Cloudflare Zero Trust vs Twingate: Access platform or connector ZTNA?

The expensive miss on a VPN replacement is not the client install. It is the week after cutover when a closed contractor ticket still leaves a flat subnet ACL in place, or when the team bought a full workspace-security stack for a job that was only “open three private apps to the right IdP groups.” Mid-stage shortlists that start from that failure usually land on Cloudflare Zero Trust and Twingate before they open a full SSE bake-off.

Between these two, Cloudflare Zero Trust packages private access inside Cloudflare’s workspace-security path (Access policies, Tunnel / cloudflared, Gateway, and the Cloudflare One Client) with a public Free plan up to 50 users, Pay-as-you-go at $7 per user per month, and Contract at an annual custom price per user under the broader Cloudflare One SASE umbrella. Twingate packages connector-based ZTNA: named Resources behind outbound Connectors, Clients that reach only those Resources, and per-user plans from free Starter through Teams at $5 per user per month, Business at $10 per user per month, and Enterprise custom. Full SSE consolidation stays on Zscaler vs Netskope; connector-vs-mesh private access sits on Twingate vs Tailscale.

	Cloudflare Zero Trust	Twingate
Primary use case	Private app access (Access + Tunnel) that can share the same Cloudflare One control plane as Gateway SWG, device client posture, and optional SASE network services	Connector-based ZTNA / VPN replacement for users and services reaching named Resources without a flat VPN
How a bad day closes	Access policy deny or Tunnel route change cuts the app; Gateway can also block internet paths when the client is on; tickets often land on WARP/client posture, DNS, and which plan unlocked log retention or add-ons	Revoke Group / Resource access or disable a Connector; user Client stops reaching that Resource; tickets often land on Connector health, split routing, and IdP group sync
Day-to-day workflow	Define Access apps and policies, run Tunnel connectors, enroll Cloudflare One Client devices, optionally layer Gateway / CASB / DLP by plan	Define Remote Networks and Resources, deploy Connectors (Docker/VM/K8s), assign Groups and posture, expand to Internet Security or Privileged Access when licensed
Deploy	Cloudflare edge; cloudflared / Tunnel toward private origins; device client for WARP-style enrollment; no inbound firewall holes for typical Tunnel paths	Outbound-only Connectors in each remote network; Clients on user devices; Controller issues signed ACLs; peer-to-peer preferred with Relays as fallback
License/pricing	Public on Cloudflare Zero Trust plans (2 Oct 2026): Free $0 forever (50-user limit), Pay-as-you-go $7/user/month, Contract annual custom $/user. Billing unit: users. ZTNA + SWG on all three; CASB/DLP/RBI/network services deepen on Contract / add-ons	Public on Twingate pricing (2 Oct 2026): Starter $0/user/month (up to 5 users), Teams $5/user/month (up to 100; yearly -15%), Business $10/user/month (up to 500; yearly -15%), Enterprise custom. Home $15/month flat is non-commercial only
Who operates it	Network / security teams already on Cloudflare DNS or ready to staff Access + client + optional Gateway policy	IT / security owners who want a focused ZTNA admin console and resource ACLs without adopting Cloudflare’s SWG packaging by default

We reviewed Cloudflare Zero Trust plan pages (live render 2 Oct 2026), Cloudflare One / Access docs, Twingate pricing and product pages, recent first-party Mesh and Privileged Access notes, and live community search the same day. We did not run either product in a paid tenant, so this is not a hands-on benchmark.

Cloudflare Zero Trust

Twingate

Cloudflare’s 2026 private-networking signal is Cloudflare Mesh (April 2026): Mesh nodes (WARP Connector lineage) and the Cloudflare One Client inherit existing Access, Gateway, and posture controls. Twingate’s 2026 expansion signal is Privileged Access for SSH (April 2026), layered on the same connector ZTNA model rather than a second VPN. Neither change turns this page into a full SASE bake-off; it still answers who owns the private-access path.

Editions and pricing

Both vendors publish self-serve per-user math you can check without a salesperson. The remaining commercial risk is plan ceilings (Cloudflare Free’s 50-user cap; Twingate Teams’ 100-user and Business’ 500-user caps) and which add-ons sit outside the base ZTNA story.

	Cloudflare Zero Trust	Twingate
Current purchasable packaging (2 Oct 2026)	Free / Pay-as-you-go / Contract on Zero Trust & SASE plans. Cloudflare One adds network services (WAN / Firewall) on a separate pricing tab when the purchase is full SASE	Starter / Teams / Business / Enterprise for commercial ZTNA. Home ($15/month) is labeled non-commercial only
Public dollar anchors	Free $0 forever (50 users). Pay-as-you-go $7 per user per month, billed monthly, no user limit. Contract: annual custom price per user. Log retention: up to 24 hours / 30 days / up to 6 months across those tiers	Starter $0 per user per month (max 5 users). Teams $5 per user per month (max 100; yearly -15%). Business $10 per user per month (max 500; yearly -15%). Enterprise: custom per user per month
What the invoice covers	ZTNA + SWG on all published tiers; CASB limited to 2 read-only API integrations on Free/PAYG; full CASB/DLP/RBI/email/network services as Contract or add-ons per the plan matrix	Core remote access / Resource ZTNA by plan tier; Internet Security (DNS filtering) and Privileged Access called out as Enterprise / expansion capabilities on first-party materials
Billing honesty	Users are the meter. Free is a hard 50-user ceiling. PAYG is the public mid-stage on-ramp. Contract dollars stay quote-required	Users are the meter. Match monthly vs yearly (-15%) before comparing to Cloudflare’s $7 PAYG. Enterprise MSA/SLA is sales-led

If the team is under 50 users and already on Cloudflare DNS, Free is a real PoC path for Access + Tunnel. If the team needs focused ZTNA past five users without adopting Gateway packaging, Twingate Teams at $5 per user per month is the published step. Do not treat Cloudflare Contract or Twingate Enterprise as interchangeable with those public floors until the quote lists the same units.

