Global Tool Radar

Security & Privacy / Zero Trust Network Access (ZTNA) Software

Cisco Secure Access Zero Trust Network Access Review, Pricing, Pros & Cons

Cisco Secure Access Zero Trust Network Access is the private-application access capability sold through Cisco Secure Private Access Essentials and Advantage, with client-based and clientless access, continuous posture checks, contextual least-privilege policy, and cloud or local enforcement.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You want application-specific access instead of broad network connectivity: Cisco ZTNA denies access by default and grants access only to specified private applications using identity, device posture, and context.
  • You need both managed-client and clientless private application access: Both SPA packages support client-based ZTNA and browser-based HTTP or HTTPS access, while Advantage adds browser-based SSH and RDP.
More buying conditions
  • Your private applications span on-premises, cloud, and multiple sites: Resource Connectors establish outbound-only connections, while site-to-site tunnels, multiple regions, SD-WAN integration, and cloud or local enforcement support distributed estates.
  • You already operate Cisco identity, firewall, SD-WAN, XDR, or Splunk tools: Secure Access publishes native integrations with ISE, Duo, Secure Firewall, Catalyst and Meraki SD-WAN, XDR, and Splunk, alongside third-party identity providers and APIs.
Not for
  • You need transparent public pricing or fewer than 50 covered users: Cisco uses dynamically calculated sales and partner quotes and requires at least 50 users for each selected SPA billing SKU.
  • You want ZTNA without deploying connectors, clients, identity, posture, routing, or policy infrastructure: Private access can require Resource Connectors or tunnels, identity-provider integration, endpoint enrollment, posture profiles, certificates, DNS, and access-policy design.
More buying conditions
  • You assume the SPA quote includes every Secure Access SSE function: Internet security, DLP, CASB, browser isolation, full firewall controls, and other functions have separate package, tier, or add-on rules.
  • You require all legacy and non-ZTNA applications to use the ZTNA path: Cisco positions VPNaaS as the separate private-access method for applications that are not supportable by ZTNA.
Pricing
  • Quote-priced per-covered-user subscriptions for Secure Private Access Essentials and Secure Private Access Advantage, with tiered pricing by covered-user quantity and term, a 50-user minimum per selected billing SKU, and a required software-support SKU
  • Secure Private Access Essentials · Requires quote · per covered user · custom quote · minimum 50 covered users
Free or trial access
  • No permanent free plan is published. Cisco documents a time-limited Secure Access free trial, but the public guide does not state a standard duration or universal eligibility. A separate Umbrella migration offer advertises a long-term Secure Private Access trial for up to 100 seats; neither trial is a pricing plan.

Product scope

Product functionality and purchase scope

This profile evaluates Cisco's Zero Trust Network Access capability as commercially delivered through the current Secure Private Access Essentials and Secure Private Access Advantage packages. It covers client-based and clientless private-application access, identity and device context, posture-aware least-privilege policy, outbound resource connectors, cloud and local enforcement options, logging, integrations, and ZTNA resilience while separating the broader SSE platform and attached or adjacent products.

Product checked: Aug 12, 2026

Functionality reviewed
  • Secure Private Access Essentials and Secure Private Access Advantage as the two current core commercial packages
  • Granular application-specific access to private apps in on-premises data centers and cloud environments
  • Client-based ZTNA through the Secure Client ZTA module for supported desktop and mobile platforms
  • Clientless browser-based HTTP and HTTPS private application access
  • Browser-based SSH and RDP in Secure Private Access Advantage
  • Identity-aware proxy policy, endpoint posture, continuous per-session posture checking, and user reauthentication controls
  • Outbound Resource Connectors, site-to-site tunnels, cloud enforcement, and supported local enforcement with Secure Firewall
  • Private-access activity, events, API access, identity-provider integrations, MultiOrg administration, and supported multi-region design
Non-target functionality excluded from scoring
  • The full Cisco Secure Access Security Service Edge platform and combined Secure Internet Access plus Secure Private Access purchase
  • Cisco Secure Internet Access, DNS Defense, secure web gateway, CASB, DLP, FWaaS, AI Access, and internet threat-protection scope except where a plan-dependent private-traffic control is expressly identified
  • Cisco Umbrella products, subscriptions, and migration entitlements
  • Cisco Duo product scope beyond identity-provider integration and limited-use Cisco-app entitlement
  • Cisco Secure Client licensing and functions outside use with the Secure Access subscription
  • VPN-as-a-Service and traditional remote-access VPN as access methods outside the ZTNA attribute assessment
  • Cisco Multicloud Defense and other workload or cloud-network security products
  • Remote Browser Isolation and enterprise-browser data controls beyond the native clientless ZTNA connection method
  • Experience Insights and ThousandEyes digital experience monitoring beyond its separately identified attached entitlement
  • Cisco User Protection Suite products other than its Secure Access acquisition route
  • Cisco Secure Access for Government, Cisco Secure Access China, and region-specific regulated packages
  • Software Support Premium, professional services, managed services, training, and implementation services
Purchase paths

