Provisional editorial research based on public documentation, not tested effectiveness.
First edition · Reviewed · Rubric 1.1
Six dimensions, each scored 0.0–5.0 in tenths. Gaps stay visible.
Selected commercial configurations providing both outbound web policy and private application access for managed remote users. Required SWG/private-access modules, clients and connectors are explicit. No score credit for SD-WAN, branch hardware, backbone size, optional CASB API scanning, DLP, RBI or managed services.
Each row is one 0.0–5.0 dimension. Every assessed offering has a consistent color, shape, and number. Numbers identify offerings, not rank. Unknown scores are omitted.
Separated marks connect to their exact positions. Separation does not change scores.
Momentum: building history. Numbers identify offerings, not rank; lines between dimensions are profiles, not time.
Missing evidence for this view
Unknown is not a low score. Select an offering above to inspect its evidence.
A position is only half the story
Momentum
Building history
Baseline recorded 2026-09-21. A second comparable review is needed to show movement.
Own movement is the score change. Relative movement subtracts the median change of matched peers, excluding this offering. Dimensions stay separate.
Zscaler Internet & SaaS and Private Access· movement by dimension
Dimension
Own movement
Against peers
Operational maturity
Building history
Not available yetNo direction inferred
Shipped innovation
Building history
Not available yetNo direction inferred
Capability breadth
Building history
Not available yetNo direction inferred
Ecosystem & integration
Building history
Not available yetNo direction inferred
Governance & control
Building history
Not available yetNo direction inferred
Operator enablement
Building history
Not available yetNo direction inferred
History appears as a hollow earlier mark connected to the current solid mark in Unfold and Overview. Profile lines between dimensions do not show time. Numbers identify offerings, not rank.
Review history & what changed
The 2026-09-21 baseline incorporates the six-dimension review. Decimal calibration and research corrections are not product momentum. Unknowns stay unknown.
2026-09-21 · baseline · rubric 1.1 · Starting point; no movement inferred.
Cloudflare One: Access and Gateway (medium confidence) and Cisco Secure Access (medium confidence) and FortiSASE (medium confidence) are tied at documented score 3.3 for Operational maturity among assessed offerings in this comparison group.
Zscaler Internet & SaaS and Private Access (medium confidence) and Cloudflare One: Access and Gateway (medium confidence) and Cisco Secure Access (medium confidence) and FortiSASE (medium confidence) are tied at documented score 3.0 for Shipped innovation among assessed offerings in this comparison group. No distinction is evidenced among the scored offerings.
Unknowns and gaps
Unknown is not low quality. Marks are omitted where a required score is unknown.
Zscaler Internet & SaaS and Private Access: no unknown dimensions.
Cloudflare One: Access and Gateway: no unknown dimensions.
Cisco Secure Access: no unknown dimensions.
FortiSASE: no unknown dimensions.
Scenario lens
A scenario highlights priorities and validation questions only. It does not rewrite scores or claim eligibility.
Selected evidence
Zscaler Internet & SaaS and Private Access · Zscaler
Zscaler ZIA URL Filtering plus ZPA private application access, Client Connector, App Connectors and ZPA log streaming; no ZDX, RBI or SD-WAN credit · Assessed 2026-09-21 · Research preview
Operational maturity
Can operators configure access, investigate policy outcomes and understand change or failure behavior?
Documented operating workflow for the selected public and private access configuration. It measures evidence of operation, not uptime or deployment age.
The documentation establishes two traffic paths, application policy and log streaming. It does not establish a measured performance or availability advantage.
Score3.0 / 5.0medium confidence
Comparison:
Rationale and sources
ZPA setup and logging, paired with documented ZIA URL policy, establish public/private policy and investigation. Diagnostics, live-session change effects and complete recovery were not verified.
How this score is built
Constraints
ZIA and ZPA are explicitly selected services; a ZPA-only license does not satisfy this cohort.
The posture-policy source documents a legacy UI; validate the equivalent current-console settings in the pilot.
Direct rendering of some help pages was limited; specific official indexed text supplied the cited workflow evidence.
Public documentation review only; no tenant deployment, detection benchmark, performance measurement or procurement quote was performed.
A score describes documented workflow in this selected scope. Unknown cells do not mean the capability is absent.
Public primary-source baseline dated 2026-09-21. No service was deployed or benchmarked and no historical momentum is inferred.
SSE and SASE portfolio labels do not define comparable entitlements. These assessments select the public-web/private-access workflow; optional networking and data modules receive no score credit.
Documentation alone earns at most medium confidence. Scores are conservative verified stages; unknown cells identify a missing evidence chain, not an absent product feature.
Shared maturity refinements divide the next anchor into diagnostics (0.3), change behavior (0.3) and recovery (0.4). No vendor-specific weighting or visual spreading is used.
Zscaler and Fortinet pages can be JavaScript-heavy or deny direct fetch. Specific indexed official documentation was readable for the cited claims; direct-access limitations are recorded in the research report.
How to read these scores
Scores use tenths from 0.0 to 5.0 against published anchors. Fractional scores credit documented requirements toward the next anchor; the inspector exposes the calculation. Equal evidence can still produce a tie. Null means unknown and is never treated as zero. Views never average or blend dimensions into an overall winner. Cohort membership is the only comparison boundary.
What this edition covers.
First edition · reviewed · rubric 1.1. Historical movement will require later dated assessments; no trajectory is inferred from this snapshot.
Public primary-source baseline dated 2026-09-21. No service was deployed or benchmarked and no historical momentum is inferred.
SSE and SASE portfolio labels do not define comparable entitlements. These assessments select the public-web/private-access workflow; optional networking and data modules receive no score credit.
Documentation alone earns at most medium confidence. Scores are conservative verified stages; unknown cells identify a missing evidence chain, not an absent product feature.
Shared maturity refinements divide the next anchor into diagnostics (0.3), change behavior (0.3) and recovery (0.4). No vendor-specific weighting or visual spreading is used.
Zscaler and Fortinet pages can be JavaScript-heavy or deny direct fetch. Specific indexed official documentation was readable for the cited claims; direct-access limitations are recorded in the research report.
Remote-user public and private access
Selected commercial configurations providing both outbound web policy and private application access for managed remote users. Required SWG/private-access modules, clients and connectors are explicit. No score credit for SD-WAN, branch hardware, backbone size, optional CASB API scanning, DLP, RBI or managed services.
