In short
Agentless ZTNA, also called clientless ZTNA, gives users access to specific private applications through a web browser without installing a ZTNA agent. The provider authenticates the user, applies policy and proxies the session to the app. It suits contractors, BYOD and partners, with less device posture and fewer supported protocols than client-based ZTNA.
Get a quote for agentless ZTNA
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What agentless ZTNA is
Zero trust network access normally relies on an agent: software on the device that reports its health and carries traffic to the applications the user is allowed to reach. Agentless (or clientless) ZTNA removes the agent. The user opens a browser, signs in through your identity provider with MFA, and the ZTNA service presents only the applications the policy allows. Behind the scenes the service proxies each session to the application through a connector in your network that makes outbound connections only.
The principle is the same as any ZTNA: deny by default, verify identity and context, grant access to one application rather than the network. What changes is where the controls sit. Without an agent, the device itself is mostly invisible to the policy engine, so the design leans more on identity, session controls and limiting what reaches the device. For the full mechanism, see how zero trust network access works.
Three ways vendors deliver it
Browser portal or reverse proxy
The provider publishes private web applications through its cloud, and users reach them from any browser after sign-in. Some vendors extend this to SSH and RDP rendered in the browser. Cisco lists clientless ZTNA in Cisco Secure Access for web apps and browser-based SSH and RDP; Trend Micro ZTSA offers browser access through a user portal generated by Vision One; Check Point lists Agentless ZTNA in its SASE Private Access range, covering web (HTTP and HTTPS), RDP, SSH and VNC applications.
Enterprise browser
A centrally managed business browser is installed instead of a ZTNA agent. It connects to private apps and applies last-mile data controls inside the browser: copy and paste, download, upload, print and screenshot restrictions, watermarking and session logging. The Island Enterprise Browser (with Island Private Access) and Check Point Enterprise Browser work this way.
Security added to existing browsers
Some platforms add policy and, in some tiers, access to company apps to the browsers people already use, so nobody has to switch browser. DefensX Premium+ adds unmanaged device and BYOD access and ZTNA to web and on-premises applications through the DefensX-protected browser.
Agent-based vs agentless ZTNA
| Agent-based ZTNA | Agentless (clientless) ZTNA | |
|---|---|---|
| Install on the device | ZTNA client or agent | Nothing, or a browser |
| Device posture | Detailed: OS, patching, encryption, endpoint protection | Limited to what the browser can report, or browser-level checks |
| Protocols | Web, thick client, file shares, SSH, RDP and more | Mainly web apps; some vendors add browser-based SSH and RDP |
| Data on the device | Depends on endpoint controls | Can be restricted in an enterprise browser (no download, copy or print) |
| Deployment effort | Device management needed | Low; share a link or a browser |
| Typical users | Employees on managed devices | Contractors, partners, BYOD, M&A |
Many organisations run both: agent-based ZTNA for employees on managed laptops, and agentless access for everyone else, under one policy.
Not sure which level fits? Ask us
Tell us what you need and we will recommend the right level for your organisation, with a quote.
The trade-offs to plan for
Agentless access is convenient, but it is not a free upgrade. Plan for:
- Less device posture. You cannot check patch level or endpoint protection on a device you do not manage in the same depth, so treat agentless sessions as higher risk and limit them to fewer, less sensitive applications. The NCSC's ZTNA guidance names device identity and device health among the core signals for access decisions, and both are weaker here.
- Protocol limits. Browser access suits web apps. Thick-client applications, file shares and anything that needs a local network connection usually need an agent or another route.
- Data leaving the session. A browser on a personal laptop can download, print and screenshot. An enterprise browser or browser isolation reduces this; a plain browser portal does not.
- Session re-evaluation. Make sure sessions time out and are re-checked as context changes, in line with the NCSC requirement to continuously re-evaluate access.
Where these limits matter, consider giving contractors a managed device, or using an enterprise browser so the data controls travel with the session.
