Cloudflare Access vs Fortra ZTNA

Cloudflare Access controls access to self-hosted apps, SaaS applications, and infrastructure by checking identity, device posture, and other context on each request. Policies can grant access at the individual resource level, and applications deny access unless a user matches an Allow policy. It supports SAML- and OIDC-compliant identity providers, including enterprise and social providers, as well as Cloudflare as an identity provider. Contractors, partners, and people using unmanaged devices can connect through a browser with social sign-in or a one-time PIN. Access can replace or supplement a legacy VPN by limiting access to specific applications, and its controls also cover infrastructure such as SSH and RDP. Administrators can manage policies centrally and scale them through APIs and Terraform. Publishing a self-hosted public application requires an active Cloudflare domain with full or partial CNAME setup. The free plan is for fewer than 50 users; paid service starts at $7/user/mo (annual).

Fortra ZTNA provides secure remote access to private applications and helps protect their data. It makes access decisions using user, device, and data context, so authorized people can reach only approved applications. An endpoint client monitors device posture and reports changes for access adjustments. The product can hide applications from the network, monitor traffic for lateral movement, and discover private applications to help organizations onboard them from an existing VPN. Private applications may be hosted in AWS, Azure, or GCP. Agent-based access supports browser and thick-client applications, while web applications can be accessed without an agent. Additional protections include digital rights management and data loss prevention policies, as well as inspection and blocking of files identified as infected with malware. Fortra describes a unified proxy architecture shared across its ZTNA, secure web gateway, and CASB offerings, with shared policies and monitoring. The product supports hybrid deployment and lists web as its supported platform. It is paid, has no free plan, and pricing is available on request.