ZTNA
Zero Trust Network Access. The product category that replaces VPNs with identity-aware proxies. ZTNA grants access to specific applications based on identity and policy, never exposing the underlying network.
ZTNA replaces the VPN's "you are on the network" model with per-application authorization, which shrinks lateral movement dramatically because a compromised endpoint reaches only what its user is entitled to. The migration difficulty is rarely the technology and usually the inventory: knowing every application, who should reach it, and what depends on flat network access today.
See also: what is zero trust, zero trust, device posture, zero trust vendors
Related on Start with Identity
- GlossaryConditional Access
Policy-driven access decisions evaluated at sign-in time. Inputs include identity, device, location, risk signals, and application sensitivity. Microsoft Entra
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- GlossarymTLS
Mutual TLS. Both the client and server present and validate X.509 certificates during the TLS handshake. The cryptographic identity binding makes mTLS a strong
- CVENetScaler Gateway and AAA authentication bypass with SAML configured
CVE-2026-19490 lets an attacker bypass authentication on NetScaler ADC and Gateway appliances running a Gateway or AAA virtual server. CVSS 9.3, shipped alongsi
- GlossaryABAC
Attribute-Based Access Control. Access decisions are made by evaluating attributes of the subject, resource, action, and environment against policy. Flexible bu