European SASE and ZTNA Platforms

#1 NetBird

Berlin, Germany Free EUR 0 (up to 5 users, 100 machines); Team EUR 6 and Business EUR 12 per seat each month; Enterprise priced individually Demo via sales

Best for: Teams retiring a classic VPN who want to start free and keep the option to self-host

• Operating company. NetBird GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Your own infrastructure when self-hosted; cloud hosting region not stated on the pricing page
• Source code. Closed source
• Replaces. Netskope Private Access, Zscaler Private Access, Tailscale

NetBird replaces the VPN in a Netskope deployment and nothing else: devices form direct WireGuard connections, and a central policy states which groups may reach which machines and networks. The feature list covers SSO and MFA, group rules, private DNS, SCIM provisioning and SSH access, with device posture checks and traffic event logging reserved for the Business plan at €12 per user per month.

The company is NetBird GmbH in Berlin, registered at the Amtsgericht Charlottenburg (HRB 237529 B), and the terms follow German law. Most of the code is BSD-3-Clause, with the management, signal and relay parts under AGPLv3, and a Docker Compose quickstart exists for self-hosting. The ISO 27001 and DORA banner on its pricing page is a vendor claim that this review did not check.

Standout feature. NetBird counts only the users and machines that connected in the billing period, and lists extra machines at €0.50 a month on its paid plans.

#2 Defguard

Szczecin, Poland Open Source free; Business free up to 10 users and one location, paid options beyond that; Enterprise priced individually Demo via sales

Best for: Technical teams that want identity, VPN and MFA in one stack on their own servers

• Operating company. Defguard Sp. z o.o.
• Jurisdiction. EU (Poland)
• Where the data sits. Your own servers (self-hosted)
• Source code. Closed source
• Replaces. Netskope Private Access, Zscaler Private Access, OpenVPN

Defguard combines a WireGuard VPN, an identity provider and multi-factor authentication in one platform that you run yourself. The second factor (TOTP, WebAuthn or e-mail) is asked when the tunnel opens, so a key left on a stolen laptop does not give standing access. Firewall rules are set per user or group, and LDAP and Active Directory sync fill the groups.

Defguard Sp. z o.o. is based in Szczecin (KRS 0001168794) and contracts under Polish law. Most code is AGPL, with an enterprise directory under a separate licence, so the open-source edition does not contain every feature. The Business edition costs nothing up to 10 users and one location, while prices above that, and for Enterprise, are not shown. Operations and updates are your job.

Standout feature. Defguard enforces MFA on the connection itself and ships the identity provider that checks it.

#3 Systancia

Sausheim, France No prices published; contact or demo Demo via sales

Best for: Industrial and public-sector organisations that need controlled third-party access to IT and OT systems

• Operating company. SA SYSTANCIA
• Jurisdiction. EU (France)
• Where the data sits. Data centers in France (vendor statement)
• Source code. Closed source
• Replaces. Netskope Private Access, Zscaler Private Access, CyberArk

Systancia approaches the access question through three products: Gate for zero trust remote access, Cleanroom for privileged sessions, and modules for identity and authentication. The site frames the platform as European zero trust for IT and OT systems and has a page on secure access to industrial infrastructure, which suits plants whose contractors need to reach machines remotely.

The company is SA SYSTANCIA, based at Actipolis III in Sausheim near Mulhouse (RCS Mulhouse 419 687 231). Gate is available as software or as a SaaS service, and the vendor states that its data centers are in France. The analyst placements on its pages are its own statements and were not verified, no prices are shown, and there is no secure web gateway or CASB.

Standout feature. Systancia puts operational technology and privileged access under one vendor with software and SaaS delivery.

#4 Open Systems

Zurich, Switzerland No prices published; quote Demo via sales

Best for: Mid-sized and large companies that prefer a vendor to operate the network and security stack

• Operating company. Open Systems AG
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. Switzerland or the EU where possible, per vendor blog
• Source code. Closed source
• Replaces. Netskope, Zscaler, Palo Alto Prisma Access

Open Systems sells SASE as a service that its own staff operate around the clock. The descriptions list SD-WAN, a firewall, a secure web gateway, CASB and ZTNA, plus contractual SLAs and a named customer success contact, so a company without a network security team buys an outcome and not a set of products to assemble.

