Global Tool Radar

Security & Privacy / Zero Trust Network Access (ZTNA) Software

Zscaler Private Access Review, Pricing, Pros & Cons

Zscaler Private Access is a cloud-delivered ZTNA service that brokers direct connections between authorized users and named private applications without placing users on the network. Current standalone packages cover managed-device access through Client Connector and browser-based access for unmanaged and third-party users, with advanced segmentation, inspection, isolation, resilience, and data controls packaged separately.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You need to replace broad network-level VPN access with per-application access: ZPA connects authorized users directly to named private applications without placing them on the corporate network or exposing applications to the public internet.
  • Your private applications span data centers, public clouds, and distributed workforces: Outbound App Connectors, globally distributed Service Edges, Client Connector, and browser access cover managed users, unmanaged devices, and third parties across hybrid environments.
More buying conditions
  • Identity, device posture, SIEM logging, and API automation are required: ZPA supports contextual access criteria, SAML and SCIM provisioning, Log Streaming Service integration, and role-scoped public APIs.
  • You need both managed-client and browser-based private access patterns: The current product supports Client Connector for managed endpoints and clientless browser access for contractors, BYOD, and privileged consoles, with separate package and add-on boundaries.
Not for
  • You require transparent self-service prices and simple month-to-month purchasing: The direct standalone packages have no public numeric price, billing schedule, commitment term, or implementation amount, and several advanced capabilities require separate entitlement.
  • You need more than 20 application segments without additional packaging: Both current standalone packages list 20 application segments, while Autonomous App Segmentation and unlimited segments are identified as advanced add-on scope.
More buying conditions
  • You cannot operate identity, connector, application-inventory, policy, logging, and resilience dependencies: A production deployment requires identity integration, App Connector placement and redundancy, application definitions or discovery, access policy, Client Connector or browser flows, and operational troubleshooting.
  • You expect advanced privileged access, isolation, inspection, data protection, or disaster recovery to be universally included: The current matrix and operations guides identify these capabilities as capped, optional, separately licensed, or separately sold depending on the package.
Pricing
  • Enterprise subscription sold through two current standalone ZPA packages, broader Zscaler platform bundles, and selected marketplace routes. Core direct package amounts are quote-based; optional segmentation, inspection, isolation, resilience, data, legacy-app, and guest-user entitlements can change total cost.
  • Paid amounts unverified — check official pricing
Free or trial access
  • No permanent free ZPA edition or publicly specified exact-product time-limited trial was verified.

Product scope

Product functionality and purchase scope

This profile evaluates the current general-market ZPA service and its two standalone packages: ZPA Clientless Platform and Zscaler Private Access Platform. It preserves the boundaries between core application access, shared Client Connector software, containing platform bundles, optional ZPA modules, adjacent standalone security products, and paid services.

Product checked: Aug 12, 2026

Functionality reviewed
  • ZPA Clientless Platform current standalone package
  • Zscaler Private Access Platform current standalone package
  • Direct user-to-application access through ZPA Service Edges and outbound App Connectors
  • Managed-device access through Zscaler Client Connector
  • Browser-based access and user portal for unmanaged and third-party users
  • Private applications in data centers, public clouds, and hybrid or multicloud environments
  • Identity, device posture, trusted-network, client-type, machine-group, SAML, and SCIM access criteria
  • Current plan limits, included capabilities, and explicitly identified add-ons in the ZPA package matrix
  • Current direct, platform-bundle, and AWS Marketplace acquisition routes at their exact published scope
Non-target functionality excluded from scoring
  • Zscaler Internet Access for public internet and SaaS traffic
  • Zscaler Zero Trust Exchange, Security Service Edge, and SASE as broader platform architectures rather than ZPA editions
  • Essentials Platform and Zscaler Platform as broader bundles rather than standalone ZPA plans
  • Government-specific ZPA Essentials, Business, and Transformation edition matrices outside the general commercial package scope
  • AWS Marketplace ZPA Transformation Edition as a presumed equivalent of either current direct standalone package
  • Zscaler Client Connector as a separately priced ZPA plan; it is a shared endpoint component governed by service entitlements
  • Zscaler Browser Isolation unless the required ZPA add-on is licensed
  • AppProtection, private-app data protection, Autonomous App Segmentation, legacy-app access, and Business Continuity Cloud unless separately entitled
  • Zscaler Privileged Remote Access Advanced, credential vaulting, cloud session recording, and uncapped system coverage beyond the included PRA Standard scope
  • Zscaler Deception Advanced or standalone Deception beyond the integrated minimum-qualified ZPA entitlement
  • ZDX Advanced and ZDX Advanced Plus beyond ZDX Standard included with Zscaler Private Access Platform
  • Zscaler Zero Trust Cloud or Workload Communications for workload-to-workload and workload-to-internet security
  • Zero Trust Branch, Device Segmentation, OT or IoT segmentation products, and Zero Trust SD-WAN
  • Professional, deployment, adoption, staff augmentation, managed, and premium support services unless separately purchased
Purchase paths

