In short
ZTNA (zero trust network access) is a way of giving users access to individual applications, never a whole network, only after checking who they are, their device and the context. The NCSC calls it an architectural approach in which connectivity alone never grants access. UK businesses mainly use it to replace or shrink a remote access VPN.
Want help with What is ZTNA??
We can plan it with you or do it for you. Tell us where you are up to.
ZTNA meaning: zero trust network access in plain words
The ZTNA full form is zero trust network access. The "zero trust" part means no user, device or network is trusted just because of where it is; the "network access" part means it controls how people reach applications over a network.
The UK's National Cyber Security Centre defines it in its ZTNA guidance (opens in a new tab) as "an architectural approach for controlling how users and devices access applications over a network". In a ZTNA approach, the NCSC says, network connectivity alone never grants access to a service, and each access request is explicitly authorised, based on defined policy and contextual information.
In practice, ZTNA in cyber security comes down to four ideas:
- Per-application access: a user is connected to one approved application at a time, not placed on the network
- Checks before every connection: identity, sign-in strength, device health and context are assessed by a policy engine first
- Hidden applications: private apps sit behind outbound-only connectors, so they have no open ports on the internet
- Continuous verification: access is re-checked during the session and can be cut if something changes, such as a security alert on the laptop
The NCSC sees two main uses: private application access, for apps hosted on-premises or in a private cloud, and SaaS application access, enforced mainly through single sign-on and application-level policy. How the parts fit together is on ZTNA architecture.
ZTNA explained through three examples
Definitions only go so far. These are the situations where most businesses meet ZTNA:
| Situation | Without ZTNA | With ZTNA |
|---|---|---|
| A finance app used by staff in the office and at home | Home users connect to the VPN and can usually reach the whole server network; office users are trusted because they are on the LAN | Everyone, in the office or at home, reaches the finance app only, after MFA and a check that their laptop is managed and healthy |
| A contractor who needs one system for a three-month project | A VPN account that reaches far more than the project, often left active after the work ends | Browser-based access to that single application, with a named account that expires when the project does |
| Remote desktop (RDP) to a server for an IT administrator | RDP published to the internet, or reached over the VPN, protected by a password | No inbound RDP port; the administrator signs in with fresh MFA on a dedicated device and every session is logged |
In each case the user still gets their work done. What changes is how much an attacker could reach with the same stolen password: one application, under policy, instead of the network. More remote desktop detail is on secure remote desktop access.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
ZTNA vs VPN at a glance
The comparison most people want first. A VPN connects a device to a network; ZTNA connects a user to an application.
| Remote access VPN | ZTNA | |
|---|---|---|
| What the user reaches | A network segment, often much more than they need | Only the applications their policy allows |
| When trust is checked | Mainly once, at connection | Before every connection and during the session |
| Device health | Often not checked, or only at sign-in | Used as a signal in the access decision |
| Exposure to the internet | A VPN gateway listening for inbound connections | Applications behind outbound-only connectors; nothing to scan |
| Office users | Usually trusted because they are on the LAN | The same policy applies in the office as at home |
| Logging | Who connected, and when | Who reached which application, on which device, and which policy allowed it |
The NCSC says zero trust and a VPN are not mutually exclusive, and some legacy applications still need a tunnel. The full comparison, including when a VPN is still reasonable, is on ZTNA vs VPN.
Client-based and clientless ZTNA
ZTNA is delivered in two ways, and many platforms offer both:
- Client-based ZTNA uses an agent on the device. It covers web and non-web applications, such as file shares, RDP and thick-client software, and reports device health to the policy engine. It suits managed staff laptops.
- Clientless ZTNA works through a web portal or an enterprise browser (opens in a new tab), with no agent to install. It suits contractors, partners and personal (BYOD) devices, but sees less about the device and mainly covers web applications.
Cisco, for example, describes Cisco Secure Access as using "client or clientless-based methods" for ZTNA, with VPN as a service for applications that ZTNA cannot handle (cisco.com (opens in a new tab), checked 9 November 2026). Island takes the browser route: Island Private Access works with the Island Enterprise Browser, which Island says can be installed on managed or unmanaged devices (island.io (opens in a new tab), checked 9 November 2026). The trade-offs are on agentless ZTNA.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Where ZTNA sits: on its own or inside a wider platform
ZTNA can be bought on its own, or as the private-access part of a Security Service Edge or SASE platform that also protects web and SaaS use, and, in the case of SASE, connects branch offices. If that wider picture is what you are weighing up, our sister site covers SASE (opens in a new tab).
ZTNA is also one part of zero trust, not the whole of it. Zero trust covers identity, devices, data and monitoring as well; what is zero trust security? explains the wider model, and zero trust access shows how the terms relate.
Who uses ZTNA
ZTNA is used by organisations of every size whose people work away from the office or whose applications have moved out of a single building:
| Organisation | Typical reason for ZTNA |
|---|---|
| Small and mid-sized businesses | Replacing an ageing VPN or exposed remote desktop with per-user access and no hardware; see ZTNA for small business |
| Professional services firms | Keeping client data in specific applications reachable only by the right teams on managed devices |
| Healthcare providers | Controlling access to clinical and administrative systems for staff, locums and suppliers; see zero trust for healthcare |
| Schools, colleges and universities | Giving staff remote access to management information systems without opening the network; see zero trust for education |
| Public sector bodies | Aligning remote access with the NCSC's zero trust guidance; see zero trust for the public sector |
| Retailers and multi-site businesses | Giving head office, stores and suppliers access to specific systems; see ZTNA for retail |
ZTNA products we supply
Forever Systems supplies several ZTNA platforms, including Cisco Secure Access, Check Point SASE Private Access (Check Point SASE was formerly Harmony SASE), Trend Micro ZTSA, Island Private Access, NordLayer, Todyl SASE, Timus SASE, Zero Networks Connect, Exium SASE and TruGrid SecureRDP. They differ in how users connect, what else they protect, how they are licensed (per user or per device) and how well they fit what you already run.
Rather than recommend one for everyone, we compare two or three against your users, applications and existing tools, and can run a trial with a pilot group first, which the NCSC recommends before committing. The side-by-side detail is on ZTNA providers, and pricing is per user or device, so ask us for a quote. Contact us to talk through your remote access.
ZTNA in more depth: how it works, cost and who uses it
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is the full form of ZTNA?
ZTNA stands for zero trust network access. It describes giving users access to specific applications only after their identity, device and context have been checked, instead of placing them on the network as a VPN does.
Is ZTNA a VPN?
No. A VPN connects a device to a network, after which the user can usually reach much of it. ZTNA connects a user to individual applications under policy, with the applications hidden behind outbound connectors. Some ZTNA platforms include VPN as a service for legacy applications that still need a tunnel.
Is ZTNA the same as zero trust?
No. Zero trust is the overall security approach, covering identity, devices, networks, applications, data and monitoring. ZTNA is one technology that applies zero trust to how users reach applications. The NCSC treats ZTNA as one part of a wider zero trust architecture.
Does ZTNA need an agent?
Not always. Client-based ZTNA uses an agent and covers non-web applications with full device checks. Clientless ZTNA works through a browser or enterprise browser with nothing to install, which suits contractors and personal devices but mainly covers web applications.
What is ZTNA in cyber security terms?
It is an access control approach in which network connectivity alone never grants access to a service. Each request is explicitly authorised by policy, using signals such as user identity, device identity, device health and behaviour, and access is re-checked as conditions change.
Still have a question about What is ZTNA??
Ask us and a member of our team will get back to you.