VPN is Dead (Mostly)

Traditional VPNs give users full network access once connected. Authenticate once, get a tunnel, access everything. This is fundamentally incompatible with zero trust principles, and it is why organizations are moving to Zero Trust Network Access (ZTNA).

ZTNA flips the model: verify every request, grant access only to specific applications, and never trust the network.

How ZTNA Works

The core concept is simple:

  1. User authenticates through an identity provider
  2. Device posture is evaluated (OS version, patches, EDR status, disk encryption)
  3. Access is granted to specific applications based on policy - not network segments
  4. The application is never exposed to the internet directly
  5. Every session is continuously evaluated - not just at connection time

The user never gets “network access.” They get application access through an encrypted tunnel to a broker that validates every request.

Evaluation Criteria

When comparing zero trust network access providers, focus on these areas:

Identity integration - Does it work with your existing IdP (Azure AD, Okta, Ping)? Does it support SAML 2.0 and OIDC? Can it enforce MFA natively or through your IdP?

Device posture assessment - Can it check OS version, patch level, antivirus status, disk encryption, and firewall state? Can you create custom posture checks? How frequently does it re-evaluate?

Application support - Does it support web apps, thick client apps, SSH, RDP, and custom TCP/UDP protocols? Some ZTNA solutions only work well with HTTP-based applications.

Deployment model - Agent-based (installed on endpoints) vs. agentless (browser-based). Agent-based provides more control and supports non-web protocols. Agentless is easier to deploy for contractors and BYOD.

Performance - Where are the provider’s points of presence? Latency matters. A ZTNA solution that routes all traffic through a single data center across the continent will frustrate users.

Logging and visibility - Detailed session logs including user, device, application, duration, and bytes transferred. Integration with SIEM platforms.

The Market

The major categories of ZTNA providers:

Pure-play ZTNA:

  • Zscaler Private Access (ZPA) - One of the earliest and most mature. Strong integration with their internet access product.
  • Cloudflare Access - Developer-friendly, competitive pricing, strong global network.
  • Appgate SDP - Software-defined perimeter approach with strong policy engine.

SASE-integrated ZTNA:

  • Palo Alto Prisma Access - ZTNA as part of a broader SASE platform. Good for existing Palo Alto customers.
  • Netskope Private Access - Strong data protection integration.
  • Cato Networks - Full SASE stack with ZTNA built in.

Identity-vendor ZTNA:

  • Microsoft Entra Private Access - Tight Azure AD integration. Natural choice for Microsoft shops.
  • Cisco Duo / Secure Access - Leverages Duo’s MFA and device trust capabilities.

Open source:

  • OpenZiti - Open source zero trust networking. More effort to deploy but no per-user licensing costs.

What ZTNA Does Not Solve

ZTNA is not a silver bullet. It secures remote access to applications, but it does not replace:

  • Network segmentation within the data center
  • Endpoint detection and response
  • Email security
  • Vulnerability management

Think of ZTNA as replacing your VPN concentrator, not your entire security stack. It is one component of a zero trust architecture, not the whole thing.

Practical Advice

Start with your highest-risk remote access use cases - typically admin access to production systems and third-party/contractor access. These are the scenarios where traditional VPN is most dangerous and where ZTNA provides the most immediate value.