Pricing checked: Aug 12, 2026

  • Combined Secure Internet Access and Secure Private Access: Cisco permits SIA and SPA to be combined within one Secure Access subscription when both use the same Essentials or Advantage tier. This broader SSE acquisition adds internet and SaaS security and is not another SPA plan; no combined-package offer is repeated here.
  • Cisco User Protection Suite: The User Protection Suite provides Cisco Secure Access alongside Duo and Email Threat Defense, with additional endpoint and ISE products in Advantage. It is a broader suite route rather than a duplicate Secure Private Access edition.

Pricing plans

Cisco Secure Access Zero Trust Network Access pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 95%2 linked sources

Secure Private Access Essentials and Secure Private Access Advantage are the two core ZTNA purchase packages. Both are licensed per covered user with a 50-user minimum, and Cisco Commerce calculates the quote from user count and term. Standard subscription term choices are 12, 36, and 60 months; annual and full-term prepaid billing choices are described, but they are not collapsed into one inferred commitment or payment state. Enhanced software support is required through a separate support SKU, with Premium available as an upgrade. Secure Internet Access combinations, User Protection Suite access, trials, add-ons, and attached Experience Insights are not additional SPA plans.

Official pricing page
PlanPriceBest for
Secure Private Access EssentialsCisco Secure Private Access Essentials (SA-SPA-ESS-K9)Supporting pricing evidence
  • Requires quote · per covered user · custom quote · minimum 50 covered users
Organizations that need core client-based and browser-based HTTP or HTTPS ZTNA, posture-aware private application policy, resource connectors, MultiOrg administration, and a lower tier before Advantage-only browser protocols and included advanced private-traffic controls.
Secure Private Access AdvantageCisco Secure Private Access Advantage (SA-SPA-ADV-K9)Supporting pricing evidence
  • Requires quote · per covered user · custom quote · minimum 50 covered users
Organizations that need the SPA core plus browser-based SSH and RDP and included advanced private-traffic inspection capabilities that would otherwise be unavailable or separately licensed in Essentials.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Secure Private Access Essentials Secure Private Access Advantage

The deployment requires browser-based SSH or RDP, or wants advanced private-traffic inspection capabilities included rather than unavailable or separately licensed.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

Application-specific access with identity, posture, and contextIncluded capability

ZTNA grants access to specified applications rather than broad network connectivity and evaluates identity, device posture, and contextual policy.

Official source
Cisco Secure Client ZTA module for managed endpointsIncluded capability

All Secure Access packages include download rights for Secure Client only for Secure Access use. ASA or FTD and other uses require separate Secure Client licensing.

Plan: Secure Private Access Essentials: Included · Secure Private Access Advantage: IncludedCisco Secure Client
Official source
Client-based and clientless HTTP or HTTPS private accessIncluded capability

Both SPA packages provide client-based ZTNA and browser-based HTTP or HTTPS access. Clientless access does not imply remote browser isolation.

Plan: Secure Private Access Essentials: Included · Secure Private Access Advantage: Included
Official source
Outbound-only connectors for private application reachabilityIncluded capability

Resource Connectors are lightweight virtual appliances for private-resource connectivity and avoid direct internet exposure of private applications.

Cisco Secure Access Resource Connector
Official source
Per-session access with continuous posture checkingIncluded capability

The data sheet states that ZTNA establishes per-session secure access with continuous posture checks.

Official source
VPN access for applications outside ZTNA supportIncluded capability

VPNaaS is a distinct private-access method that extends application coverage where ZTNA is not supportable. Its network-level access is excluded from ZTNA attribute values.

