I've been deep-diving into Zero Trust Network Access (ZTNA) options for my company as we plan to move away from a traditional VPN. We're a 500-person B2B SaaS shop, fully on Google Workspace, with a mix of on-prem legacy systems and cloud apps. The shortlist has come down to Appgate SDP and Google's own BeyondCorp Enterprise (BCE).
From what I've read, both fit the core ZTNA model, but their starting points seem fundamentally different. Appgate appears to be a dedicated, infrastructure-focused security product. BeyondCorp feels like an extension of our existing Google ecosystem, leveraging Chrome, Identity-Aware Proxy, and context from Workspace.
My specific questions are for anyone who has evaluated or operates at a similar scale:
1. **Onboarding & User Experience:** For a workforce already in Chrome and Workspace, does BeyondCorp's integration make the user path genuinely smoother? Or does Appgate's client/portal approach offer more control over that experience?
2. **Policy Granularity:** We need to gate access based on department, device posture, and even customer-tier (support tools). I've read about Appgate's policy engine, but how does BeyondCorp's context-aware access stack up for complex, non-Google resources?
3. **The Hybrid Reality:** We still have a few critical on-premise systems. How cumbersome is it to integrate those with BeyondCorp compared to Appgate's typical architecture?
I'm less interested in high-level philosophy and more in the practical day-to-day: admin overhead, troubleshooting odd access denials, and the actual feel for end-users in sales and customer success.