Everyone's rebranding their firewall as "Zero Trust" now. It's getting ridiculous.
So where's the real line? When does a cloud firewall with some identity stitching become actual ZTNA? And when are you just paying extra for the buzzword? I've seen vendors claim both from the same feature set. Feels like the old CRM upselling game all over again.
CRM is a means, not an end.
I manage data infrastructure for a 300-person SaaS company, and we've deployed both a cloud-based firewall service and a separate ZTNA product for our remote workforce after moving off a traditional VPN.
* **Perimeter vs. Identity Boundary:** A Firewall-as-a-Service (FWaaS) like Zscaler Internet Access or Cloudflare Gateway still creates a network perimeter, just in the cloud. It filters traffic by IP, port, and protocol. Real ZTNA, like Cloudflare Access or Twingate, starts with user/device identity and grants access to specific applications, not network segments. The overlap is when FWaaS adds "identity stitching," but that's often just for logging user-to-IP mapping, not for granular access enforcement.
* **Deployment and Agent Model:** Our FWaaS deployment was a central DNS and network policy shift that took a weekend. The ZTNA rollout required an agent on every user device and took about three months of phased testing. The integration effort for ZTNA was 4-5x higher because we had to re-catalog every internal app and define access policies per user group.
* **Typical Cost Drivers:** Our FWaaS costs are based on bandwidth and feature tiers, roughly $3-5 per user per month at our scale. Our ZTNA solution is licensed strictly per user, at $7-10 per user per month. The hidden cost for ZTNA is ongoing policy management overhead, which for us equates to about 10 hours of admin time weekly versus 2 for the FWaaS.
* **Where the FWaaS-Plus-ZTNA Model Breaks:** A cloud firewall with added identity features often fails on "default deny." Many still allow lateral movement once a user is inside the network perimeter. True ZTNA we tested enforced per-session authentication directly to each app. We saw a 60% reduction in east-west traffic alerts after switching internal admin tools to ZTNA because the network path simply wasn't there anymore.
I'd pick a dedicated ZTNA solution if your primary goal is securing remote access to specific internal web apps and admin panels. I'd stick with a FWaaS if you need broad internet traffic filtering and data loss prevention for all office locations. To make it clean, tell us if you're replacing a VPN or just trying to filter internet traffic, and whether you have more legacy client-server applications or modern web apps.
Data doesn't lie, but dashboards sometimes do.
Great point about the deployment timeline difference. We rolled out a similar ZTNA setup last year and the agent management was a huge chunk of the work, especially for non-corporate devices.
I'm curious about your app catalog process. Did you find that building the granular access policies forced you to clean up a lot of legacy, wide-open permissions that were hiding behind the old VPN? For us, that was a painful but ultimately useful side effect.
Also, on the cost: that $3-5 per user for FWaaS seems low. Did you get that rate because you're mostly filtering outbound traffic, or is your vendor bundling it with other services?
Webhooks or bust.