The legal entity is Open Systems AG at Raeffelstrasse 29 in Zurich, which its imprint places inside the Swiss Post Group. The website terms follow Swiss law, and Switzerland is outside the EU. A vendor blog says data is hosted in Switzerland or the EU where possible, with Swiss-only hosting on request. The vendor site refused automated access, and the customer contract was not available, so these statements come from excerpts.

Standout feature. Open Systems is the only entry in this category sold as a fully vendor-operated service with a web gateway included.

#5 Cato Networks

Israel, Israel No prices found; licensed per user group and ZTNA user Demo via sales

Best for: Multi-site organisations that want networking and security from one vendor with regional contracts

• Operating company. Cato Networks Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. Regional management instances in the US, EU, India and Japan
• Source code. Closed source
• Replaces. Netskope, Zscaler, Palo Alto Prisma Access

Cato Networks describes one platform with a single control plane, data plane and data lake covering SD-WAN, firewall as a service, secure web gateway, IPS, CASB, DLP, ZTNA, remote browser isolation and AI security. ZTNA licences are defined per user and cover up to 3 devices, and there is no price list in the pages that could be read.

Cato Networks Ltd. is Israeli, with legal entities in Germany, the Netherlands, Italy and France that act as contracting parties in their regions, and which entity signs depends on where you buy. Management instances run in the US, EU, India and Japan, with geo-fencing on regional points of presence. The direct website blocked automated access, so the facts come from its knowledge base and excerpts of its legal pages.

Standout feature. Cato Networks states that the same feature set is available through public, telecom-run and customer-hosted deployments.

#6 Check Point SASE

Israel, Israel No prices published; demo Demo via sales

Best for: Organisations that already use Check Point firewalls or want SASE bought through a security channel partner

• Operating company. Check Point Software Technologies Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. Not stated on the product page
• Source code. Closed source
• Replaces. Netskope, Zscaler, Perimeter 81 (same product family)

Check Point SASE, formerly Harmony SASE, divides the offer into Private Access with agentless and client-based zero trust access, Internet Access that inspects browsing on the device and in the cloud, and SaaS security with DLP covering over 800 predefined data types. Its SD-WAN part lists failover between MPLS, 5G and broadband and branch provisioning without touching the device.

The contracting party is Check Point Software Technologies Ltd. of Israel, and search excerpts of its cloud terms point to Israeli law and the Tel Aviv-Yafo courts. The Perimeter 81 website now carries the title Check Point SASE - Perimeter 81, so that service sits under this entry. Check Point says it sells only through channel partners, no prices or hosting regions are published, and its terms page blocked automated access.

Standout feature. Check Point SASE absorbs Perimeter 81, so existing customers of that service stay in the same product family.

#7 genua

Kirchheim (Munich), Germany Pricing on request Demo via sales

Best for: Government, defence and critical infrastructure networks with classification rules

• Operating company. genua GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. On-premise appliances; no cloud service required
• Source code. Closed source
• Replaces. Fortinet FortiGate, Palo Alto firewalls

genua is a German vendor whose range runs from the genugate firewall, which puts an application level gateway and a packet filter on two separate computers, to genusphere, a product that gives users browser access to approved applications without a VPN client. Sign-in works through Microsoft Entra ID or Keycloak, and genusphere can run on-premises, on Kubernetes or in the cloud.

genua GmbH has its seat in Kirchheim near Munich (HRB 98238, Amtsgericht München) and says on its homepage it belongs to the Bundesdruckerei Group. The product page for genugate states Common Criteria EAL 4+ and approvals for VS-NfD, NATO RESTRICTED and EU RESTRICTED, and a licence can be activated offline. Prices are on request, and the sales approach aims at authorities and industry.

Standout feature. genua combines a firewall with approvals for classified German and NATO networks and a browser-based access product.

