Secure plant access without the cloud. Five Zscaler alternatives, ranked for OT.
Trout Access Gate is an on-premise appliance to secure OT access without the cloud: it protects PLCs and HMIs that never run an agent, with enforcement staying on your own network, on the equipment you already have.
Last updated:
The right choice depends on what you protect.
Zscaler is genuinely good at what it was built for: connecting a distributed workforce to cloud applications. Its model assumes an agent on the endpoint and a network path out to a cloud point of presence. For a fleet of laptops reaching SaaS, that is the right design, and nothing here argues otherwise.
In market terms Zscaler is a Security Service Edge (SSE). Zscaler Internet Access (ZIA) is the secure web gateway. Zscaler Private Access (ZPA) is the ZTNA that replaces the VPN for private applications. Privileged Remote Access (PRA) brokers clientless sessions for vendors. The alternatives people search for, Prisma Access, Netskope, Cloudflare, sit in the same SSE and SASE category. That category answers one question well: how does a person on a laptop reach an application. It was not built to answer the plant-floor question: how does anyone reach a controller that cannot run an agent and has no route to the cloud.
A water treatment plant or a machine shop breaks both assumptions. The endpoint is a PLC or an HMI that will never run an agent, and it often sits on a segment with no route to the internet. Cloud-delivered Zero Trust has nothing to install on the device and nowhere to send the traffic. That is a category mismatch, and no fault of the product.
The useful comparison is which model fits a plant floor. The table below is built from each vendor's own public documentation. Where a capability is not documented, the table says so rather than guessing.
5 Zscaler competitors and alternatives, ranked for OT.
Ranked for one job: securing on-premise IT and OT assets. A different ranking would be right for a laptop fleet reaching SaaS, and the first entry says so.
1. Trout Access Gate
An on-premise appliance that connects to your existing network and enforces Zero Trust there, with nothing to install on the device and no cloud control plane to reach.
- Best for
- Plants with legacy PLCs, HMIs and SCADA, isolated or air-gapped segments, and data-sovereignty mandates that keep every packet on site.
- Where it stops
- It is not a SASE. If your problem is a distributed workforce reaching cloud applications, this is the wrong shape and a cloud ZTNA is the better call.
2. Palo Alto Prisma Access
Cloud-delivered SASE with a documented OT and ICS remote-access story, and OT protocol parsing that lives in the next-generation firewall rather than in the access broker.
- Best for
- Organisations already standardised on Palo Alto that want one vendor across the IT edge and the OT remote-access path.
- Where it stops
- Cloud-delivered, so it does not function on a segment with no route out. Deployment timelines are not publicly documented.
3. Zscaler Privileged Remote Access
The benchmark for cloud-first Zero Trust, with a privileged remote access product that brokers clientless sessions to OT systems.
- Best for
- Large distributed workforces reaching SaaS, plus supervised vendor access to OT systems that do have a path to the cloud.
- Where it stops
- Needs the cloud control plane, so it stops at the air gap. No OT protocol parsing is documented in the broker itself.
4. Netskope
Cloud Zero Trust on the NewEdge network, marketed for access to SCADA, PLCs and HMIs, with OT capability weighted toward discovery rather than enforcement.
- Best for
- Teams that want visibility across cloud, web and private applications and treat OT access as one more private application.
- Where it stops
- Session recording and playback are not publicly documented, and enforcement depends on reaching NewEdge.
5. Cloudflare Zero Trust
The fastest cloud Zero Trust to stand up, with a generous entry tier and no OT-specific positioning.
- Best for
- Lean teams securing web applications, SSH and RDP for people, where cost and time to first policy matter most.
- Where it stops
- No documented support for OT devices, command logging without replay, and it depends entirely on Cloudflare's network.
How the Zero Trust options compare for industrial plants.
Competitor cells are drawn from each vendor's public documentation, linked below. Where a capability is not publicly documented, the cell says so rather than assuming.
| Capability | Zscaler | Palo Alto Prisma Access | Netskope | Cloudflare Zero Trust | Trout Access Gate |
|---|---|---|---|---|---|
| Cloud dependency | Cloud service; on-prem data-plane option | Cloud-delivered SASE | Cloud (NewEdge) | Cloud only (global network) | None; on-premise, on the existing network |
| Agent required | Client Connector; clientless browser via PRA | GlobalProtect; clientless browser via PRA | Netskope client; clientless browser | WARP client; some clientless access | None; nothing to install |
| Works with legacy PLC / HMI | Brokers clientless access to OT systems | Brokers OT and ICS remote access | Markets access to SCADA, PLCs, HMIs | Not documented for OT devices | Yes; the device is never touched |
| Functions air-gapped | No; needs the cloud control plane | No; cloud-delivered | No; needs the NewEdge cloud | No; needs Cloudflare's network | Yes; no cloud dependency |
| Typical deployment time | Not documented | Not documented | Not documented | Not documented | A day; no rewiring, no downtime |
| Session recording and playback | Yes; PRA session recording | Yes; Browser PRA recording | Not documented; monitoring only | Command logging only; no replay | Yes; recorded and replayable |
| OT protocol awareness | RDP, SSH, VNC; no OT parsing documented | RDP, SSH, VNC; OT parsing lives in the NGFW, not the broker | RDP, SSH; OT discovery, not enforcement | TCP, HTTP, SSH; no OT parsing | Protocol-aware enforcement, including Modbus |
| Compliance mapping (CMMC L2 / NERC CIP) | CMMC and NERC not documented | NERC referenced; CMMC not documented | CMMC and NERC not documented | FedRAMP; CMMC and NERC not documented | CMMC L2 and NERC CIP |
Sources: Zscaler · Palo Alto · Netskope · Cloudflare
The questions that decide it on a plant floor.
Does enforcement stay on site?
Cloud-delivered Zero Trust routes the access decision through a vendor point of presence. On-premise enforcement keeps every decision and every packet inside the fence. That is what an isolated OT segment and a data-sovereignty mandate require.
Can it protect a device that will never run an agent?
A modern proxy terminates the session, authenticates the person, applies policy, records what happened, and forwards a clean request. The PLC or HMI never knows anything changed, and it never needs software installed on it.
Is the audit trail ready for an assessor?
Tamper-evident logs of who connected, to which device, and what they did are what a CMMC or NERC CIP assessor asks for. Access Gate generates them at the enforcement point, as each session happens.
Access Gate runs where nothing can be installed.
Trout Access Gate secures defense manufacturers, research institutions, and critical-infrastructure operators: environments built on legacy PLCs, SCADA, and equipment that cannot take an agent. Among them are Thales, Millbrook Machine, Elna Magnetics, Irish Manufacturing Research, HUN-REN SZTAKI, and STBMA.
See customer storiesQuestions about Zscaler competitors and alternatives.
Access Gate is an on-premise Zero Trust appliance for IT and OT, with nothing to install on machines. It covers the assets a cloud ZTNA cannot reach.
Not for what Zscaler does best. If your job is connecting a remote workforce to SaaS, Zscaler is a strong fit and Access Gate is not trying to be. Access Gate is for the other half of the problem: securing on-premise IT and OT assets, including PLCs and HMIs that cannot run an agent and often have no path to the cloud. Many sites run both.
Yes. Enforcement happens on the network, beside the equipment, not on the endpoint. A modern proxy terminates the session, authenticates identity, applies enclave policy, and records the session, then forwards a clean request to the device. A twenty-year-old PLC gets the same Zero Trust treatment as a modern workstation, with nothing installed on it.
Yes. Access Gate runs fully on-premise as an appliance connected to your existing network. There is no cloud control plane and no cloud point of presence to reach, so it keeps working on an isolated or air-gapped segment. Cloud-delivered Zero Trust services depend on reaching their provider's network.
Yes, and that is the common shape. ZPA keeps handling the laptops and SaaS. Access Gate sits in front of the plant network, so the person who arrives through ZPA still meets an identity check, a per-asset policy and a recorded session before reaching a PLC or an HMI. The two do not overlap: one decides who gets onto the network, the other decides what they may do to a machine once there.
Access Gate enforces policy over the protocols on the wire, not just the ports. For a protocol like Modbus that has no native authentication, a protocol-aware proxy can bind access to identity, restrict which function codes and registers a source may use, and record every transaction, without touching the controller.
One site, one flow, one week. Rack the appliance next to the plant switch, listen for a few days to see who reaches what, then steer one remote-access flow (a vendor session to one controller is the usual pick) through it in report-only mode, then in enforcement. Nothing on the controller changes and the old path stays available as a fallback until you remove it. If that one flow works, the rest is repetition.
It maps to the access-control, system-and-communications-protection, and audit families those frameworks assess: identity-bound access, segmentation, network-layer MFA, and tamper-evident logs generated at the enforcement point. Treat it as one documented control in a broader program, not a compliance box on its own.
Access Gate is built by Trout Software, a French company, and runs entirely on site: the access decision, the logs and the asset inventory never leave the plant, and there is no cloud tenant under a foreign jurisdiction. For regulated and public-sector buyers who need a sovereign option, the French guide on sovereign alternatives to Fortinet and Zscaler for OT covers the criteria in detail.
Start from your endpoints. If they are laptops reaching SaaS, a cloud ZTNA such as Zscaler, Prisma Access, Netskope, or Cloudflare fits. If they are PLCs, HMIs, RTU, or air-gapped servers, an on-premise appliance such as Access Gate fits. It connects to your existing network and needs no agent and no cloud. The table above shows where each one lands.
See whether Access Gate fits your plant.
Thirty minutes with an engineer is usually enough to tell whether an on-premise appliance fits your plant, or whether a cloud ZTNA is the better call. We will tell you honestly either way.