Global Tool Radar

Security & Privacy / Zero Trust Network Access (ZTNA) Software

Palo Alto Networks Prisma Access Review, Pricing, Pros & Cons

Palo Alto Networks Prisma Access is a cloud-delivered secure access service edge platform that applies least-privilege access, continuous trust verification, and ongoing security inspection to private, internet, and SaaS application traffic.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You need a cloud-delivered ZTNA service for mobile users and branch users across private applications: Prisma Access supports GlobalProtect, Explicit Proxy, service connections, ZTNA Connector, and multiple private-app connectivity patterns.
  • You require application- and sub-application-level least privilege with continuous post-connect evaluation: Palo Alto Networks documents App-ID-based control and continuing evaluation of device posture, user behavior, and application behavior.
More buying conditions
  • You operate a complex multicloud or overlapping-address private application estate: ZTNA Connector supports AWS, Google Cloud, Azure, ESXi, and KVM deployments and can address applications in overlapping private networks.
Not for
  • You require transparent self-service pricing and a publicly stated short commitment: Palo Alto Networks does not publish numeric edition pricing, billing cadence, minimum quantity, or commitment duration for Prisma Access.
  • Your private applications require dynamic ports and you plan to use only ZTNA Connector: The current support matrix marks dynamic-port applications such as FTP active mode and VoIP unsupported by ZTNA Connector, although service connections support them.
More buying conditions
  • You expect secure enterprise browser, full digital experience management, DLP, or CASB services to be automatically included in every edition: Palo Alto Networks documents separate, bundled, add-on, or license-dependent treatment for Prisma Browser, ADEM, Enterprise DLP, and SaaS Security.
Pricing
  • Sales-assisted enterprise subscription with Secure Web Gateway, ZTNA, and Enterprise editions; mobile users are licensed by user and remote networks use bandwidth units
  • Secure Web Gateway · Requires quote · custom quote · Contact Palo Alto Networks for Secure Web Gateway edition pricing and terms.
Free or trial access
  • No permanent free plan or time-limited free trial is publicly stated. Palo Alto Networks promotes an Ultimate Test Drive evaluation experience, which is not a pricing plan.

Product scope

Product functionality and purchase scope

This profile evaluates the current Prisma Access cloud-delivered security product with emphasis on its ZTNA 2.0 private-application access capabilities and current Secure Web Gateway, ZTNA, and Enterprise license editions. ZTNA 2.0 is the capability framework, not a separate plan. Prisma Access 3.0 was a historical software release name and is not a current ZTNA 3.0 offer.

Product checked: Aug 12, 2026

Functionality reviewed
  • Prisma Access Secure Web Gateway edition
  • Prisma Access ZTNA edition
  • Prisma Access Enterprise edition
  • ZTNA 2.0 least-privilege access, continuous trust verification, and ongoing security inspection
  • Base ZTNA Connector entitlement for ZTNA and Enterprise editions
  • Mobile-user access through GlobalProtect or Explicit Proxy and current base agentless private-web access
Non-target functionality excluded from scoring
  • Prisma Access 3.0 as a historical software release and any unsupported ZTNA 3.0 product naming
  • Prisma SASE platform bundles and Prisma SD-WAN
  • Private App Access capacity beyond the base ZTNA Connector entitlement
  • Prisma Browser standalone or bundle licensing
  • Standalone GlobalProtect subscriptions and on-premises GlobalProtect gateways
  • Autonomous Digital Experience Management, Enterprise DLP, SaaS Security Inline, Next-Generation CASB, Remote Browser Isolation, and other add-ons or separate services
  • Professional, implementation, migration, training, managed, and support services

Pricing plans

Palo Alto Networks Prisma Access pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 95%2 linked sources

Palo Alto Networks publishes three current Prisma Access license editions but no public numeric amounts. Edition pricing, currency, billing cadence, payment timing, commitment duration, minimum purchase, and add-on pricing require sales confirmation. Mobile-user units represent users; remote-network units represent 1 Mbps, but those unit definitions do not establish a public rate.