Cisco Secure Access VPN-as-a-Service
Official source
Chrome, Edge, and enterprise-browser private access integrationsNative integration

The integration supports more secure clientless private-app access. Browser-native DLP, watermarking, print, copy, and screenshot controls remain browser-product scope.

Plan: Secure Private Access Essentials: Included · Secure Private Access Advantage: IncludedChrome Enterprise, Edge for Business, and supported enterprise browsers
Official source
Cloud or local ZTNA enforcement with Secure FirewallNative integration

Cisco publishes cloud or local enforcement and lists Hybrid Private Access in both SPA tiers. Secure Firewall licensing, deployment, and controlled-availability prerequisites remain separate.

Plan: Secure Private Access Essentials: Included · Secure Private Access Advantage: IncludedCisco Secure Firewall
Official source
Browser-based SSH and RDP in SPA AdvantagePlan-dependent capability

Cisco's current ordering guide states that browser-based SSH and RDP requires a Secure Access Advantage tier subscription.

Plan: Secure Private Access Essentials: Unavailable · Secure Private Access Advantage: Included
Official source
Layer 7 IPS and private-traffic inspection entitlementPlan-dependent capability

The package matrix shows Layer 7 firewall and IPS as an add-on for SPA Essentials and included in SPA Advantage. It is not generalized to every Essentials quote.

Plan: Secure Private Access Essentials: Optional add-on · Secure Private Access Advantage: IncludedCisco Secure Access Threat Defense
Official source
Attached ThousandEyes digital experience monitoring entitlementSeparate product

The $0 SA-INSIGHTS SKU is automatically attached to SPA and SIA subscriptions and cannot be removed. DEM is not used to increase the ZTNA user-experience attribute.

Plan: Secure Private Access Essentials: Included · Secure Private Access Advantage: IncludedCisco Secure Access Experience Insights
Official source
Broader user security suite acquisition routeSeparate product

The suite includes Secure Access with Duo, Email Threat Defense, and tier-dependent endpoint and ISE products; it is not another SPA plan.

Cisco User Protection Suite
Official source
Cloud network and workload securitySeparate product

Multicloud Defense protects cloud environments through its own SaaS control plane and is not a Secure Private Access edition or ZTNA feature.

Cisco Multicloud Defense
Official source
Internet and SaaS security packageSeparate product

SIA is a separate package group that may be combined with SPA at the same tier. Its SWG, DNS, CASB, DLP, and internet controls are not core ZTNA.

Cisco Secure Internet Access
Official source
Legacy DNS and SIG product familySeparate product

The current package guide presents Umbrella separately from Secure Access. Migration tools and trial entitlements do not make Umbrella a current SPA plan.

Cisco Umbrella
Official source
Limited-use Duo identity for Cisco applicationsSeparate product

Secure Access customers receive limited-use Duo licenses for Cisco applications at no extra cost, but this does not replace or expand existing Duo entitlements.

Cisco Duo
Official source
Remote execution and browser data controlsSeparate product

RBI executes internet browsing remotely and provides isolation controls. It is distinct from browser-based ZTNA that proxies access to a private application.

Cisco Secure Access Remote Browser Isolation
Official source
Required Enhanced support with optional Premium upgradeSeparate product

A separate support SKU is required for every Secure Access subscription. Enhanced is selected by default and Premium is an optional paid upgrade.

Cisco Software Support Service
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
85%
AI claim confidence
98%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
95%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 5 A1 documentary official sources and 3 A2 official product sources are linked.
  • 0 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Least-privilege access20%
88

Deny-by-default, contextual least-privilege policy and per-session continuous posture checking enforce application-specific access instead of network-wide reach for private apps that fit the ZTNA model.

Identity and device trust17%
83

Integrates natively with identity infrastructure and continuous posture assessment, though advanced authentication features like Duo require separate licensing.

Application coverage15%
76

ZTNA covers private applications reachable through client and clientless HTTP/HTTPS paths across on-premises, cloud, and multi-region designs, Advantage adds browser SSH and RDP, and remaining non-ZTNA applications are expected to use separate VPNaaS.

User experience and performance14%
74

Multi-platform Secure Client access, clientless browser paths, and choice of cloud or supported local enforcement give flexible user connectivity options, while quantified latency or experience outcomes are not established inside the core SPA capability set.

Security and resilience13%
84

Outbound-only Resource Connectors, deny-by-default application access, continuous posture checks, and multi-region design options reduce inbound exposure and support resilient private-access architectures for covered applications.