#8 Stormshield

Issy-les-Moulineaux, France Enterprise pricing on request Demo via sales

Best for: Organisations that run or plan firewall appliances and want ZTNA features and sovereignty-grade qualifications from one French vendor

• Operating company. Stormshield
• Jurisdiction. EU (France)
• Where the data sits. Mostly the EEA, with international transfers under EU standard contractual clauses
• Source code. Closed source
• Replaces. CrowdStrike, SentinelOne, Palo Alto Cortex

Stormshield makes network firewalls with ZTNA features inside them: host checks on the workstation, policy by user or group, multi-factor authentication and micro-segmentation, which the vendor says come at no extra cost. A ZTNA agent opens a VPN connection to the allowed resources, so the model is appliances you operate and not a cloud broker, and there is no cloud web gateway.

The company is based in Issy-les-Moulineaux and is a wholly-owned subsidiary of Airbus Defence and Space Cyber Programmes. Its endpoint agent, Stormshield Endpoint Security Evolution, holds an ANSSI CSPN qualification and Spain's CCN-LINCE approval, and its privacy notice says data is processed mostly within the EEA, with standard contractual clauses for the rest. Pricing is quoted, no trial is listed, and the partner network thins out outside France.

Standout feature. Stormshield includes ZTNA in the firewall instead of selling it as a separate subscription.

#9 SSH.com PrivX

Helsinki, Finland No prices published; free trial offered Demo via sales

Best for: DevOps and infrastructure teams that need controlled administrator access to servers and cloud workloads

• Operating company. SSH Communications Security Oyj
• Jurisdiction. EU (Finland)
• Where the data sits. Not stated on the product page
• Source code. Closed source
• Replaces. Privileged access parts of Netskope and Zscaler deployments, CyberArk

SSH.com PrivX removes the standing password from administrator access. A user or a machine receives a certificate for one session, and it expires afterwards, so there is no key lying around to steal. The product page lists zero standing privileges, secrets management, browser sessions with single sign-on and an architecture aimed at cloud-native, auto-scaling infrastructure.

SSH Communications Security Oyj is a Finnish public limited company with its headquarters at Karvaamokuja 2D in Helsinki. The product page offers a free trial, and gives no prices, no hosting options and no self-hosting statement. Its terms and governing law were not opened for this review. PrivX covers servers and infrastructure access and does not filter web traffic, so it complements a web gateway.

Standout feature. SSH.com PrivX makes every session credential short-lived, for people and for machines.

#10 Sophos

Abingdon, United Kingdom See website Demo via sales

Best for: Teams already managing endpoints and e-mail in Sophos Central

• Operating company. Sophos Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Sophos Central, see vendor
• Source code. Closed source
• Replaces. Forcepoint DLP, Symantec DLP

Sophos appears in this category through its ZTNA, which is sold inside the Sophos Workspace Protection bundle and shares device health with its firewall and endpoint products so that a compromised device can be isolated automatically. On the data side, the DLP policy in Sophos Central uses content and file rules and regional templates, but its documentation states it is available on Windows devices only.

The end user terms name Sophos Limited, registered in Abingdon in the United Kingdom, as the contracting party for customers outside the US, Canada and Latin America, which contract with Sophos Technology Limited instead. The UK is outside the EEA and has an adequacy decision. No price is published for ZTNA or DLP, and the monitored DLP destinations are not documented.

Standout feature. Sophos lets device health reported by its own endpoint and firewall products decide access.

#11 Cyolo

Israel, Israel No prices published; demo Demo via sales

Best for: Manufacturers, utilities and data center operators controlling third-party access to OT networks

• Operating company. Cyolo Security Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. Agentless deployment with no cloud dependency (vendor statement)
• Source code. Closed source
• Replaces. Netskope Private Access for industrial use, Zscaler Private Access

Cyolo has moved its homepage from general enterprise ZTNA to secure connectivity for OT and critical infrastructure. Its Privileged Remote Operations product gives employees and vendors least-privilege access that can be supervised and recorded, with MFA for legacy systems that cannot host an agent. A separate segmentation product adds policy simulation before enforcement.

Cyolo Security Ltd. is the responsible entity named in the privacy policy and is Israeli. The vendor describes agentless deployment with no cloud dependency, which has not been verified. The terms page returned not found, so the governing law of a customer contract is unconfirmed, and no prices are published. A buyer wanting web filtering, CASB or office-wide access will find the product too narrow.

Standout feature. Cyolo records and supervises third-party sessions on industrial systems without installing an agent on them.