: carrying one data policy across multiple access channels. Skyhigh SSE unifies CASB, web filtering, private application access, DLP and browser isolation on its cloud platform.
Shared data classifications and policies can follow information across several access channels. This fits regulated environments where stopping inappropriate movement matters as much as granting or denying the initial connection.
Skyhigh SSE does not supply the entire network edge. Buyers need a separate WAN design and should test how routing, identity, endpoint and incident data pass between the networking layer and Skyhigh enforcement.
9. Akamai: segmentation plus private application access
Focused strength: restricting lateral movement and publishing applications without network-level access. Akamai Guardicore Segmentation maps workload communication and enforces granular boundaries across legacy, cloud, container and operational technology environments.
Akamai Enterprise Application Access adds identity-based ZTNA for private applications, including device-posture signals and clientless options. Used together, the services can address both user-to-application access and east-west workload communication.
They remain distinct capabilities. Teams should test how identities, asset labels, policy exceptions and alerts move between segmentation, private access and the wider security stack.
10. Microsoft Defender for Cloud: posture and workload protection
Focused strength: assessing cloud configuration and protecting workloads across Azure, AWS and Google Cloud. Microsoft Defender for Cloud combines CSPM with workload-specific protection for servers, containers, storage, databases and other resources.
Continuous assessments identify misconfigurations and prioritize remediation. Attack-path analysis and multicloud inventory can help teams see how permissions, exposure and vulnerabilities combine into practical srisk.
This is CNAPP coverage, not a replacement for ZTNA, SSE or SD-WAN. Microsoft-heavy organizations may gain familiar workflows, but they still need an enforcement path for users and branches reaching applications.
11. Darktrace: adaptive detection across cloud activity
Focused strength: identifying abnormal behavior that static policy did not anticipate. Darktrace / CLOUD monitors cloud assets, containers, APIs, identities and network context to detect unusual activity and support targeted response.
Its ActiveAI Security Platform can correlate cloud signals with network, email, identity, endpoint and operational technology coverage. That can help investigations follow an attack that crosses several control domains.
Darktrace is a detection and response layer rather than a complete zero-trust access or SASE service. Transport, authentication, access enforcement, DLP and segmentation must be designed separately.
Zero trust networks need five connected control layers
NIST defines zero trust around resources rather than trusted network segments. Identity and device checks occur before a session is established, and network location alone does not grant access. This makes authentication, authorization and continuous policy evaluation the first layer.
The second layer controls transport and segmentation. Branch, remote-user, application and workload traffic still needs an enforced path. SD-WAN, application-aware routing and microsegmentation can reduce exposure, but they do not replace identity or data controls.
The third layer protects applications and information. Web gateways, CASB, private access, browser isolation and DLP address different transactions. Teams should identify whether a rule covers SaaS activity, internet use, private applications, email or east-west workload traffic.
The fourth layer covers cloud posture and workload risk. Misconfigurations, excessive permissions, vulnerable containers and exposed storage require controls beyond remote access. The fifth layer supplies visibility, investigation and response when preventive policy misses new or abnormal behavior.
NSA guidance treats zero trust as a response to an assumed breach, not as confidence in any single node or service. A complete design therefore connects all five layers and assigns an owner to every handoff.
Close the control gaps before rollout
Begin with a control-gap checklist, not a product score. Record every protected resource, identity source, device signal, traffic path, data class and enforcement point. Then mark the system that owns the policy and the team that can change it.
Use a production-like pilot to answer five questions:
- Does every request reach the intended identity and posture check?
- Can a compromised account or device move to another application or workload?
- Which controls inspect encrypted traffic and sensitive data?
- Do logs preserve user, device, application and policy context?
- Can teams revoke access and restore service without conflicting changes?
Commercial review should include connectors, endpoint agents, virtual appliances, log storage, data inspection, cloud egress, premium modules and migration labor. It should also identify duplicated functions that will remain during transition.
Practical zero trust questions
Can SD-WAN enforce zero trust by itself?
No. SD-WAN can steer traffic, segment paths and apply edge security, but zero trust also requires identity, device posture, resource-level authorization and continuous evaluation. It becomes part of zero trust when those signals inform access and enforcement.
What role does microsegmentation play?
Microsegmentation limits communication between workloads, applications or device groups. It can reduce lateral movement after a breach. Effective policy depends on accurate dependency mapping, controlled exceptions and testing before enforcement.
How should unmanaged devices be handled?
Use risk-based options such as clientless access, browser isolation, limited application functions and stronger authentication. Do not grant network-level access simply because a contractor or partner passed an identity check.
Which logs should be centralized?
Centralize authentication, device posture, policy decisions, application access, network flow, data events and administrative changes. Preserve common identifiers so analysts can reconstruct one request across identity, access and response systems.
How often should zero-trust policies be retested?
Retest after material application, identity, network or device-management changes and during scheduled exercises. Also simulate credential theft, endpoint compromise, connector failure and incorrect policy deployment before expanding coverage.
Build the control chain before choosing the stack
No service on this list completes zero trust alone. Fortinet connects secure branch networking with access controls, while Zscaler emphasizes direct application access. Cato, Cloudflare, Netskope and Versa provide broader edge architectures with different operating models.
Sophos and Skyhigh cover focused access and data needs. Akamai addresses segmentation and private access, Microsoft strengthens cloud posture and workloads, and Darktrace adds behavioral detection. Favor the shortlist that closes documented gaps without leaving any handoff unowned.
