ZTNA
Zero Trust Network Access. The product category that replaces VPNs with identity-aware proxies. ZTNA grants access to specific applications based on identity and policy, never exposing the underlying network.
ZTNA replaces the VPN's "you are on the network" model with per-application authorization, which shrinks lateral movement dramatically because a compromised endpoint reaches only what its user is entitled to. The migration difficulty is rarely the technology and usually the inventory: knowing every application, who should reach it, and what depends on flat network access today.
See also: what is zero trust, zero trust, device posture, zero trust vendors
Related on Start with Identity
- GlossaryConditional Access
Policy-driven access decisions evaluated at sign-in time. Inputs include identity, device, location, risk signals, and application sensitivity. Microsoft Entra
- GlossaryMicrosegmentation
Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogAccess broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials
Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute fo
- GlossaryCAEP
Continuous Access Evaluation Protocol. A specification for communicating security-relevant session events, such as a credential change, a device falling out of
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo