Absolute Secure Access alternatives that are not Zscaler or Cisco

Hey folks,

Looking into alternatives for Absolute Secure Access for a client's hybrid cloud environment. They need solid ZTNA, but the big names like Zscaler and Cisco are either overkill for their scale or don't fit their existing compliance workflow (think PCI DSS with specific logging requirements). They're also a bit AWS-heavy, so I'm keen on options that play nice with IAM and security groups.

I've been doing some digging and hands-on testing. Here are a few contenders that have come up, each with a different angle:

* **Palo Alto Networks Prisma Access:** Strong on the security front, obviously. Their integration with cloud-native controls is decent. However, I've seen some... interesting... default security group configurations come out of their automated deployment that needed tightening. Always check those egress rules!
* **Cloudflare Zero Trust:** This one's gaining a lot of traction. The appeal is the "start from the network layer" approach and their global edge. For a cloud-centric team, the way they handle DNS-based policies and integrate with IdPs like Okta is pretty slick. Pricing is transparent, which is a plus.
* **Twingate:** Very developer-friendly and simple to deploy. It creates a software-defined perimeter without needing a public-facing VPN gateway. From a cloud security perspective, I like how it can enforce access based on device posture. One pitfall to watch: make sure your resource-level tagging in AWS/Azure is on point, as that's often how access gets scoped.

A real configuration watch-out I've seen across some PoCs is over-permissive initial trust policies. For example, an early Twingate setup might have a resource policy that looks too broad:

```hcl
# Too permissive - allows any authenticated user from the engineering group
resource "twingate_resource" "prod_db" {
access {
group_ids = [twingate_group.engineering.id]
}
}
# Better to scope to specific needs or add additional conditions
```

Has anyone else evaluated these or other platforms (like Perimeter 81 or NetFoundry) in a production context? I'm particularly interested in:
* How they handle logging for compliance audits (CloudTrail integration depth, log granularity).
* Any surprises with egress traffic costs or architecture when connecting to VPCs.
* The actual day-to-day management overhead compared to the marketing claims.

Real-world pitfalls and architecture lessons are worth more than any datasheet.