Zero trust network access (ZTNA)
Also known as: ZTNA, zero trust network access, software-defined perimeter, SASE access
Zero trust network access (ZTNA) gives remote users secure access to individual applications, not the entire network.
Each request is verified by identity and device health before access is granted, and users never see resources they aren't authorized for. It's the zero trust alternative to the broad, all-or-nothing access of traditional VPNs.
Zero trust network access (ZTNA), explained at three levels
At home
Zero trust network access is like a hotel key card instead of a master key. A master key, like a traditional VPN, opens every door once you have it. A key card opens only your room, and the front desk checks who you are before programming it. ZTNA works the same way: each time you use a work app, it checks your identity and device, then opens only that app.
At work
Zero trust network access, or ZTNA, gives remote staff access to specific business applications instead of the whole company network. Every request is checked against who the person is, the health of their device, and company policy. For a business, it limits the damage when a password is stolen or a laptop is infected, because the attacker reaches only that person's approved apps.
At home
ZTNA has three parts. An agent or browser on your device asks for an app. A broker, run by the ZTNA provider in the cloud, checks your sign-in with the company identity system and your device's health, such as encryption and updates. A connector sits next to the app inside the company and makes an outbound link to the broker. If everything checks out, the broker joins the two, and you reach that app only.
At work
For a workplace, ZTNA replaces broad network access with rules per application: accounting staff reach the accounting system, contractors reach one portal, and nobody can browse the rest of the network. It plugs into the identity provider, such as Entra ID or Okta, and device management tools such as Intune for health checks. Products include Zscaler Private Access, Cloudflare Access, and Microsoft Entra Private Access, often sold as part of a SASE platform.
At home
The clever part is the direction of the connection. The app's connector dials out to the broker, so the company firewall needs no open inbound ports, and the app is invisible to anyone scanning from the internet. Policy can be checked again during a session, cutting access if a device falls out of compliance. While ZTNA is not magic, in my view it fixes the VPN's biggest flaw: trusting anyone who gets inside.
At work
ZTNA designs rely on strong identity, ideally phishing-resistant MFA, device posture signals, and per-application policy written for least privilege. Outbound-only connectors remove inbound exposure, and per-app segmentation blocks lateral movement. Limits remain: legacy apps that need broad network protocols are harder to publish, and the broker becomes a critical dependency. The model follows NIST SP 800-207, the US zero trust architecture guide. Migration from VPN is usually phased, starting with contractors and the most sensitive apps.
Real-world examples
At home
Sophie's contractors previously needed a full VPN account to use one internal app, which was overkill and risky. With ZTNA, her MSP gave each contractor access to just that single application, verified by identity and device, with no view of anything else on the network.
At work
After a security review flagged their broad VPN access, Carlos's firm adopted ZTNA. Remote staff now reach only the specific applications their roles require, each connection verified for identity and device health, so a compromised laptop can no longer be used to scan or move across the internal network.
How it compares
| feature | Traditional VPN | ZTNA |
|---|---|---|
| Access granted | Whole network | Specific applications |
| Verification | At login | Continuous (identity + device) |
| Resource visibility | Network visible once in | Hidden unless authorized |
| Inbound exposure | VPN appliance exposed | No open inbound ports |
| Lateral movement risk | High | Minimal |
For analysts
For new remote-access needs, ask your MSP whether ZTNA fits better than a VPN. Granting access to specific apps rather than the whole network dramatically limits what a stolen login or compromised device can reach, which is the core of a zero trust approach.
History & origin
As remote work exploded and traditional VPNs showed their weakness by granting wide network access that attackers could exploit, the industry embraced zero trust principles for remote access. ZTNA emerged as the practical implementation: brokered, application-specific, continuously verified access. It became a cornerstone of modern secure access strategies (and the SASE model), increasingly replacing or supplementing VPNs for connecting distributed workforces.