Pricing checked: Aug 12, 2026

  • Zscaler Essentials Platform: Broader platform bundle with ZPA Standard for one user per 20 subscribed users and a minimum of 500 subscribed users. It is limited private access within a wider internet, security, data, workload, experience, and support bundle.
  • Zscaler Platform: Broader SASE and SSE bundle that provides Private Access for all users alongside Secure Internet Access, inline web data security, and other standard platform services. It is not a standalone ZPA edition.
  • AWS Marketplace ZPA Transformation Edition: Current AWS Marketplace contract route for the exact ZPA service. The marketplace retains the Transformation Edition label, while the current general-market ZPA data sheet uses platform package names and does not publish an equivalence mapping.
    • $155000 USD · per contract · per year · AWS 12-month contract · one-year commitment

Pricing plans

Zscaler Private Access pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 97%1 linked source

The current direct package matrix names ZPA Clientless Platform and Zscaler Private Access Platform but publishes no currency amount, priced unit, payment schedule, commitment term, renewal term, or implementation fee. Essentials Platform and Zscaler Platform are broader containing bundles, not duplicate ZPA plans. AWS Marketplace publishes a separate 12-month ZPA Transformation Edition contract; its edition label is retained only for that route because no current official mapping to either direct platform package is published. The marketplace page does not state a minimum user quantity.

Official pricing page
Commercial scope needs confirmation

Current official sources describe an offer or purchase route differently. The page remains usable, but affected price schema is withheld until the scope is resolved.

  • The current general-market ZPA data sheet names ZPA Clientless Platform and Zscaler Private Access Platform, while the current AWS Marketplace route sells ZPA Transformation Edition. No official current mapping establishes that the marketplace edition is equivalent to either direct package, so the route remains separately scoped; the marketplace page also does not state a minimum user quantity.
PlanPriceKey differencesBest for
ZPA Clientless PlatformCurrent ZPA Clientless Platform standalone packageSupporting pricing evidenceAmount unverified — check official pricing
  • User-to-application segmentation limit: 20 application segments; Base standalone package before any differently scoped entitlement.
  • PRA Standard system limit: 10 systems; Clientless RDP, SSH, or VNC access under PRA Standard.
Organizations prioritizing browser-based private application and privileged-console access for unmanaged devices, contractors, vendors, and BYOD users without a full managed-endpoint ZPA deployment.
Zscaler Private Access PlatformCurrent Zscaler Private Access Platform standalone packageSupporting pricing evidenceAmount unverified — check official pricing
  • User-to-application segmentation limit: 20 application segments; Base package; Autonomous user-to-app segmentation is separately identified as an add-on.
  • PRA Standard system limit: 10 systems; Clientless RDP, SSH, or VNC access under PRA Standard.
  • Legacy-app access minimum: 50 subscribed users; VPN Service Edge add-on for VoIP, server-to-client, and other legacy applications.
  • Business Continuity Cloud minimum: 500 subscribed users; ZPA Business Continuity Cloud add-on.
  • Integrated deception minimum: 500 subscribed users; Integrated decoys to detect compromised users.
Organizations replacing VPN across managed users and private applications while retaining browser access and adding ZDX Standard, integrated deception at the stated minimum, and optional advanced segmentation, inspection, data protection, legacy access, and resilience.
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

AppProtection for OWASP Top 10 and private web traffic inspectionAdd-on

The exact package matrix marks AppProtection as an add-on for both standalone packages despite broader product-page inspection messaging.

Plan: ZPA Clientless Platform: Optional add-on · Zscaler Private Access Platform: Optional add-onZPA AppProtection
Official source
Browser Isolation for private and SaaS applicationsAdd-on

Browser Isolation is distinct from included browser-based access and is shown as an add-on for both standalone packages.