How private access is built

	Cloudflare Zero Trust	Twingate
Control model	Access applications and policies at Cloudflare’s edge; Tunnel / cloudflared (and Mesh nodes) toward private origins; identity + device posture on the request path	Resources attached to Remote Networks; Connectors make outbound-only paths; Controller issues per-session ACLs to Clients
Least privilege unit	Access app / policy (and infrastructure Access for SSH/RDP where enabled). Avoid treating a Tunnel as a flat network grant	Named Resource (host, CIDR, or service) with Group and protocol constraints. Avoid mapping “the whole VPC” as one Resource unless that is intentional
Protocol coverage	Browser-rendered access covers SSH, RDP, and VNC. Enrolled Cloudflare One Client traffic follows private routes. A statement that every TCP and UDP port is in scope the same way was not found in this research.	Any TCP or UDP application is a Resource, defined by destination address rather than a separate protocol SKU. The documented transport is TLS 1.2. WireGuard is not the current transport.
Clientless vs client	Browser-rendered SSH, RDP, and VNC without the Cloudflare One Client, on a public hostname onboarded to Cloudflare. Command logging is not supported on that clientless path. Private routes use the Cloudflare One Client.	Private Resource reachability uses the Twingate Client. A browser clientless path for human users was not found in this research.
Main buying consideration	Do you want private access on the same control plane as Cloudflare Gateway and Cloudflare One network services?	Do you want a ZTNA product whose default hire is Resource connectors, not SWG packaging?

Both replace “join the VPN VLAN” with identity-aware reachability. Between these two, Cloudflare productizes that path as Access plus Tunnel under Zero Trust / Cloudflare One. Twingate productizes it as Connectors and Resources with an admin console built for that job alone.

Client ops and adjacent controls

	Cloudflare Zero Trust	Twingate
Device client	Cloudflare One Client (WARP lineage) for enrollment, posture, and routing into Cloudflare; MDM options for mandatory auth patterns	Twingate Client on major desktop and mobile OS; posture checks and IdP integrations deepen by plan
Adjacent internet controls	Gateway SWG is on the same published Zero Trust plans; CASB/DLP/RBI deepen on Contract / add-ons. That is why this pair is not a Zscaler/Netskope substitute	Internet Security (DNS / content filtering) is marketed as an expansion, not the reason most mid-stage teams shortlist Twingate against Cloudflare
Privileged / infra access	Access for Infrastructure (SSH/RDP) and Mesh private networking inherit Access/Gateway/posture when enabled	Privileged Access for SSH (and related database / K8s messaging) extends the same Resource model on Enterprise / documented expansions
Service-account access	Access service tokens (a Client ID and Client Secret) let an automated system call an HTTP application under a Service Auth policy. That path does not complete a user identity-provider login. Deleting the token is how the docs end that credential.	Service accounts are for machines. They cannot use an identity-provider login or satisfy a 2FA prompt. They use a Service Key with the Twingate Client in headless mode. Keys can expire and can be managed through the API.
Logging	Access authentication logs can record failed attempts for a recognized service token when strict service token authentication is on. Access for Infrastructure can export SSH command logs. Clientless command logging is not supported. Log retention on the plan table is up to 24 hours on Free, 30 days on Pay-as-you-go, and up to 6 months on Contract.	Audit logs cover create, delete, edit, and connect events for access, devices, remote networks, connectors, resources, policies, service accounts, and users and groups. Export is JSON from the admin console, or a JSON sync to an AWS S3 bucket. A log-retention period for that export was not found in this research.
Availability	A numeric uptime commitment for Cloudflare Zero Trust was not found in this research.	Twingate publishes a Service Level Agreement dated 22 Apr 2024. A numeric uptime percentage in that agreement was not found in this research.
Identity provider	Human Access policies use a configured identity provider. Service tokens are the non-interactive path and do not prompt that provider. Cloudflare Zero Trust does not require one named identity vendor.	User sign-in is delegated to an identity provider. The product FAQ names Okta, Microsoft Entra ID, Google Workspace, and OneLogin, and says Twingate does not store user passwords. Service accounts cannot use those identity-provider accounts.
Who writes the next step	Owners of Access apps, Tunnel connectors, and client enrollment; Gateway owners when SWG is in scope	Owners of Resources, Connectors, and IdP groups; separate owners only when Internet Security or Privileged Access is purchased

If next quarter’s hard hours are Gateway policy and Cloudflare One Client exceptions across the fleet, Cloudflare is the honest hire. If next quarter’s hard hours are Connector health and Resource ACLs for private apps only, Twingate is the honest hire. Broader ZTNA category context sits on ZTNA tools.

Choose Cloudflare Zero Trust when private access should live with Access, Tunnel, Gateway, and the Cloudflare One Client, and you will use the published Free (up to 50 users), Pay-as-you-go ($7/user/month), or Contract path under Cloudflare One. Choose Twingate when you need connector ZTNA for named Resources on Starter / Teams ($5/user/month) / Business ($10/user/month) / Enterprise plans without making Cloudflare SWG the default purchase.