Administration and integrations11%
82

Simplifies multi-tenant administration through MultiOrg capabilities and integrates directly with Cisco security ecosystems like ISE and SD-WAN.

Support and total cost10%
57

Quote-priced per-covered-user licensing, a 50-user minimum, required separate support SKU, and no published numeric price or renewal figures keep total cost opaque and raise the commercial entry threshold for smaller or self-serve buyers.

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

AWS Marketplace4.3/5
Rating count
72 ratings
Evaluated scope
Full product listing
Storefront
AWS Marketplace
View source
Score79
Pricing modelQuote-priced per-covered-user subscriptions for Secure Private Access Essentials and Secure Private Access Advantage, with tiered pricing by covered-user quantity and term, a 50-user minimum per selected billing SKU, and a required software-support SKU
Use casereplace broad remote network access with identity- and device-aware access to specific private applications across on-premises and cloud environments
Company sizeEnterprise, Mid-market
Structured tags

Cisco Secure Access Zero Trust Network Access tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Cisco Secure Access Zero Trust Network Access core capabilities

  • Application-specific private access with deny-by-default, identity-aware policy
  • Client-based ZTNA for Windows, macOS, Linux, iOS, Android, and ChromeOS scope documented by Cisco
  • Clientless HTTP and HTTPS access in both SPA packages
  • Browser-based SSH and RDP in Secure Private Access Advantage
  • Per-session access with continuous endpoint posture checking
  • Outbound-only Resource Connectors and supported site-to-site tunnel connectivity
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Deny-by-default, identity-aware, application-specific private access with per-session continuous endpoint posture checking supports least-privilege private-app policy for managed and unmanaged users.
  • Both Secure Private Access Essentials and Advantage include client-based ZTNA across documented Windows, macOS, Linux, iOS, Android, and ChromeOS scope plus clientless HTTP and HTTPS access.
  • Outbound-only Resource Connectors and supported site-to-site tunnels allow private resources to connect without inbound exposure, with cloud or supported local enforcement under centralized policy.
  • Activity search, event logging, APIs, and MultiOrg administration give operators shared visibility and multi-organization control options across multi-region designs.
Cons

What to confirm before buying

  • Pricing is quote-only per covered user with a 50-user minimum on each selected billing SKU and a mandatory separate software-support SKU, so entry cost and renewal amounts are not self-service.
  • Browser-based SSH and RDP require Secure Private Access Advantage, and advanced private-traffic inspection, DLP, browser controls, Duo, DEM, and full SSE remain outside the core SPA entitlement or on separate packages.
  • Some private applications may still need VPNaaS rather than ZTNA, which changes traffic path, policy model, and migration design for those workloads.
  • Production rollout can require identity integration, certificates, client enrollment, connector capacity, DNS, routing, posture sources, and policy design before steady-state operation.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Least-privilege access8592887
Identity and device trust8384831
Application coverage7578763
User experience and performance80707210
Security and resilience8582843
Administration and integrations8283812
Support and total cost6054586
ztna private app access control8590865
ztna user device context8588826
ztna application onboarding manageability8076746
ztna user connectivity experience8080800
ztna visibility troubleshooting7574784
Where models differ
  • User experience and performance: 70–80 (10-point range)
  • Least-privilege access: 85–92 (7-point range)
  • Support and total cost: 54–60 (6-point range)
GeminiAI-assisted buyer perspective80

Cisco Secure Access Zero Trust Network Access provides per-session, identity-aware private application protection available via Essentials and Advantage tiers, requiring custom-quoted subscriptions with a 50-user minimum.

Review confidence
80/100
Model details
Strengths
  • Provides robust client-based access across Windows, macOS, Linux, iOS, Android, and ChromeOS, combined with clientless HTTP and HTTPS browser access in both packages.
  • Utilizes lightweight virtual resource connectors that establish outbound-only connections to prevent inbound public exposure of private assets.
  • Supports centralized, deny-by-default application policies backed by continuous endpoint posture checks to enforce per-session trust.
Cautions
  • Limits access to browser-based SSH and RDP protocols to the higher-tier Secure Private Access Advantage package.
  • Imposes a 50-covered-user minimum per selected billing SKU, raising the entry barrier for smaller deployments.
  • Requires purchasing a separate software-support SKU alongside the core subscription, increasing total cost of ownership complexity.
GPTAI-assisted buyer perspective79

Cisco Secure Access ZTNA fits organizations that want private-application access with identity-aware policy, device posture checks, and both client and browser access, but it is best evaluated where a 50-user minimum, quote-based pricing, and separate support SKU are acceptable.