Plan: ZPA Clientless Platform: Optional add-on · Zscaler Private Access Platform: Optional add-onZscaler Browser Isolation
Official source
Business Continuity Cloud for private application accessAdd-on

The add-on has a published 500-user minimum, and disaster recovery can require further licensing and customer-side components.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: Optional add-onZPA Business Continuity Cloud
Official source
Essential, Support Plus, and Premium support packagesAdd-on

The advanced support levels are purchased for an additional fee and add 24x7 access, faster targets, and progressively more proactive engagement.

Plan: ZPA Clientless Platform: Optional add-on · Zscaler Private Access Platform: Optional add-onZscaler Support Services
Official source
Legacy VoIP and server-to-client application accessAdd-on

The VPN Service Edge add-on has a published minimum of 50 users.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: Optional add-onZPA for Legacy Apps
Official source
Base user-to-application segmentation for 20 application segmentsIncluded capability

Both current standalone packages include 20 application segments.

Plan: ZPA Clientless Platform: Included · Zscaler Private Access Platform: Included
Official source
Clientless PRA Standard for up to 10 RDP, SSH, or VNC systemsIncluded capability

The included scope is PRA Standard and capped at 10 systems. It must not be generalized to the separately licensed Advanced product.

Plan: ZPA Clientless Platform: Included · Zscaler Private Access Platform: IncludedZscaler Privileged Remote Access
Official source
Clientless browser access and authorized-app portalIncluded capability

Browser Access is the clientless access method. Additional guest-user licenses can be purchased through ZPA Clientless Platform for the broader ZPA Platform scope.

Plan: ZPA Clientless Platform: Included · Zscaler Private Access Platform: IncludedZPA Browser Access
Official source
Role-scoped public ZPA administration APIsIncluded capability

Public APIs use client credentials and granular API RBAC; access-policy operations are rate limited.

Official source
Standard Support during regional business hoursIncluded capability

Standard Support is included for all products and provides 8x5 access based on customer geography.

Plan: ZPA Clientless Platform: Included · Zscaler Private Access Platform: IncludedZscaler Standard Support
Official source
AI-assisted autonomous segmentation and unlimited application segmentsPlan-dependent capability

The current matrix marks autonomous segmentation as unavailable for Clientless and an add-on for ZPA Platform. The pricing page associates the advanced module with unlimited application segments and AI recommendations.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: Optional add-onZPA Autonomous App Segmentation
Official source
Integrated deception decoys for ZPA subscriptions of at least 500 usersPlan-dependent capability

The included ZPA Platform state is conditional on the published 500-user minimum and does not imply the full separately available Deception Advanced product.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: IncludedZscaler Deception
Official source
Managed-device access through Zscaler Client ConnectorPlan-dependent capability

Client Connector is the shared lightweight endpoint component used to forward managed-user traffic and can also carry ZIA, ZDX, and Deception entitlements. It is not a duplicate ZPA plan.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: IncludedZscaler Client Connector
Official source
Private-application data protection, incident response, and classificationPlan-dependent capability

The broader Zscaler Platform bundle includes this scope, but the standalone ZPA Platform marks it as an add-on and Clientless marks it unavailable.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: Optional add-onZscaler Data Security
Official source
ZDX Standard user, connectivity, and application telemetryPlan-dependent capability

The exact matrix includes ZDX Standard only with Zscaler Private Access Platform.

Plan: ZPA Clientless Platform: Unavailable · Zscaler Private Access Platform: IncludedZscaler Digital Experience Standard
Official source
Advanced digital experience monitoring and remediationSeparate product

ZDX Advanced and Advanced Plus are standalone-capable products and are not inferred from the included ZDX Standard entitlement.

Zscaler Digital Experience Advanced and Advanced Plus
Official source
Advanced privileged access with vaulting, monitoring, and cloud recordingSeparate product

Advanced is subscribed by number of systems and adds credential vaulting and injection, emergency access, session monitoring, and cloud session recording.

Zscaler Privileged Remote Access Advanced
Official source
Agentless device segmentation for branches, campuses, and factoriesSeparate product

Device Segmentation is explicitly available as a standalone product and is sized by endpoint count. It is not user-to-app ZPA segmentation.

Zscaler Device Segmentation
Official source
Deployment, adoption, and staff augmentation servicesSeparate product

These are separate expert-service engagements and must not be represented as included ZPA software capabilities or implementation amounts.

