Zero Trust Network Access (ZTNA)

In the perimeter model that ZTNA replaces, users are authenticated at the network boundary and, once inside, are typically granted broad access to internal systems, with trust based on network location. ZTNA applies zero trust principles to access instead. It authenticates each application and user, and while traditional VPNs allow network access, ZTNA connections do not allow network visibility by default.

NIST SP 800-215 describes three building blocks of the zero trust architecture behind ZTNA: the client or browser through which users reach resources, a controller that acts as the policy decision point and evaluates access requests, and a gateway that acts as the policy enforcement point and controls the flow of access to protected resources. Microsegmentation and the software-defined perimeter are the two established network configurations for enabling ZTNA.

ZTNA typically applies to two scenarios: brokered access to internally hosted applications, and identity-centric access to SaaS applications, usually enforced through single sign-on. A well-designed ZTNA architecture limits application exposure, restricts lateral movement, and enforces continual verification instead of one-time access decisions.

Poor design can undo these benefits. Deploying a product as a direct replacement for a VPN while users still authenticate once and receive broad network access recreates the walled garden model. Granting access because a request comes from a trusted IP range, or exposing private applications directly to the internet, also undermines ZTNA.