Official pricing page
PlanPriceKey differencesBest for
Secure Web GatewayPrisma Access Secure Web Gateway editionSupporting pricing evidence
  • Requires quote · custom quote · Contact Palo Alto Networks for Secure Web Gateway edition pricing and terms.
  • Secure internet access: Web and internet traffic protection; This is the secure-internet edition in the current Prisma Access license model.
Organizations primarily securing user access to the public internet and web applications without the private-app scope of the ZTNA edition.
ZTNAPrisma Access ZTNA editionSupporting pricing evidence
  • Requires quote · custom quote · Contact Palo Alto Networks for ZTNA edition pricing and terms.
  • Secure private application access: Private-application access with least-privilege policy; This is the secure-private-apps edition in the current Prisma Access license model.
  • Included ZTNA Connectors: 10 connectors; Base entitlement; additional capacity is available through Private App Access.
Enterprises that need least-privilege access to private applications for mobile users and branches, with base ZTNA Connector capacity.
EnterprisePrisma Access Enterprise editionSupporting pricing evidence
  • Requires quote · custom quote · Contact Palo Alto Networks for Enterprise edition pricing and terms.
  • Secure all application traffic: Internet, SaaS, and private application scope; This is the secure-all-apps edition in the current Prisma Access license model.
  • Included ZTNA Connectors: 10 connectors; Base entitlement; additional capacity is available through Private App Access.
Enterprises that want the broadest Prisma Access edition for internet, SaaS, and private applications under one policy and management platform.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Secure Web Gateway ZTNA

The buyer needs access to private applications rather than secure internet access alone.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

AI-powered digital experience monitoring and remediationAdd-on

AI-Powered ADEM is explicitly documented as a Prisma Access add-on license.

Autonomous Digital Experience Management
Official source
Agentless RDP, SSH, and VNC private application accessAdd-on

Current documentation states that RDP, SSH, and VNC application types still require the existing add-on license.

Plan: Secure Web Gateway: Unavailable · ZTNA: Optional add-on · Enterprise: Optional add-onSecure Agentless Access add-on
Official source
Enterprise data loss prevention across Prisma Access trafficAdd-on

Enterprise DLP is listed under Prisma Access add-on licenses; no add-on amount is public.

Enterprise DLP
Official source
Expanded ZTNA Connector capacity up to 200 connectorsAdd-on

Private App Access is an add-on entitlement, not a fourth core Prisma Access edition.

Plan: Secure Web Gateway: Unavailable · ZTNA: Optional add-on · Enterprise: Optional add-onPrivate App Access
Official source
Inline SaaS visibility and controlAdd-on

SaaS Security Inline is built into the management experience but requires an add-on license.

SaaS Security Inline
Official source
Agentless Explicit Proxy connection modeIncluded capability

Explicit Proxy does not require the GlobalProtect app and can reach private resources through supported private-app connectivity methods.

Official source
ZTNA 2.0 least-privilege and continuous-verification frameworkIncluded capability

ZTNA 2.0 is Palo Alto Networks capability branding for Prisma Access, not a separate edition and not Prisma Access software release 2.0.

Official source
Directory synchronization for user and group policyNative integration

Cloud Identity Engine provides read-only directory access for policy and is documented as free to start.

Cloud Identity Engine
Official source
GlobalProtect client access for Prisma Access mobile usersNative integration

A Prisma Access mobile-user license supports GlobalProtect, Explicit Proxy, or both. The endpoint app is a connection method, not a plan.

GlobalProtect app
Official source
Agentless HTTP and HTTPS private application accessPlan-dependent capability

Palo Alto Networks renamed PRA to Secure Agentless Access in May 2026 and included private web apps in ZTNA and Enterprise base licensing.

Plan: Secure Web Gateway: Unavailable · ZTNA: Included · Enterprise: IncludedSecure Agentless Access
Official source
Base ZTNA Connector capacity for private applicationsPlan-dependent capability

The base ZTNA and Enterprise license includes 10 connectors; the current entitlement statement excludes Secure Web Gateway.

Plan: Secure Web Gateway: Unavailable · ZTNA: Included · Enterprise: IncludedZTNA Connector
Official source
Centralized Prisma Access log storageSeparate product

Strata Logging Service is a required license and must be deployed in the same region as Prisma Access.

Strata Logging Service
Official source
Next-Generation CASB through separately licensed SaaS and data-security servicesSeparate product

NG-CASB is an integrated SASE service family rather than a fourth Prisma Access core edition; exact component licensing must be quoted.

Next-Generation CASB
Official source
Secure enterprise browser for managed and unmanaged devicesSeparate product

Prisma Browser has standalone and Prisma Access bundle licensing and appears as a related product, not a core Prisma Access edition.