Zscaler Services
Official source
Workload-to-workload and workload-to-internet segmentationSeparate product

The ZPA product page mentions workload segmentation within the broader platform story, while current pricing presents Workload Communications as its own Standard, Advanced, and Advanced Plus product family.

Zscaler Zero Trust Cloud and Workload Communications
Official source
Log Streaming Service integration with customer SIEMThird-party integration

Production deployment should use dedicated App Connector groups and account for documented recovery limitations after connection loss.

Customer SIEM or log receiver
Official source
SAML and SCIM identity integrations with Microsoft, Okta, and PingThird-party integration

ZPA uses SAML for SSO and SCIM for provisioning through supported identity-provider integrations.

Microsoft Entra ID, Okta, and PingFederate
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
79%
AI claim confidence
98%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
95%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 9 A1 documentary official sources and 3 A2 official product sources are linked.
  • 4 independent review sources are retained, including 1 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • 1 non-blocking commercial scope issue requires confirmation.
Least-privilege access20%
84

Application-specific access instead of network placement, combined with role- and context-based controls and base user-to-application segmentation, supports least-privilege designs, constrained by the 20-segment base entitlement on both standalone packages.

Identity and device trust17%
87

SAML and SCIM identity integration plus device-posture and related client or machine criteria allow trust decisions to gate private-app sessions for both connector-based and browser-based users.

Application coverage15%
70

Standard private apps are covered, but supporting legacy workloads such as VoIP and server-to-client flows requires purchasing an optional VPN Service Edge add-on.

User experience and performance14%
75

Cloud-delivered brokering and ZDX Standard on qualified Private Access Platform subscriptions can inform experience monitoring for managed access paths, while Clientless Platform omits ZDX Standard and deeper performance outcomes still depend on connector and path design.

Security and resilience13%
78

The inside-out architecture prevents inbound attacks, but continuous disaster recovery operations under platform disruption require licensing the Business Continuity Cloud add-on.

Administration and integrations11%
80

Public APIs with granular RBAC, identity federation hooks, and Log Streaming Service support administrative integration with existing identity and SIEM stacks, with production logging and policy design remaining buyer-owned work.

Support and total cost10%
55

Total cost is harder to predict because core pricing is quote-based and advanced capabilities such as segmentation, inspection, isolation, resilience, legacy-app access, and privileged access are separated into additional entitlements; that structure gives flexibility but also makes budgeting less transparent.

Public review signals

Strong VPN-replacement feedback with recurring deployment and troubleshooting costs

Exact-product reviewers consistently value application-level access, always-on connectivity, VPN replacement, scalability, identity integration, and reduced network exposure. Recurring concerns center on initial segmentation and policy design, troubleshooting visibility, connector and identity complexity, occasional connectivity or latency issues, and enterprise pricing.

Public review signals updated: Aug 12, 2026

Commonly reported strengths

  • Granular access to private applications without broad network access
  • Seamless always-on user experience compared with traditional VPN
  • Cloud scale, identity integration, and centralized policy administration

Commonly reported concerns

  • Initial application inventory, segmentation, and policy design can be demanding
  • Troubleshooting can require navigating several policy, identity, client, and connector layers
  • Pricing and optional modules can be difficult to evaluate publicly
G24.4/5
Review count
135 reviews
Source context
Zscaler Private Access on G2Exact product
View sourceHistory baseline established: Aug 12, 2026
PeerSpot4.5/5
Review count
13 reviews
Source context
Zscaler Private Access (ZPA) on PeerSpotExact product
View sourceHistory baseline established: Aug 12, 2026
TrustRadius9.3/10
Reviews and ratings
163 reviews and ratings
Source context
Zscaler Private Access on TrustRadiusExact product
View sourceHistory baseline established: Aug 12, 2026

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

AWS Marketplace4.4/5
Rating count
149 ratings
Evaluated scope
Full product listing
Storefront
AWS Marketplace
View source

Independent editorial perspectives

Strong zero-trust access and scalability with a learning curve and opaque advanced-feature costs

TechRadar found ZPA strong for always-on private application access, application-level policy, visibility, scalability, and reduced lateral movement. Its pricing and edition references predate the current platform package matrix, so they are not used as current commercial evidence.

Professional reviews are shown separately from public user ratings and do not affect the Global Tool Radar score.