Who agentless ZTNA is for
- Contractors and suppliers who need one or two systems for a fixed period
- Partners' staff reaching a shared portal or application
- BYOD, where staff use personal phones, tablets or home computers for some work
- Mergers and acquisitions, where a new team needs access to your apps before their devices are brought under management
- Kiosks and shared devices, where installing an agent is impractical
For employees on company devices, agent-based ZTNA usually gives stronger posture checks and wider application support. Our secure remote access solutions page maps each use case to an approach.
Is agentless ZTNA the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Agentless options we supply
| Product | Agentless approach | Notes |
|---|---|---|
| Check Point SASE | Agentless ZTNA for web, RDP, SSH and VNC applications, plus the Check Point Enterprise Browser for unmanaged devices | Enterprise Browser adds upload, download, copy, print and screen capture controls and agentless device posture checks. See Check Point Enterprise Browser and Check Point ZTNA |
| Cisco Secure Access | Clientless ZTNA for web apps; Cisco also lists browser-based SSH and RDP | Same policy as client-based ZTNA. See Cisco ZTNA |
| Exium SASE Pro | Agentless access for devices you do not manage, such as contractors' laptops | Included in SASE Pro, not Essentials. See Exium SASE |
| Island Private Access | ZTNA built into the Island Enterprise Browser, via lightweight connectors in your private cloud or data centre | Works on managed, unmanaged and BYOD devices, and alongside an existing ZTNA. See Island Private Access |
| Trend Micro ZTSA | Browser access through a Vision One user portal, with nothing installed | Private Access option; risk-based rules can use Vision One data. See Trend Micro ZTSA |
| DefensX Premium+ | Unmanaged device and BYOD access and ZTNA through the DefensX-protected browser | The highest DefensX plan. See DefensX |
Capabilities and the exact split between tiers change, so we confirm what each product includes for your applications before recommending it.
How we help
We can help you decide which users and applications suit agentless access, run a pilot with a contractor group or BYOD team, and configure policies, session controls and logging. Scope is confirmed at quote, and pricing depends on users and options, so ask us for a quote. Contact us to discuss your requirements.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is agentless ZTNA?
Agentless ZTNA gives users access to specific private applications through a web browser without installing a ZTNA client. The user signs in with MFA, the service applies policy and proxies the session to the application through an outbound-only connector, and the rest of the network stays hidden.
What is the difference between clientless and client-based ZTNA?
Client-based ZTNA uses an agent that reports device health and supports a wide range of protocols. Clientless ZTNA works through the browser, needs nothing installed and suits unmanaged devices, but has weaker device posture checks and mainly supports web applications.
Is agentless ZTNA secure enough for BYOD?
It can be, if access is limited to appropriate applications, MFA is enforced, sessions are re-evaluated and data controls stop corporate data leaving the session. An enterprise browser adds controls over downloads, copy and paste and printing that a plain browser portal does not.
Can agentless ZTNA handle RDP and SSH?
Some products can. Cisco lists browser-based SSH and RDP in Cisco Secure Access clientless ZTNA, and Check Point's Agentless ZTNA covers RDP, SSH and VNC as well as web applications. Others are limited to web apps, so check each application against the product during a trial.
Do I still need agent-based ZTNA if I use agentless access?
Usually, yes, for employees on company devices. Agent-based ZTNA gives deeper device posture checks and supports thick-client apps and file shares. Most organisations use agent-based access for staff and agentless access for contractors and personal devices.
Still have a question about agentless ZTNA?
Ask us and a member of our team will reply by email.
More zero trust access guides
Island Private AccessZTNA inside the Island Enterprise Browser, with last-mile data controls for staff, contractors and BYOD.How ZTNA worksA ZTNA connection step by step: signals, policy engine, connectors, client and clientless access.Secure remote accessSecure remote access by use case: staff, admins, suppliers and personal devices, with the products for each.VPN alternativesSeven ways to give staff and suppliers remote access without a traditional VPN, with products for each.
Check Point ZTNAPrivate Access in the Check Point SASE Platform: agent-based and agentless ZTNA over a private backbone.
Exium (NETGEAR)Exium is now part of NETGEAR: what that means, and what Exium SASE Essentials, SASE Pro and Cyber Gateway do.