Review confidence
79/100
Model details
Strengths
  • The product supports application-specific private access with deny-by-default policy, which fits least-privilege access to private applications.
  • The product includes clientless HTTP and HTTPS access in both SPA packages, which supports unmanaged-device or contractor access cases.
  • The product supports client-based ZTNA across Windows, macOS, Linux, iOS, Android, and ChromeOS scope, which broadens endpoint coverage for mixed fleets.
  • The product includes continuous endpoint posture checking and centralized policy administration, which can support ongoing access control decisions after enrollment.
Cautions
  • The commercial model is quote-based per covered user with a 50-user minimum and a separate required support SKU, which creates an entry threshold for smaller buyers.
  • Browser-based SSH and RDP are available only in Secure Private Access Advantage, which places some private-access workflows on the higher edition.
  • Some private applications may need VPNaaS rather than ZTNA, so application coverage must be checked before assuming every legacy workload fits the ZTNA path.
  • The public facts do not provide transparent self-service pricing or a published permanent free plan, which means buyers must validate commercial fit through quoting.
xAIAI-assisted buyer perspective79

Cisco Secure Access ZTNA fits mid-market and enterprise buyers moving from broad VPN to application-specific private access when they accept quote-based licensing at a 50-user minimum, a required separate support SKU, and Advantage for browser SSH/RDP, while keeping VPNaaS available for applications outside ZTNA scope.

Review confidence
79/100
Model details
Strengths
  • Deny-by-default, identity-aware, application-specific private access with per-session continuous endpoint posture checking supports least-privilege private-app policy for managed and unmanaged users.
  • Both Secure Private Access Essentials and Advantage include client-based ZTNA across documented Windows, macOS, Linux, iOS, Android, and ChromeOS scope plus clientless HTTP and HTTPS access.
  • Outbound-only Resource Connectors and supported site-to-site tunnels allow private resources to connect without inbound exposure, with cloud or supported local enforcement under centralized policy.
  • Activity search, event logging, APIs, and MultiOrg administration give operators shared visibility and multi-organization control options across multi-region designs.
Cautions
  • Pricing is quote-only per covered user with a 50-user minimum on each selected billing SKU and a mandatory separate software-support SKU, so entry cost and renewal amounts are not self-service.
  • Browser-based SSH and RDP require Secure Private Access Advantage, and advanced private-traffic inspection, DLP, browser controls, Duo, DEM, and full SSE remain outside the core SPA entitlement or on separate packages.
  • Some private applications may still need VPNaaS rather than ZTNA, which changes traffic path, policy model, and migration design for those workloads.
  • Production rollout can require identity integration, certificates, client enrollment, connector capacity, DNS, routing, posture sources, and policy design before steady-state operation.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
8
Broad product review sources
0
Marketplace and app-store sources
1
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free plan is published. Cisco documents a time-limited Secure Access free trial, but the public guide does not state a standard duration or universal eligibility. A separate Umbrella migration offer advertises a long-term Secure Private Access trial for up to 100 seats; neither trial is a pricing plan.
  • Quote-priced per-covered-user subscriptions for Secure Private Access Essentials and Secure Private Access Advantage, with tiered pricing by covered-user quantity and term, a 50-user minimum per selected billing SKU, and a required software-support SKU
  • Application-specific private access with deny-by-default, identity-aware policy Client-based ZTNA for Windows, macOS, Linux, iOS, Android, and ChromeOS scope documented by Cisco Clientless HTTP and HTTPS access in both SPA packages Browser-based SSH and RDP in Secure Private Access Advantage Per-session access with continuous endpoint posture checking Outbound-only Resource Connectors and supported site-to-site tunnel connectivity Cloud or supported local enforcement with centralized policy administration Activity search, event logging, APIs, MultiOrg administration, and multi-region design options
  • Requires quote
  • Secure Private Access Essentials and Secure Private Access Advantage are the two core ZTNA purchase packages. Both are licensed per covered user with a 50-user minimum, and Cisco Commerce calculates the quote from user count and term. Standard subscription term choices are 12, 36, and 60 months; annual and full-term prepaid billing choices are described, but they are not collapsed into one inferred commitment or payment state. Enhanced software support is required through a separate support SKU, with Premium available as an upgrade. Secure Internet Access combinations, User Protection Suite access, trials, add-ons, and attached Experience Insights are not additional SPA plans.
Verification notes and unresolved itemsCurrent June and July 2026 Cisco sources establish only Secure Private Access Essentials and Secure Private Access Advantage as core SPA offers.
  • No numeric amount, currency, renewal amount, implementation amount, or deterministic plan-bound payment state is retained.
  • Cisco publishes 12-, 36-, and 60-month term choices and annual or full-term prepaid billing options, but these are not converted into an inferred commitment for the generic quote offer.
  • The attached Experience Insights SKU, required support SKUs, optional add-ons, SIA combinations, User Protection Suite, trials, and AWS private-offer route are not duplicate plans.
  • ZTNA attribute values exclude VPNaaS, full SSE, Umbrella, Duo product scope, Secure Client outside Secure Access use, Multicloud Defense, RBI, enterprise-browser data controls, DEM, government and China packages, and services.
Sources checked