Editorial research updated: Aug 12, 2026

TechRadar ProExact product

Strong zero-trust access and scalability with a learning curve and opaque advanced-feature costs

TechRadar found ZPA strong for always-on private application access, application-level policy, visibility, scalability, and reduced lateral movement. Its pricing and edition references predate the current platform package matrix, so they are not used as current commercial evidence.

Review basis
hands on
Testing standard
independent hands on
Editorial independence
Verified policy
Published
Dec 13, 2024
Commercial disclosure
affiliate
Review details
  • Cloud-delivered access to specific private applications
  • Always-on connectivity and centralized application policy
  • Scalable zero-trust model that limits network exposure
  • Learning curve for teams migrating from conventional VPN
  • Advanced capabilities can increase cost
  • The review's three-edition ladder and marketplace price are stale relative to current Zscaler packaging
View source
Score77
Pricing modelEnterprise subscription sold through two current standalone ZPA packages, broader Zscaler platform bundles, and selected marketplace routes. Core direct package amounts are quote-based; optional segmentation, inspection, isolation, resilience, data, legacy-app, and guest-user entitlements can change total cost.
Use casereplace network-level VPN access with identity- and context-aware access to specific private applications
Company sizeEnterprise, Mid-market
Structured tags

Zscaler Private Access tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Zscaler Private Access core capabilities

  • Direct one-to-one connections between authorized users and named private applications
  • Inside-out App Connector architecture with no inbound application exposure
  • Role- and context-based access using identity, device posture, network, client, machine, SAML, and SCIM criteria
  • Managed endpoint access through Zscaler Client Connector
  • Browser-based clientless access and a unified user portal
  • User-to-application segmentation with 20 base application segments per current standalone package
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Brokers direct one-to-one connections from authorized users to named private applications without placing users on the broader network, using an inside-out App Connector model with no inbound application exposure.
  • Enforces role- and context-based policy with identity, device posture, network, client, machine, SAML, and SCIM criteria for both Client Connector managed endpoints and browser-based clientless access.
  • Provides a unified clientless user portal plus PRA Standard clientless RDP, SSH, or VNC access to up to 10 systems, which can support contractors, vendors, and BYOD without a full managed-endpoint rollout.
  • Exposes public APIs with granular role-based access control, application discovery, health monitoring, source IP anchoring, and Log Streaming Service for operational integration.
Cons

What to confirm before buying

  • Both current standalone packages include only 20 application segments in base scope, so denser segmentation requires a separately scoped autonomous or unlimited entitlement.
  • AppProtection, Browser Isolation, data protection, legacy-app access, Business Continuity Cloud, PRA Advanced, and higher ZDX or Deception modules are not universal base entitlements and change total cost.
  • Direct package amounts, billing, commitment, renewal, implementation fees, and most add-on pricing are quote-based with no published public starting price or permanent free edition.
  • Identity integration, App Connector redundancy, application inventory, policy migration, SIEM production design, and disaster-recovery testing can create substantial implementation and operating work.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Least-privilege access8088848
Identity and device trust8886872
Application coverage7073685
User experience and performance8072748
Security and resilience7880764
Administration and integrations8279803
Support and total cost6054528
ztna private app access control9092866
ztna user device context8586883
ztna application onboarding manageability7574723
ztna user connectivity experience8584823
ztna visibility troubleshooting80787010
Where models differ
  • ztna visibility troubleshooting: 70–80 (10-point range)
  • Least-privilege access: 80–88 (8-point range)
  • Support and total cost: 52–60 (8-point range)
GeminiAI-assisted buyer perspective79

Zscaler Private Access (ZPA) delivers broker-based connection security to named private applications without network exposure, though buyers must plan for quote-based pricing and additional licensing to scale segments, support legacy protocols, or secure business continuity.

Review confidence
79/100
Model details
Strengths
  • The inside-out App Connector architecture removes inbound application exposure, keeping internal resources hidden from unauthorized external network scans.
  • Diverse connection routes accommodate both managed endpoints via Zscaler Client Connector and unmanaged third-party users through clientless browser access.
  • Granular access policies dynamically evaluate context including SAML and SCIM identity metadata alongside physical device posture and client status.
Cautions
  • The base standalone packages restrict configuration to only 20 application segments, necessitating paid add-on entitlements to achieve automated or highly segmented deployments.
  • Legacy application protocols, including VoIP and server-to-client routing, are excluded from standard access and require an optional VPN Service Edge add-on with a 50-user minimum.
  • Disaster recovery and business continuity safeguards depend on an optional Business Continuity Cloud add-on carrying a 500-user subscription minimum.
GPTAI-assisted buyer perspective79

Zscaler Private Access fits buyers that want application-specific private access for managed users and browser-based access for unmanaged or third-party users, with selective add-ons for segmentation, privileged access, deception, resilience, and data controls. The main tradeoff is that the current standalone packages are quote-based, base segments are capped at 20, and several advanced capabilities are packaged separately, so buyers should confirm the exact entitlement mix before using it as a replacement for VPN or broader zero-trust access needs.

