So, we just wrapped up a 6-month pilot replacing our Zscaler Private Access (ZPA) deployment with an in-house zero trust overlay using OpenZiti. Wanted to share our experience for anyone else considering the "build" side of the buy-vs-build equation for ZTNA.
The driver wasn't just cost, though the long-term savings are significant. We needed finer-grained control over our app-to-app microservices in hybrid cloud, and we found the policy engine in our previous solution a bit rigid for our dynamic workloads. OpenZiti, being open source, let us embed zero trust connectivity directly into our apps (they call it "born with identity"), which was a game-changer for our dev teams.
Here's a quick rundown of our key results:
* **Performance:** Latency improved by ~15% on average. Bypassing the external SaaS points-of-presence and having direct, ephemeral connections made a noticeable difference for our internal dashboard and database traffic.
* **Admin Overhead:** Higher initial investment, no doubt. Our platform team spent a good 3 months getting the network fabric and controllers right. But now, day-to-day policy management is actually simpler and fully API-driven.
* **User Experience:** We use the lightweight "edge router" model for most user access. The switch from the Zscaler client to our own was seamless for end-users—still just authenticating via SSO and connecting. The big win was for service accounts; no more managing "machine" users in the Zscaler portal.
* **Feature Gap:** We do miss the out-of-the-box cloud app security (CASB) and browser isolation that came with the broader suite. We're now evaluating standalone solutions for that, which adds some complexity back.
Overall, if you have a strong platform/security engineering team and your primary need is robust, programmable *network access*, building with OpenZiti is absolutely viable. It's not a direct 1:1 replacement for a full-featured platform like Zscaler, but for our core ZTNA use case, it's working brilliantly. The deep integration into our CI/CD pipeline is something we could never have achieved before.
Would love to hear if others have gone down a similar path or have questions about the transition specifics!
—Mike
Measure twice, slice once.