In short
Zero trust solutions are the products that put zero trust into practice: MFA and device trust for identity and devices, ZTNA for per-application access, segmentation for the network and browser or data controls for unmanaged devices. Forever Systems, a Cisco Partner and Check Point Advanced Partner, supplies products from several zero trust vendors and can design, quote and deploy them.
Get a quote for zero trust solutions
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What counts as a zero trust solution
The NCSC's Demystifying Zero Trust (opens in a new tab) is clear that zero trust is not a product you can buy off the shelf. Vendors still use "zero trust solution" for almost anything, so it helps to sort products by the job they do. CISA's Zero Trust Maturity Model (opens in a new tab) gives a useful set of pillars:
| Pillar | What a zero trust solution does here | Typical product type |
|---|---|---|
| Identity | Proves who is asking, with strong MFA and single sign-on | Identity provider, MFA, single sign-on |
| Devices | Checks the device is known and healthy before access | Device trust, device management, endpoint security |
| Networks | Stops being on the network from granting access; limits lateral movement | ZTNA, microsegmentation, network access control |
| Applications and Workloads | Puts each application behind a policy decision, with no inbound ports | ZTNA connectors, application gateways |
| Data | Controls what happens to data once it is on screen | Enterprise browser (opens in a new tab), data controls |
| Visibility (cross-cutting) | Logs every decision so you can see and improve policy | Central logging fed by every product above |
Most businesses already own something in two or three rows. A zero trust project fills the gaps, rather than replacing everything.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Zero trust solutions we supply, by pillar
Each row is a product we supply, described from the vendor's own material:
| Pillar | Product | What it adds |
|---|---|---|
| Identity and devices | Cisco Duo (opens in a new tab) | MFA, including phishing-resistant methods, single sign-on and Device Trust (opens in a new tab): device visibility, device health checks and continuous verification, including on unmanaged and personal devices |
| Access (remote and on site) | Cisco Secure Access with universal ZTNA | Client-based or clientless ZTNA that denies access by default, with the same per-application policy enforced on Cisco Secure Firewall for office users |
| Access to a few internal apps | Duo Network Gateway (opens in a new tab), part of Duo Premier | Browser access to internal web apps, and SSH, RDP and file shares through DuoConnect, without a full VPN; Duo checks the user, device and network against each application's policy (Duo documentation (opens in a new tab)) |
| Access, web and SaaS | Check Point Private Access | Identity-centric zero trust access for employees, third parties and branches, agent-based or agentless, with Internet Access and SaaS Security from the same platform |
| Access for smaller teams | Barracuda, Timus, Todyl, NordLayer, Exium | Cloud-delivered ZTNA without hardware, licensed per user or per device |
| Network | Zero Networks | Automated microsegmentation built from observed traffic, and just-in-time MFA for admin protocols such as RDP, SMB and SSH (Zero Networks (opens in a new tab)) |
| Data and unmanaged devices | Island Private Access | Zero trust access inside the Island Enterprise Browser, with last-mile data controls for contractors and BYOD |
| Remote desktop | TruGrid SecureRDP | Remote desktop to office PCs, RDS and virtual desktops without an exposed RDP port |
Endpoint security that feeds device health into these decisions is covered on our sister site under zero trust endpoint security (opens in a new tab). The ZTNA products are compared side by side on ZTNA vendors.
How to choose between zero trust vendors
There is no single best zero trust provider. The right mix depends on what you already run. These questions narrow it quickly:
- Which identity provider do you use, and is MFA on everywhere? Identity comes first; every other product depends on it.
- Which firewalls and endpoint security do you run? Cisco, Check Point, Sophos and Barracuda estates often get the most from the same vendor's zero trust access.
- How many applications need protecting, and where are they? A handful of internal web apps may suit Duo Network Gateway; dozens of apps across sites and clouds point to a full ZTNA platform.
- Are devices managed? Unmanaged and contractor devices push you towards agentless or browser-based access.
- Do you need segmentation inside the network? If one infected server could reach everything, microsegmentation belongs on the list.
- Who will run it day to day? Some products are built for managed service providers; we can help with day-to-day policy, with scope confirmed at quote.
A short zero trust assessment answers these questions properly, and the NCSC's advice on assessing ZTNA services and providers is summarised on NCSC ZTNA guidance.
Is zero trust solutions the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Zero trust security services
Products are half of it. What usually decides whether zero trust works is the design and the removal of old access routes. Forever Systems can help organisations in London and across the UK with:
- Assessment: an application inventory, access matrix and list of VPN dependencies, measured against the NCSC principles
- Design: which products cover which pillar, with access policies written per application
- Pilot and deployment: one group of users and applications first, then the rest in stages
- Retiring the old routes: closing the VPN, inbound ports and IP allow-lists once replacements are proven
- Ongoing help: policy changes, licence reviews and renewals, with scope confirmed at quote
Rollout steps are on how to implement zero trust, and the business case on benefits of zero trust.
Licensing and quotes
Most zero trust products are licensed per user, on a monthly or annual subscription; a few are per device, and Duo Network Gateway comes with the Duo Premier edition, which is licensed per user. Billing terms are confirmed at quote. Because we supply several vendors, we can quote a combination, for example Duo for identity and devices with a ZTNA platform for access, rather than one vendor's bundle. Cost drivers are explained on zero trust network access cost.
Contact us for free advice on the zero trust solutions that fit your business, or a quote.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What are zero trust solutions?
They are the products that put zero trust into practice: MFA and device trust, zero trust network access (ZTNA), microsegmentation, network access control and browser or data controls. No single product delivers zero trust on its own; together they remove assumed trust from identity, devices, networks, applications and data.
Which zero trust vendors does Forever Systems supply?
Cisco (Duo, Duo Network Gateway, Secure Access and universal ZTNA), Check Point (Private Access), Barracuda, Island, Zero Networks, Trend Micro, NordLayer, Todyl, Timus, Exium, TruGrid, Sophos and WatchGuard. The ZTNA products among them are compared on ZTNA vendors.
What is the best zero trust solution?
There is no single best one. The right choice depends on your identity provider, firewalls, endpoint security, applications and whether devices are managed. A short assessment and a trial of two shortlisted products usually settles it.
Do you provide managed zero trust services?
We can help with ongoing policy changes, licence reviews and renewals for the products we supply, and some products are built for managed delivery. Regulated organisations, such as financial services firms, often want this alongside the design work. Scope is confirmed at quote.
Is ZTNA a zero trust solution?
Yes, it is the part of zero trust that controls how users reach applications. It needs strong identity and device checks to work well, which is why most zero trust projects pair ZTNA with MFA and device trust.
Is Duo Network Gateway a zero trust solution?
It is a zero trust access option for a smaller set of applications. Duo Network Gateway publishes internal web apps, SSH, RDP and file shares to remote users after sign-in and Duo MFA, with a device check per application, without a full VPN. It is part of Cisco Duo Premier.
Still have a question about zero trust solutions?
Ask us and a member of our team will get back to you.