Review confidence
79/100
Model details
Strengths
  • It provides direct one-to-one connections between authorized users and named private applications without placing users on the network.
  • It supports both managed-endpoint access through Zscaler Client Connector and browser-based clientless access for unmanaged and third-party users.
  • It enforces role- and context-based access using identity, device posture, network, client, machine, SAML, and SCIM criteria.
  • It includes application discovery, health monitoring, source IP anchoring, and Log Streaming Service for operational visibility.
Cautions
  • The current standalone base packages are quote-based and do not publish a public price, billing schedule, or commitment term.
  • Both current standalone base packages list 20 application segments, so buyers that need broader segmentation need an additional entitlement.
  • Advanced inspection, isolation, data protection, autonomous segmentation, resilience, legacy-app access, and privileged access are not universal base entitlements.
  • The AWS Marketplace Transformation Edition route is a separate contract path and is not mapped to the current direct platform packages.
xAIAI-assisted buyer perspective77

Zscaler Private Access fits enterprises replacing VPN with application-specific private access for managed and clientless users, provided the buyer accepts quote-based packaging, a 20-segment base limit, and selective licensing of advanced segmentation, inspection, isolation, resilience, and privileged features.

Review confidence
77/100
Model details
Strengths
  • Brokers direct one-to-one connections from authorized users to named private applications without placing users on the broader network, using an inside-out App Connector model with no inbound application exposure.
  • Enforces role- and context-based policy with identity, device posture, network, client, machine, SAML, and SCIM criteria for both Client Connector managed endpoints and browser-based clientless access.
  • Provides a unified clientless user portal plus PRA Standard clientless RDP, SSH, or VNC access to up to 10 systems, which can support contractors, vendors, and BYOD without a full managed-endpoint rollout.
  • Exposes public APIs with granular role-based access control, application discovery, health monitoring, source IP anchoring, and Log Streaming Service for operational integration.
Cautions
  • Both current standalone packages include only 20 application segments in base scope, so denser segmentation requires a separately scoped autonomous or unlimited entitlement.
  • AppProtection, Browser Isolation, data protection, legacy-app access, Business Continuity Cloud, PRA Advanced, and higher ZDX or Deception modules are not universal base entitlements and change total cost.
  • Direct package amounts, billing, commitment, renewal, implementation fees, and most add-on pricing are quote-based with no published public starting price or permanent free edition.
  • Identity integration, App Connector redundancy, application inventory, policy migration, SIEM production design, and disaster-recovery testing can create substantial implementation and operating work.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
12
Broad product review sources
3
Marketplace and app-store sources
1
Editorial sources
1
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

Unresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.

