In short
Zero trust access (ZTA) is an approach to access control in which no user, device or network is trusted by default. Every request is authorised against policy using identity, device health and context, with least privilege and continuous verification. ZTNA is its network-access implementation; zero trust architecture is the wider design covering identity, devices, data and monitoring.
Get a quote for zero trust access
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Zero trust access defined
Traditional access control trusted location. If you were in the office, or connected over the VPN, you were treated as an insider and could usually reach a wide slice of the network. Zero trust access removes that inherent trust. The NCSC describes zero trust as an approach to system design where inherent trust in the network is removed, the network is assumed hostile and each access request is checked against an access policy.
In practice, zero trust access means three things:
- Explicit authorisation: every request, to every resource, is checked against policy before access is granted
- Least privilege: users and services get access to the specific applications and data they need, not to everything on the same network
- Continuous verification: trust is not granted once at sign-in; it is re-evaluated as the device, the user's behaviour or the sensitivity of the request changes
It applies to people, devices and services, to private applications and SaaS, and to users in the office as well as at home. Zero trust access is not a product you can buy; the NCSC is explicit that zero trust is an architectural approach rather than a single product. Products help you implement it. Our wider guide to zero trust security covers the strategy.
ZTA vs ZTNA vs zero trust
The terms are often used interchangeably, which causes confusion when comparing products. This is how they relate:
| Zero trust (the model) | Zero trust access (ZTA) | Zero trust network access (ZTNA) | |
|---|---|---|---|
| What it is | A security philosophy: assume no implicit trust, verify explicitly | Applying that philosophy to access decisions for users, devices and services | A specific architecture for brokering network access to applications |
| Scope | Everything: identity, devices, networks, applications, data, monitoring | Who and what can reach which resources, under which conditions | User-to-application connectivity, usually for private apps |
| Typical controls | Strategy, architecture principles, roadmap | Identity provider, MFA, conditional access, device compliance, policy engines | ZTNA client, cloud broker, connectors, per-app policy |
| Can you buy it? | No | Not as one product; it spans several | Yes, as a product or as part of SSE or SASE |
| UK reference | NCSC zero trust architecture design principles | The same principles, especially policies and authentication | NCSC ZTNA guidance (May 2026) |
So ZTNA vs ZTA is a question of scope: ZTNA is one implementation of zero trust access, aimed at the network path. ZTNA vs zero trust is a question of level: zero trust is the overall approach, and ZTNA is one of the tools that delivers part of it. The NCSC's guidance treats ZTNA as one part of a wider zero trust architecture, not a standalone fix. See how ZTNA works for the mechanics.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Zero trust access control: the principles in practice
Zero trust access control turns the model into rules a system can enforce. The core ideas, mapped to the NCSC design principles:
| Principle | What it means for access control | NCSC design principle |
|---|---|---|
| Policy-based decisions | A policy engine, not network position, decides whether a request is allowed | Use policies to authorise requests |
| Strong identity for users, devices and services | Every requester has a verifiable identity; MFA for people, certificates or managed identities for devices and services | Know your user, service and device identities |
| Device health counts | An unmanaged or unhealthy device gets less access, or none | Assess user behaviour, service and device health |
| Authenticate everywhere | Internal applications check identity too, not just the edge | Authenticate and authorise everywhere |
| Least privilege | Access is scoped per application, and per action where the app supports it | Use policies to authorise requests |
| No trusted networks | The office LAN and VPN address pools are treated as untrusted | Don't trust any network, including your own |
| Watch and adapt | Decisions are logged, monitored and fed back into policy | Focus your monitoring on users, devices and services |
Our summary of the NCSC zero trust principles goes through each one.
What a zero trust access policy looks like
Policies are easiest to understand as examples. A small set of rules for a professional services firm might read:
| Who | Device | Resource | Condition | Result |
|---|---|---|---|---|
| Finance group | Managed, compliant laptop | Finance system | Phishing-resistant MFA | Allow |
| Finance group | Unmanaged personal device | Finance system | Any | Deny, or browser-only access with no downloads |
| All staff | Managed laptop or phone | Intranet and HR self-service | MFA within the last working day | Allow |
| IT administrators | Dedicated admin device | Server management (RDP, SSH) | Fresh MFA for each session | Allow, session logged |
| Contractors | Any | One project application | Named account, time-limited | Allow through a browser only |
| Any user | EDR alert raised on the device | All private apps | Alert active | Block until resolved |
Notice what is missing: no rule says "anyone on the office network". The NCSC's ZTNA guidance recommends keeping policies to a small number of standard categories so they remain manageable, and treating location as a supporting signal at most.
Is zero trust access the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Zero trust access architecture: the building blocks
A zero trust access architecture usually combines:
- An identity provider such as Microsoft Entra ID, with MFA, single sign-on and joiner, mover and leaver processes. See ZTNA vs IAM for why this comes first.
- Device management and endpoint security, so device identity and health can feed access decisions.
- A network-level policy engine: ZTNA, or the private access part of an SSE or SASE platform, for private applications.
- Application-level policy in the identity provider for SaaS, using conditional access and short-lived tokens.
- Segmentation inside the network, because ZTNA controls user-to-app access but does not stop lateral movement between servers on its own. See network segmentation vs microsegmentation.
- Central logging in a SIEM, so every decision can be explained and reviewed.
The products we supply cover different parts of this picture; ZTNA providers compares them.
"Zero Trust Access" in Cisco Secure Client
If you searched for zero trust access because you saw "Zero Trust Access" in the client software on your work laptop, that may be a product name rather than the general concept. Zero Trust Access is a module in Cisco Secure Client, the agent formerly known as AnyConnect. It makes per-application connections to private apps through Cisco Secure Access, so seeing it usually means your organisation uses Cisco's ZTNA. Your IT team manages it; the details are on our Cisco site under Cisco ZTNA.
How we help
We help organisations turn zero trust access from a slide into working policy: mapping who needs what, fixing identity and device foundations, choosing a ZTNA or SSE platform and writing the first set of rules. We can start with a review of your current access model and a short written plan, with scope confirmed at quote. Contact us to arrange it.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is the difference between ZTNA and ZTA?
Zero trust access (ZTA) is the broad principle of granting access only after explicit, policy-based verification of user, device and context. ZTNA is one implementation of it, focused on brokering network access to applications. ZTA also covers SaaS access through the identity provider, device compliance and access inside the network.
Is zero trust the same as ZTNA?
No. Zero trust is the overall security approach, covering identity, devices, networks, applications, data and monitoring. ZTNA is one technology that applies zero trust to remote and private application access. The NCSC treats ZTNA as one part of a wider zero trust architecture.
What is zero trust access control?
It is access control in which every request is authorised by a policy engine using identity, device health and context, with least privilege and continuous re-evaluation. Being on the office network or connected to a VPN grants nothing by itself.
What is Zero Trust Access in Cisco Secure Client?
Zero Trust Access is a module in Cisco Secure Client, the agent formerly known as AnyConnect. It provides client-based, per-application access to private apps through Cisco Secure Access, Cisco's security service edge. If it appears on your laptop, your organisation uses Cisco's ZTNA; your IT team manages it.
Can a small business implement zero trust access?
Yes, in proportion. MFA on every account, managed devices, per-application access instead of a full-network VPN and DNS or web protection cover much of the ground, using services licensed per user or device. See our page on ZTNA for small business.
Still have a question about zero trust access?
Ask us and a member of our team will reply by email.