In short
The main VPN alternatives for business are client-based ZTNA, clientless (agentless) ZTNA, SSE or SASE platforms, enterprise browsers with private access, RDP brokers, MFA-protected application gateways and segmentation-based remote access. Each gives access to specific applications after checking identity and device, so users no longer join the whole network.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
Why look for an alternative to a VPN?
A traditional remote access VPN authenticates a user once and then gives the device an address on the internal network. What the user can reach after that depends on routing and firewall rules, which are often broad. The VPN gateway also has to accept connections from the internet, which makes it a target.
The alternatives below share a different starting point: access is denied until a policy allows it, and it is granted to an application rather than to the network. That is the core of zero trust network access, explained in how zero trust network access works. They differ in where the policy is enforced, what the user has to install and which applications they suit.
If you are looking for a conventional business VPN to buy rather than an alternative to one, our software licensing site covers that. For the project view (inventory, pilot, migration, switching the old VPN off) see our VPN replacement project guide.
The seven alternatives
1. Client-based ZTNA
How it works: an agent on a managed device connects to a cloud broker or gateway. Each request for a private application is checked against identity, device health and context, then brokered to that application through a connector that makes outbound connections only.
What it replaces: the everyday staff VPN.
Best fit: company-managed laptops reaching web apps, file shares, thick-client apps and SSH or RDP.
Examples we supply: Cisco ZTNA in Cisco Secure Access, Check Point SASE Private Access, Trend Micro ZTSA Private Access, Todyl SASE and Exium SASE.
2. Clientless or agentless ZTNA
How it works: users reach published applications through a web browser via the provider's portal or proxy, with nothing to install.
What it replaces: VPN accounts for contractors, partners and personal devices.
Best fit: web applications for people whose devices you do not manage. Some vendors go further: Cisco lists browser-based SSH and RDP, and Check Point's agentless access covers RDP, SSH and VNC as well as web apps.
Examples we supply: Check Point Agentless ZTNA, Cisco Secure Access clientless ZTNA and Exium SASE Pro agentless access. See agentless ZTNA.
3. SSE or SASE platforms
How it works: ZTNA is combined with a secure web gateway, CASB and usually firewall as a service in one cloud service and one policy; SASE adds SD-WAN for branch sites.
What it replaces: the VPN plus the web proxy and, in some cases, branch firewalls.
Best fit: organisations that want private access and web or SaaS protection for remote users together.
Examples we supply: Cisco Secure Access, Check Point SASE, Trend Micro ZTSA, Todyl SASE, Exium SASE and WatchGuard FireCloud Total Access. See SASE vs SSE.
4. Enterprise browser with private access
How it works: a centrally managed business browser connects to private web apps through connectors in your network, and applies data controls such as copy, paste, download and print restrictions in the browser itself.
What it replaces: VPN or virtual desktop access for unmanaged devices.
Best fit: BYOD, contractors and situations where the data on screen matters as much as the connection.
Examples we supply: Island Private Access in the Island Enterprise Browser, and Check Point Enterprise Browser.
5. RDP brokering
How it works: users sign in to a cloud service with MFA, and the session is relayed to a Windows desktop or Remote Desktop Services host through components that connect outbound only, so no RDP port is open to the internet.
What it replaces: a VPN used only to reach office PCs or RDS, and port-forwarded RDP.
Best fit: firms whose staff work on office desktops, RDS or hosted desktops; administrators reaching servers.
Examples we supply: TruGrid SecureRDP; Keeper Connection Manager and KeeperPAM for browser-based RDP and SSH with vaulted credentials. See secure remote desktop access.
6. MFA-protected application gateways
How it works: a self-hosted gateway, usually in your DMZ, publishes internal web apps, SSH, RDP and file shares to remote users after sign-in through your identity provider and MFA, with a device check before each connection. Web apps open in the browser; SSH, RDP and file shares need Duo's small DuoConnect tool (and Duo Desktop for RDP and SMB).
What it replaces: the VPN for a defined set of internal services.
Best fit: organisations already using Cisco Duo that want to publish a handful of applications without a VPN.
Examples we supply: Duo Network Gateway, part of Cisco Duo Premier.
7. Segmentation-based remote access
How it works: the remote access service has no open ports until a user completes MFA, then a port opens only for that user's IP address for a set time; remote users fall under the same segmentation rules as on-site devices.
What it replaces: an internet-facing VPN, with lateral movement controls added.