Prisma Browser
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
82%
AI claim confidence
97%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
94%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 8 A1 documentary official sources and 2 A2 official product sources are linked.
  • 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Least-privilege access20%
89

Application- and sub-application-level App-ID policy with continuous verification delivers least-privilege private access instead of broad network reach, which is the core control model buyers evaluate on the ZTNA and Enterprise editions.

Identity and device trust17%
81

Provides continuous, post-access trust verification, which relies on configuring external identity platforms and endpoint agents for context monitoring.

Application coverage15%
79

Private-application coverage includes client-initiated traffic on all ports and protocols, multi-cloud and data-center reach, and agentless private HTTP/HTTPS on ZTNA and Enterprise, while Secure Web Gateway stays internet-focused and dynamic-port apps still need service connections.

User experience and performance14%
74

Nearest-location discovery and automated tunnel management support user connectivity design, but the facts do not provide measured latency, throughput, or guaranteed performance outcomes for end users.

Security and resilience13%
84

Least-privilege admission combined with continuous trust verification and ongoing security inspection keeps inspection active after access is granted, supporting resilient private-app and broader traffic control on the applicable editions.

Administration and integrations11%
74

Features unified administration within the Palo Alto Networks platform, but mandates licensing Strata Cloud Manager or Panorama to manage the environment.

Support and total cost10%
55

Involves complex deployment architecture and lacks transparent pricing, requiring custom sales quotes and multiple mandatory software add-ons to operate.

Public review signals

Prisma Access is rated 4. 6/10 on TrustRadius

3/5 from 72 reviews, and TrustRadius displays 8. 6/10 from 55 reviews and ratings for the exact Prisma Access product.

Public review signals updated: Aug 12, 2026

Commonly reported strengths

  • Reviewers commonly praise consistent cloud-delivered security, centralized policy management, and integration with the wider Palo Alto Networks ecosystem.
  • Reviewers commonly report useful global reach, secure remote access, stable connectivity, and strong threat-prevention controls.

Commonly reported concerns

  • Reviewers commonly report complex initial deployment, policy design, troubleshooting, and a substantial administrator learning curve.
  • Reviewers commonly cite high cost, licensing and capacity-planning complexity, and operational effort across multiple components.
TrustRadius8.6/10
Reviews and ratings
55 reviews and ratings
Source context
Palo Alto Networks Prisma Access on TrustRadiusExact product
View sourceHistory baseline established: Aug 12, 2026

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

Apple App Store4.4/5
Rating count
2.7k ratings
Evaluated scope
Mobile app
Storefront
United States
View source
Google Play2.5/5
Review count
5.4k reviews
Evaluated scope
Mobile app
Storefront
United States
View source
Score78
Pricing modelSales-assisted enterprise subscription with Secure Web Gateway, ZTNA, and Enterprise editions; mobile users are licensed by user and remote networks use bandwidth units
Use caseenterprise zero trust network access software
Company sizeEnterprise
Structured tags

Palo Alto Networks Prisma Access tag profile

Company size
  • Enterprise
Key features

Palo Alto Networks Prisma Access core capabilities

  • Application- and sub-application-level least-privilege access using App-ID
  • Continuous monitoring of device posture, user behavior, and application behavior
  • ZTNA Connector automated tunnel management, nearest-location discovery, and private-app onboarding
  • Private application access for all ports and protocols for client-initiated traffic
  • Mobile-user access through GlobalProtect or Explicit Proxy
  • Base secure agentless access for private HTTP and HTTPS applications in ZTNA and Enterprise
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • App-ID enables application- and sub-application-level least-privilege policy for private applications rather than network-wide access.
  • ZTNA Connector provides automated tunnel management, nearest-location discovery, and private-app onboarding for client-initiated traffic across all ports and protocols.
  • Continuous monitoring of device posture, user behavior, and application behavior supports ongoing trust checks after access is granted.
  • Mobile users can connect through GlobalProtect or Explicit Proxy, with base secure agentless access to private HTTP and HTTPS applications on ZTNA and Enterprise editions.
Cons

What to confirm before buying

  • Every current edition is sales-assisted with no public numeric rates, commitment terms, or minimums, so total cost requires a formal quote.
  • ZTNA and Enterprise base licenses include only 10 ZTNA Connectors
  • larger connector estates need the Private App Access add-on.
  • ZTNA Connector does not support dynamic-port applications such as FTP active mode or VoIP, so those cases still need service connections.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGPTGeminixAIRange
Least-privilege access9285907
Identity and device trust8480804
Application coverage86757711
User experience and performance72807010
Security and resilience8385842
Administration and integrations7675724
Support and total cost5855526
ztna private app access control9085885
ztna user device context8280822
ztna application onboarding manageability7875783
ztna user connectivity experience7480746
ztna visibility troubleshooting8075765
Where models differ
  • Application coverage: 75–86 (11-point range)
  • User experience and performance: 70–80 (10-point range)
  • Least-privilege access: 85–92 (7-point range)
GPTAI-assisted buyer perspective80

Prisma Access fits enterprises that want cloud-delivered ZTNA across private applications, internet traffic, and SaaS under a single policy model, but buyers should confirm edition scope, connector capacity, logging dependencies, and sales-quoted commercial terms before committing.

