Zero trust network access (ZTNA) gives users access to specific applications after checking their identity and device, instead of placing them on the network the way a traditional VPN does. The idea is sound and widely supported, including in NIST SP 800-207. The difficulty for decision owners is that ZTNA products differ a lot in which applications they can protect, how they handle devices the organisation does not manage, and whether they are sold alone or as part of a larger secure access service edge (SASE) platform.
CYBORIUM helps Australian organisations compare ZTNA products and providers through a structured vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.
Inventory the applications and the users
Before comparing products, list the applications users reach through the VPN today and group them by type: web applications, SaaS, remote desktop and SSH, thick-client applications, and legacy systems using unusual protocols. Then list the user groups: employees on managed devices, contractors, third-party support staff and people on personal devices.
Web applications and managed devices are the easy part and every product handles them. The hard part is the long tail: an old finance application, a vendor’s remote support tool, operational technology. That long tail usually decides whether the VPN can be switched off or has to run alongside the new product for years.
Five areas that decide ZTNA value
1. Application and protocol coverage
Give vendors the application inventory and ask them to mark each one as supported through a browser, supported through an agent, supported with workarounds, or not supported. Test the hardest three applications during the trial, not the easiest.
2. Identity and device checks
Confirm integration with your identity provider and support for phishing-resistant multi-factor authentication. Check which device signals the product can use, such as operating system version, disk encryption and endpoint agent status, and how often it re-checks them during a session.
3. Unmanaged devices and third parties
Ask how contractors and support vendors will get access without installing your agent. Browser-based access and isolation features vary in how well they prevent data being copied to an unmanaged device.
4. Architecture and performance
Find out where the provider’s points of presence are in Australia, where traffic is inspected and where logs are stored. Test latency to your key applications from the cities where your users work. If the product requires connectors inside your network, check how many are needed and how they fail over.
5. Commercial model and platform scope
ZTNA is often bundled with secure web gateway, CASB and SD-WAN in a SASE platform. Bundles can reduce cost, but they also increase dependence on one vendor. Price ZTNA alone and as part of the bundle, and decide whether the other components would win their own evaluations.
Plan the migration, not just the product
ZTNA projects stall in the middle, when the easy applications have moved and the remaining ones need changes to the applications themselves or to network design. Ask each vendor for a realistic migration plan based on your inventory, including which applications may never move. Keep the VPN decommissioning date out of the business case until the long tail has been tested.
A comparable evaluation
Run a trial with a group of real users, covering at least one application from each difficult category and one third-party access case. Measure login success, time to access, latency and support tickets. Score these alongside written evidence on identity integration, device checks, data location, logging, resilience and three-year cost at your expected user count.
Contract points to settle
The contract should state where traffic is processed and logs are held, service levels for availability of the access service, what happens during a provider outage, and exit support. Commercial schedules should define how users are counted, including contractors and occasional users, and fix the price of bundled components you may not use in year one.
CYBORIUM’s role in the decision
CYBORIUM can build the application and user inventory, design the trial, coordinate vendors, evaluate evidence and compare standalone and bundled pricing. The organisation keeps the decision and contracts directly with the selected provider. See also the guides to SASE, identity and access management and privileged access management.
Updated 15 September 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal or regulatory advice.
Standards and further reading
Zero trust is an architecture, not a product category, so the useful evaluation question is which parts of it a given product actually implements.
- NIST SP 800-207. The reference architecture, including the policy decision and enforcement points a product should be able to show you on its own diagram.
- ASD Essential Eight Maturity Model. The maturity baseline access controls are assessed against in Australia.
- ASD Information Security Manual. Control requirements for network segmentation and remote access that survive the change in architecture.
Related from CYBORIUM
Also relevant: PAM procurement for Australian decision owners.
What should a ZTNA pilot prove?
That your real applications work for real users, that policies are manageable, and that support responds when something breaks. Run it with a group that includes your hardest users.
Which applications should move to ZTNA first?
Start with applications used by remote or contract staff, where the old VPN causes most problems. Prove it works there before you move the rest.
What should ZTNA support include?
Fast response for access problems, since users cannot work when access fails. Ask about support hours, escalation and how outages are handled.
If this is on your list this year, a short conversation can save weeks. Contact CYBORIUM or request a free market briefing.
Last updated:
