Zero Trust Market Map 2025: Who Wins as Legacy VPN Finally Dies?

The pitch for zero trust network access has been the same for years — stop trusting anything by default, verify every request regardless of network location — but the shift away from legacy VPN architectures has accelerated as remote and hybrid work made the old perimeter-based model obviously insufficient, and as compliance regimes increasingly assume a zero-trust posture is table stakes rather than best practice.

The competitive map splits along where each vendor entered the market. Zscaler built its business on network-layer ZTNA and secure web gateway, replacing the VPN and firewall stack directly. Okta owns the identity layer that any zero-trust architecture depends on for authentication and authorization. Palo Alto Networks has taken the platform-consolidation route, bundling network, cloud, and security operations into a single suite rather than competing point-product to point-product.

That difference in strategy shows up in growth and margin profiles: Zscaler and Okta both grow revenue in the high-teens to high-20s percent range as focused, best-of-breed vendors, while Palo Alto's platform bundling trades slightly slower organic growth for higher account stickiness and cross-sell. Neither approach has decisively won yet — enterprise buyers are still split between wanting fewer vendors and wanting the best point solution in each category.

Our view is that consolidation is the medium-term winner: security budgets are under the same scrutiny as every other IT line item, and a platform that can plausibly replace three vendor relationships has a real pricing and renewal advantage over any one point product. That said, best-of-breed vendors that own a critical layer — Okta's identity graph is the clearest example — have a defensibility that's harder to consolidate away than a company might assume.