Review confidence
80/100
Model details
Strengths
  • The ZTNA edition supports private application access with least-privilege policy, and the Enterprise edition extends scope to internet, SaaS, and private applications under one edition boundary.
  • The platform supports continuous monitoring of device posture, user behavior, and application behavior after access is granted, which can support ongoing trust evaluation for higher-risk access scenarios.
  • ZTNA Connector automation includes tunnel management, nearest-location discovery, and private-app onboarding, which can reduce manual setup for distributed private-app deployments.
  • Mobile-user access can use GlobalProtect or Explicit Proxy, giving buyers more than one endpoint access method within the Prisma Access model.
Cautions
  • Base ZTNA and Enterprise entitlement includes 10 ZTNA Connectors, so larger private-app estates need Private App Access for more connector capacity.
  • All current editions require sales-assisted pricing, so buyers do not get public rates, public commitment terms, or online checkout.
  • Strata Logging Service is required, and Strata Cloud Manager or Panorama requirements add operating and licensing dependencies that procurement should verify early.
  • ZTNA Connector does not support dynamic-port private applications such as FTP active mode or VoIP, so those workflows still need service connections.
GeminiAI-assisted buyer perspective78

This cloud-delivered ZTNA platform is a highly secure, application-aware access solution best suited for large enterprises that require continuous post-access threat inspection and sub-application control, though it demands a highly technical multi-component deployment and lacks transparent pricing.

Review confidence
78/100
Model details
Strengths
  • Enables granular, sub-application-level least-privilege access policies using native App-ID capabilities.
  • Ensures continuous security post-access by monitoring device posture, user behavior, and application behavior in real time.
  • Offers flexible connection options for users via GlobalProtect endpoints, Explicit Proxy, or agentless private HTTP/HTTPS access.
Cautions
  • Relies on mandatory licensing and operational dependencies, requiring both Strata Logging Service and a management console like Strata Cloud Manager or Panorama.
  • Restricts base ZTNA and Enterprise plans to 10 ZTNA Connectors, requiring a paid Private App Access add-on to scale up to 200 connectors.
  • Standard ZTNA Connectors do not support dynamic-port applications like active FTP or VoIP, making separate service connections necessary for those use cases.
xAIAI-assisted buyer perspective77

Prisma Access fits large enterprises replacing VPN with App-ID least-privilege private-app access on the ZTNA or Enterprise edition when they can operate sales-quoted licensing, a 10-connector base, and Strata logging or management dependencies.

