Hi everyone, I’ve been tasked with evaluating our current Zero Trust setup and specifically looking at potential alternatives to Cloudflare Access. We’re a ~500-person organization, and while Access has served us well for certain applications, our compliance team is now mandating far more granular and immutable audit logging than what we’re currently getting. The built-in reports are good, but we need to feed every event—think every connection attempt, policy evaluation, and user attribute used—into our own SIEM with full context, and we’ve hit some limits.
I’m looking for community experiences with tools that can handle a similar scale but offer deeper, more exportable audit trails. Our core needs are:
* **Strict, Unalterable Logging:** Every authentication and authorization event, with user ID, timestamp, policy applied, and decision reason, must be logged in a way that prevents tampering. Forwarding raw logs to an external system is a must.
* **Scale for 500+ Users:** Smooth SSO integration (we use Okta) and the ability to handle a mix of web apps, SSH, and RDP connections.
* **Granular Policy Controls:** We use feature flags and do a lot of internal tool launches, so we need dynamic policies based on user groups, device posture, and even time of day.
* **Reasonable Cost Structure:** Per-user pricing can get steep at our size, so we're also open to models based on monthly active users or concurrent connections.
I’ve done my initial homework and have a shortlist, but I value real-world implementation stories over vendor datasheets. I'm particularly curious about:
* **Zscaler Private Access (ZPA):** How does its audit log detail and exportability compare? Is the segmentation as flexible?
* **Tailscale / Tailscale Funnel:** For those who've scaled it in an enterprise, how do you handle centralized policy enforcement and logging? Does the audit log capture enough detail for compliance (SOC2, ISO27001)?
* **Twingate:** I’ve heard their focus on simplicity is great, but does that come at the expense of log depth? Can you trace a connection failure back to the exact policy rule that blocked it?
* **Any other contenders?** We've looked at traditional VPNs, but they lack the application-layer granularity we now require.
If you’ve migrated from Cloudflare Access for similar reasons, I’d especially love to hear your story. What was your “gotcha” moment? What trade-offs did you have to make, and are you happy with the outcome? I’m all for sharing knowledge, but please come with concrete examples—tell me about your logging pipeline, your policy complexity, or a compliance hurdle you overcame.
Thanks in advance for sharing your insights. This community has always been a fantastic resource for cutting through the hype.
— Charlotte
That shift towards needing every event for your SIEM is a real game changer. We hit a similar wall a while back, where the canned logs just weren't enough for our auditors.
You might want to take a close look at Pomerium. It's built on an envoy proxy foundation and the open-source version pushes *all* events, every decision and context bit, as structured logs. You can point it straight at your SIEM. For your scale and mix of apps, SSH, and RDP, it's handled that load fine in my experience, and the policy language is super granular for those internal tool launches.
The caveat is it takes more internal knowledge to run than a pure SaaS option, but the logging fidelity is exactly what you're describing.
ian
Pomerium's a solid suggestion, and that envoy foundation really does give you incredible logging detail right out of the box. We've tested it for a similar use case.
One thing I'd add for your 500-user org is to think hard about the operational overhead user803 mentioned. The logging fidelity is perfect, but you're essentially taking on a new internal service to manage. If your team is already stretched, that's a real cost. The alternative path is to look at paid tiers of other SaaS ZTNA players (like Zscaler Private Access or even Twingate's business tier) where the granular, immutable logs are a core feature of the offering, not a DIY project. You trade some control for not running infrastructure.
For your feature flag needs, that's where Pomerium's policy language really shines, though. You can bake those flags directly into the route-level policies with JWT assertions. Could be a deciding factor.
Always A/B test.
You missed the biggest caveat: cost.
>"takes more internal knowledge to run"
It takes more infrastructure to run. Compute, load balancers, logging volume, security patching. All on your own cloud bill.
That's not just internal knowledge, it's a direct and often hidden operational expense.
show me the bill
You've absolutely nailed the hidden line item. I've seen teams tally the license savings of an open source tool, only to get blindsided by the infra and, more critically, the engineering FTE cost to keep it reliable and secure. That operational tax can easily eclipse a SaaS subscription for a 500-user org.
Where I see it pencil out is when you already have a dedicated platform or infra team with the cycles and the mandate to own this layer. Otherwise, you're just shifting the cost from an Opex line to Capex and headcount.
Mike