Best fit: organisations also tackling lateral movement inside the network, or controlling supplier access tightly.
Examples we supply: Zero Networks Connect. See network segmentation vs microsegmentation.
VPN alternatives at a glance
| Alternative | Client needed | Typical apps | Device posture | Suits |
|---|---|---|---|---|
| Client-based ZTNA | Yes | Web, thick client, file shares, SSH, RDP | Strong (agent reports device health) | Managed staff devices |
| Clientless ZTNA | No (browser) | Web apps; some vendors add browser SSH and RDP | Limited | Contractors, BYOD |
| SSE or SASE | Usually yes | Private apps plus internet and SaaS | Strong | Hybrid workforces, multi-site |
| Enterprise browser | The browser itself | Web and SaaS apps | Browser-level checks | Unmanaged devices, data control |
| RDP brokering | Usually an app | Windows desktops, RDS, RemoteApp, VDI | Varies by product | Desktop-centric firms, admins |
| MFA app gateway | No for web; a small tool for SSH, RDP and file shares | Selected web apps, SSH, RDP, file shares | Device check per connection | Cisco Duo users |
| Segmentation-based access | Yes (lightweight client) | Approved applications | MFA before access | Lateral movement control, suppliers |
The table describes typical designs; each vendor's exact capabilities differ, and we confirm them against your applications before recommending one.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
When a VPN is still the right answer
Some traffic does not suit per-application access. Server-initiated connections (where the data centre calls out to the device), some legacy client-server applications, and site-to-site links between offices are the usual examples. The honest answer is to keep a small, tightly scoped network-level option for those flows rather than leave the whole VPN in place.
Cisco Secure Access includes VPN as a service for this reason, under the same policy and client as its ZTNA. Site-to-site connectivity is a separate decision: IPsec tunnels into an SSE or SASE platform (such as a Todyl SASE Tunnel) or SD-WAN are common answers. Our ZTNA vs IPsec and SSL VPN page covers the technical differences.
How to choose between them
Start from the applications and the people, not the product category:
- List what people reach over the VPN today, from the VPN logs, and tag each application by protocol.
- Split users by device: managed company devices can use client-based ZTNA with posture checks; unmanaged devices are better served by clientless access or an enterprise browser.
- Decide whether you also want web and SaaS protection. If yes, an SSE or SASE platform avoids running two agents.
- Look for remote desktop patterns. If most remote work is RDP to office PCs or RDS, an RDP broker may be the simplest and most focused answer.
- Consider what you already own. Existing Cisco, Check Point or WatchGuard estates, or Cisco Duo licences, can change the shortlist.
The NCSC's guidance on assessing ZTNA services recommends trials or proof-of-concept deployments using realistic scenarios before committing, and checking how a service integrates with your identity provider, device management and monitoring. We can run that evaluation with you, side by side across the options that fit.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
How we help
We supply every alternative on this page, so we can recommend a combination that fits rather than a single product. We can review your current VPN use, shortlist options, run a pilot and help migrate users in stages; scope and timescales are confirmed at quote. Pricing depends on users, devices and the options chosen, so ask us for a quote, or compare costs on zero trust network access cost. Contact us to talk it through.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is the best alternative to a VPN for business?
There is no single answer. For most organisations, zero trust network access (ZTNA) replaces the everyday staff VPN, clientless access or an enterprise browser covers contractors and personal devices, and an RDP broker covers remote desktops. The right mix depends on your applications and devices.
Is ZTNA better than a VPN?
ZTNA limits each user to specific applications after checking identity and device, and hides those applications from the internet, which reduces exposure and lateral movement compared with a typical VPN. A VPN can still suit legacy and site-to-site traffic. See our ZTNA vs VPN comparison for the detail.
What is a zero trust VPN alternative?
It is any remote access method that denies access by default and grants it per application after checking the user, device and context, rather than placing the device on the network. ZTNA, enterprise browsers with private access and segmentation-based remote access all fit this description.
Can contractors get access without a VPN?
Yes. Clientless ZTNA lets contractors reach approved web applications through a browser after signing in with MFA, with nothing to install. Enterprise browsers such as the Island Enterprise Browser or Check Point Enterprise Browser add controls over downloads, copy and paste and printing on devices you do not manage.
Do VPN alternatives work for remote desktop?
Yes. RDP brokers such as TruGrid SecureRDP put cloud authentication and MFA in front of Windows desktops and RDS with no inbound ports, and several ZTNA platforms support RDP either through their client or in the browser.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.