Review confidence
77/100
Model details
Strengths
  • App-ID enables application- and sub-application-level least-privilege policy for private applications rather than network-wide access.
  • ZTNA Connector provides automated tunnel management, nearest-location discovery, and private-app onboarding for client-initiated traffic across all ports and protocols.
  • Continuous monitoring of device posture, user behavior, and application behavior supports ongoing trust checks after access is granted.
  • Mobile users can connect through GlobalProtect or Explicit Proxy, with base secure agentless access to private HTTP and HTTPS applications on ZTNA and Enterprise editions.
Cautions
  • Every current edition is sales-assisted with no public numeric rates, commitment terms, or minimums, so total cost requires a formal quote.
  • ZTNA and Enterprise base licenses include only 10 ZTNA Connectors
  • larger connector estates need the Private App Access add-on.
  • ZTNA Connector does not support dynamic-port applications such as FTP active mode or VoIP, so those cases still need service connections.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
10
Broad product review sources
1
Marketplace and app-store sources
2
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free plan or time-limited free trial is publicly stated. Palo Alto Networks promotes an Ultimate Test Drive evaluation experience, which is not a pricing plan.
  • Sales-assisted enterprise subscription with Secure Web Gateway, ZTNA, and Enterprise editions; mobile users are licensed by user and remote networks use bandwidth units
  • Application- and sub-application-level least-privilege access using App-ID Continuous monitoring of device posture, user behavior, and application behavior ZTNA Connector automated tunnel management, nearest-location discovery, and private-app onboarding Private application access for all ports and protocols for client-initiated traffic Mobile-user access through GlobalProtect or Explicit Proxy Base secure agentless access for private HTTP and HTTPS applications in ZTNA and Enterprise Centralized policy, logging, reporting, and management through the Palo Alto Networks platform
  • Requires quote
  • Palo Alto Networks publishes three current Prisma Access license editions but no public numeric amounts. Edition pricing, currency, billing cadence, payment timing, commitment duration, minimum purchase, and add-on pricing require sales confirmation. Mobile-user units represent users; remote-network units represent 1 Mbps, but those unit definitions do not establish a public rate.
Verification notes and unresolved itemsThe official licensing page establishes three current editions but publishes no numeric amount, currency, billing cadence, payment schedule, commitment duration, or minimum quantity.
  • Requires quote is retained because the exact-product page routes buyers to a Prisma Access expert contact form and exposes no self-service purchase state.
  • The licensing-guide landing page did not expose its full comparison matrix in captured text, so edition names and boundaries were cross-checked against current product documentation.
  • ZTNA 2.0 is current Palo Alto Networks capability branding
  • Prisma Access 3.0 is an older release identifier, and no current official ZTNA 3.0 product or edition was found.
Sources checked

Sources checked

Palo Alto Networks Prisma Access source links

Secure Access Service EdgePalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Account Protection for the Prisma BrowserPalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Onboarding Workflow for Prisma Access ZTNA ConnectorPalo Alto NetworksLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Access Your Data Center Using Explicit ProxyPalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Prisma Access Addressed IssuesPalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
All Available Apps and ServicesPalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Prisma Access ZTNA ConnectorPalo Alto NetworksLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Your Prisma Access LicensePalo Alto NetworksLevel A1Linked to 2 scored claimsChecked Aug 12, 2026

FAQ

Palo Alto Networks Prisma Access FAQ

Is Prisma Access ZTNA 2.0 a separate product or plan?

No. Palo Alto Networks uses ZTNA 2.0 for the least-privilege, continuous-verification, and ongoing-inspection capability model delivered by Prisma Access. The current Prisma Access editions are Secure Web Gateway, ZTNA, and Enterprise.

Is there a current Prisma Access ZTNA 3.0 edition?

No current official ZTNA 3.0 edition was identified. Prisma Access 3.0 was an older software release name; current product marketing still names the access model ZTNA 2.0.

Which current editions support private applications?

Palo Alto Networks describes ZTNA as the secure-private-apps edition and Enterprise as the secure-all-apps edition. Base ZTNA Connector and private-web agentless access entitlements are documented for ZTNA and Enterprise.

Is Private App Access a separate Prisma Access plan?

No. It is an add-on capacity entitlement. The ZTNA and Enterprise base license includes 10 ZTNA Connectors, while Private App Access provides up to 200 connectors.

Is GlobalProtect the same product as Prisma Access?

No. GlobalProtect is a first-party endpoint connection method used by Prisma Access mobile-user deployments. A mobile-user license can support GlobalProtect, Explicit Proxy, or both; GlobalProtect is not a Prisma Access edition.

Is Prisma Browser included?

Do not assume so. Palo Alto Networks documents Prisma Browser standalone and Prisma Access bundle licenses. Prisma Browser is a related secure-browser product, not one of the three core Prisma Access editions.

Are ADEM, Enterprise DLP, SaaS Security, and NG-CASB core ZTNA plans?

No. ADEM, Enterprise DLP, and SaaS Security Inline are documented as add-on or license-dependent services. Next-Generation CASB spans separate SaaS Security and data-security capabilities and must not be treated as a duplicate ZTNA plan.

Does Palo Alto Networks publish Prisma Access pricing?

No public numeric edition amounts were verified. Buyers must obtain edition, user, bandwidth, add-on, support, and contract terms through Palo Alto Networks or an authorized channel.

Popular comparisons

Common Palo Alto Networks Prisma Access comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Palo Alto Networks Prisma AccessvsMicrosoft Entra Private Access
78Gap 280

Enterprise

VS #2
Palo Alto Networks Prisma AccessvsChrome Enterprise Premium
78Gap 474

Enterprise

VS #3
Palo Alto Networks Prisma AccessvsNetskope One Private Access
78Gap 177

Enterprise