Sources checked

Cisco Secure Access Zero Trust Network Access source links

Cisco User Protection SuiteCiscoLevel A2Linked to 1 scored claimChecked Aug 12, 2026
Cisco Secure Access Free Trial Users GuideCiscoLevel A1Linked to 4 scored claimsChecked Aug 12, 2026
Cisco Secure Access Multi-Region Redundancy Design GuideCiscoLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Configure Secure Access with Catalyst SD-WAN Automated Tunnels for Secure Private AccessCiscoLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Secure-Access-Sub Ordering GuideCiscoLevel A1Linked to 5 scored claimsChecked Aug 12, 2026
Security Service Edge (SSE) Packages Comparison GuideCiscoLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Cisco Secure Access Data SheetCiscoLevel A2Linked to 1 scored claimChecked Aug 12, 2026
Cisco Secure AccessCiscoLevel A2Linked to 1 scored claimChecked Aug 12, 2026

FAQ

Cisco Secure Access Zero Trust Network Access FAQ

What are the current Cisco Secure Access ZTNA packages?

The current core purchase packages are Secure Private Access Essentials and Secure Private Access Advantage. Secure Internet Access packages and full SSE combinations are broader scope, not additional ZTNA plans.

Does Cisco publish a numeric price?

No public numeric SPA price is published. Cisco licenses per covered user, applies a 50-user minimum to each selected billing SKU, and calculates pricing dynamically from user count and term.

Is there a free plan or trial?

There is no published permanent free plan. Cisco documents a temporary Secure Access free trial without a standard public duration, and separately advertises a long-term SPA migration trial for eligible Umbrella customers up to 100 seats.

Does Essentials support clientless access?

Yes. Both SPA packages include clientless HTTP and HTTPS ZTNA. Browser-based SSH and RDP require Secure Private Access Advantage.

Is VPN-as-a-Service the same as Cisco ZTNA?

No. They are separate private-access methods within Secure Access. ZTNA grants application-specific access, while VPNaaS extends coverage to applications that are not supportable by ZTNA.

Is Cisco Secure Client a separate plan?

No. SPA packages provide the right to download Secure Client for use with Secure Access. Other uses, including on-premises ASA or FTD VPN, require separate Secure Client licensing.

Are Duo and Experience Insights core ZTNA functions?

No. Duo is a separate identity product with limited-use Cisco-app entitlements and native integration. Experience Insights is a separate zero-cost SKU automatically attached to SIA and SPA orders; its DEM results are not used to rate the ZTNA capability.

How do private resources connect without inbound exposure?

Cisco Resource Connectors are lightweight virtual appliances that make outbound-only connections to Secure Access. Site-to-site tunnels are another supported connection method for selected architectures.

Popular comparisons

Common Cisco Secure Access Zero Trust Network Access comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Cisco Secure Access Zero Trust Network AccessvsAkamai Enterprise Application Access
79Gap 277

Enterprise / Mid-market

VS #2
Cisco Secure Access Zero Trust Network AccessvsZscaler Private Access
79Gap 277

Enterprise / Mid-market

VS #3
Cisco Secure Access Zero Trust Network AccessvsFortinet FortiSASE ZTNA
79Gap 376

Enterprise / Mid-market