View research methodology
Verified findingsDirect one-to-one connections between authorized users and named private applications Inside-out App Connector architecture with no inbound application exposure Role- and context-based access using identity, device posture, network, client, machine, SAML, and SCIM criteria Managed endpoint access through Zscaler Client Connector Browser-based clientless access and a unified user portal User-to-application segmentation with 20 base application segments per current standalone package Application discovery, health monitoring, source IP anchoring, and Log Streaming Service Public APIs with granular role-based access control Optional autonomous segmentation, AppProtection, Browser Isolation, data protection, legacy-app access, and Business Continuity Cloud ZDX Standard and integrated deception in the qualified Zscaler Private Access Platform scope
  • No permanent free ZPA edition or publicly specified exact-product time-limited trial was verified.
  • Enterprise subscription sold through two current standalone ZPA packages, broader Zscaler platform bundles, and selected marketplace routes. Core direct package amounts are quote-based; optional segmentation, inspection, isolation, resilience, data, legacy-app, and guest-user entitlements can change total cost.
  • No current public numeric starting price is published for ZPA Clientless Platform or Zscaler Private Access Platform.
  • The current direct package matrix names ZPA Clientless Platform and Zscaler Private Access Platform but publishes no currency amount, priced unit, payment schedule, commitment term, renewal term, or implementation fee. Essentials Platform and Zscaler Platform are broader containing bundles, not duplicate ZPA plans. AWS Marketplace publishes a separate 12-month ZPA Transformation Edition contract; its edition label is retained only for that route because no current official mapping to either direct platform package is published. The marketplace page does not state a minimum user quantity.
Verification notes and unresolved itemsThe current general-market ZPA data sheet names ZPA Clientless Platform and Zscaler Private Access Platform, while the current AWS Marketplace route sells ZPA Transformation Edition. No official current mapping establishes that the marketplace edition is equivalent to either direct package, so the route remains separately scoped; the marketplace page also does not state a minimum user quantity.
  • Verified against current public sources on 2026-08-12.
  • The current general-market ZPA matrix controls the retained direct packages: ZPA Clientless Platform and Zscaler Private Access Platform.
  • Direct numeric amount, priced unit, payment timing, commitment term, renewal term, implementation fee, and exact add-on amounts are not publicly established, so direct plan offer arrays are empty.
  • Essentials Platform and Zscaler Platform are retained only as broader related purchase paths.
Sources checked

Sources checked

Zscaler Private Access source links

Zscaler Private Access (ZPA)Amazon Web Services MarketplaceLevel A2Linked to 4 scored claimsChecked Aug 12, 2026
Zscaler ServicesZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
Support OfferingsZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
Disaster Recovery Deployment and Operations GuideZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
About API Key ManagementZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
SIEM and ZPA Integration Deployment and Operations GuideZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
User Provisioning and Authentication Deployment and Operations GuideZscaler, Inc.Level A1Linked to 1 scored claimChecked Aug 12, 2026
About Access PolicyZscaler, Inc.Level A1Linked to 0 scored claimsChecked Aug 12, 2026

FAQ

Zscaler Private Access FAQ

What are the current standalone ZPA packages?

The current general-market ZPA data sheet names ZPA Clientless Platform and Zscaler Private Access Platform. Essentials Platform and Zscaler Platform are broader containing bundles, not standalone ZPA editions.

Are ZPA Essentials, Business, and Transformation still the current general-market edition ladder?

The current general-market data sheet uses platform package names instead. Government material and the AWS Marketplace route still use edition labels, so those scopes should not be merged without an order-specific mapping.

Does ZPA require Zscaler Client Connector?

Managed endpoints commonly use the shared Zscaler Client Connector, but ZPA also provides browser-based clientless access for unmanaged devices and third parties. Client Connector is a foundational component, not a separate ZPA pricing plan.

Is Browser Access the same as Browser Isolation?

No. Browser Access provides clientless access and a user portal. Browser Isolation renders private or SaaS application sessions in an isolated environment and is shown as an add-on for both current standalone packages.

Is Privileged Remote Access included?

The current ZPA matrix includes PRA Standard for clientless RDP, SSH, or VNC access to up to 10 systems within the clientless access scope. PRA Advanced adds capabilities such as credential vaulting, monitoring, and cloud recording and is priced separately by systems.

Are deception and Digital Experience included with ZPA?

Zscaler Private Access Platform includes ZDX Standard and integrated Zscaler Deception for subscriptions meeting the stated 500-user minimum. ZPA Clientless Platform includes neither. ZDX Advanced, ZDX Advanced Plus, and standalone or Advanced Deception remain separate products or modules.

Does ZPA include unlimited segmentation?

Both current standalone packages list 20 application segments. Autonomous user-to-app segmentation and unlimited application segments are presented as advanced add-on scope for the full Private Access route, not a base entitlement.

Is workload-to-workload segmentation part of the base ZPA user-access package?

No automatic inclusion should be assumed. Zscaler markets workload communication and segmentation through Zero Trust Cloud and Workload Communications packages, which are separate from the two standalone user-access packages evaluated here.

Popular comparisons

Common Zscaler Private Access comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Zscaler Private AccessvsAkamai Enterprise Application Access
77Gap 077

Enterprise / Mid-market

VS #2
Zscaler Private AccessvsFortinet FortiSASE ZTNA
77Gap 176

Enterprise / Mid-market

VS #3
Zscaler Private AccessvsCisco Secure Access Zero Trust Network Access
77Gap 279

Enterprise / Mid-market