Everyone seems to be treating SASE and ZTNA like they're magic wands you can wave at your network problems. Having to pick a remote access solution for our engineering team, I looked at Cloudflare One and Perimeter 81. Both promise to make the corporate perimeter obsolete, which is a nice fantasy. The reality is a lot more about trade-offs in manageability, visibility, and where you want your complexity to live.
Cloudflare One leans heavily on its massive anycast network, which is great for performance if your team is globally scattered. But their approach to device posture feels like an afterthought compared to their core proxy services. You're stitching together Cloudflare Access, Gateway, and Tunnel—it's powerful, but it feels like you're assembling the solution yourself. The audit logs are decent, but correlating events across those services isn't as straightforward as their marketing suggests.
Perimeter 81, on the other hand, feels more like a traditional VPN that's been forcibly evolved into a ZTNA suit. It's arguably simpler to get going for pure remote access, and their focus on network segmentation is clearer out of the gate. But you're then trusting their entire PoP infrastructure, which doesn't have the same scale as Cloudflare's. Their compliance checkboxes are more obviously highlighted, which reeks of security theater if the underlying controls aren't rigorous.
For a team of 20 engineers who likely have a mix of corporate and unmanaged devices, which one actually provides meaningful security without becoming a support nightmare? I'm less interested in the buzzwords and more in practical details: How painful is the client deployment? When something breaks, can you actually trace the auth flow? Does the encryption actually meet the standards they claim, or is it just a checkbox?
—Greg
Trust but verify