In short
Barracuda ZTNA is SecureEdge Access, which Barracuda calls a simple yet powerful ZTNA solution: per-application access from the SecureEdge Access Agent, managed in a web console with no hardware to install, TINA-encrypted tunnels and Advanced Threat Protection inspection. Forever Systems can quote and set up Barracuda SecureEdge Access for UK organisations.
Get a quote for Barracuda SecureEdge Access
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What is Barracuda SecureEdge Access?
Barracuda describes SecureEdge Access (opens in a new tab) as "a simple yet powerful ZTNA solution that delivers enterprise-class access control for any organization". It is Barracuda's zero trust network access, sometimes searched as Barracuda zero trust access or Barracuda SecureEdge ZTNA, and Barracuda's own page sets out four points:
| What Barracuda says | What it means for you |
|---|---|
| An easy-to-use web UI and no hardware to install | Policy is set in a cloud console; nothing has to be racked to get started |
| Access to unlimited applications in any private cloud or SaaS, including on-premises, using any type of client, with no bandwidth limits | One service for internal servers, private cloud workloads and SaaS applications |
| Barracuda's own TINA encryption protocol, with traffic optimisation and intelligent packet loss reduction | Tunnels designed to stay stable on busy or shared internet lines |
| Traffic inspection with Barracuda Advanced Threat Protection, including sandboxing and category-based web filtering | Threat protection on the same connection, not only access control |
Source: Barracuda, checked 9 November 2026. In Barracuda's documentation the original SecureEdge Access ZTNA subscription is now called SecureEdge Private Access, one of the SecureEdge Access plans (opens in a new tab). SecureEdge Access is also part of Barracuda's wider SecureEdge platform with Secure SD-WAN, covered on our sister site as Barracuda SecureEdge SASE (opens in a new tab).
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How Barracuda zero trust access works
Barracuda's SecureEdge Access documentation (opens in a new tab) describes the parts below. They follow the general pattern on how zero trust network access works, with Barracuda's names:
| Part | Role |
|---|---|
| SecureEdge Access Agent | A unified agent on the user's device for ZTNA and web security; Barracuda lists Windows 10 or later, macOS 11 or later, iOS 12 or later, Android 11 or later and Linux |
| SecureEdge Manager | The web console where you define users, resources and policies; Barracuda says (opens in a new tab) changes to user-related settings are pushed to the agent immediately |
| Points of presence (PoPs) | Barracuda's global cloud entry points, used by default, linked to the agent by TINA tunnels |
| Private points of presence | Your own Barracuda CloudGen Firewalls, SecureEdge Edge Services or sites acting as access points (on the Private Access plan) |
| ZTNA policies | Rules that set which resources each user or group can reach, the access criteria, security inspection and device posture |
| Identity | Single sign-on with Microsoft Entra ID, Okta, OpenID Connect or any SAML service, plus Active Directory and SCIM provisioning |
Barracuda's ZTNA policies (opens in a new tab) can require device posture before access is granted, with checks that vary by platform:
- Screen lock and blocking jailbroken devices on Android and iOS
- Firewall enabled on macOS and Windows, and antivirus enabled on Windows
- Disk encryption on Android, Windows, macOS and iOS
- Agent updates on every supported platform and operating system updates on Android, Windows, macOS and iOS
Barracuda's documentation notes that internal resources are always sent through SecureEdge, while SaaS traffic can be routed through it for inspection per policy. That supports the NCSC's advice to use multiple signals and enforce policy before granting access, summarised on NCSC ZTNA guidance.
Security and visibility built in
Barracuda positions threat protection as part of the access service rather than an add-on. Its page says SecureEdge Access inspects traffic with Barracuda Advanced Threat Protection, including sandboxing and category-based web filtering that blocks known bad sites, so users are stopped from reaching malicious websites or downloading malware.
For audit and compliance, Barracuda says you get control and visibility over which users and devices, in which locations, reach which applications and websites, with reporting and detailed logs kept for 30 days as standard. If longer retention matters to you, we include sending logs to your SIEM in the design.
The plans Barracuda documents build up from DNS filtering (opens in a new tab) to full web security:
| SecureEdge Access plan | What Barracuda says it covers |
|---|---|
| DNS Access | Agent-based DNS filtering, with enforcement in Barracuda's cloud |
| Private Access | Zero trust network access to private and public resources, with basic DNS filtering; supports both PoPs and private PoPs |
| Internet Access | Web filtering with SSL/TLS inspection and agent-based web security with AI content inspection |
| Premium Access | Everything in the DNS, Private and Internet Access plans, plus Data Loss Prevention (DLP) and Firewall as a Service (FWaaS) |
For zero trust access to private applications, Private Access is the starting point.
Is Barracuda SecureEdge Access the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Barracuda SecureEdge Access compared with other ZTNA products
We supply several ZTNA products, so the useful question is which one fits your estate. Here is how SecureEdge Access compares with three others:
| Barracuda SecureEdge Access | Cisco Secure Access | Check Point Private Access | Sophos ZTNA | |
|---|---|---|---|---|
| How users connect | SecureEdge Access Agent | Cisco Secure Client, or clientless browser access | Agent, agentless browser access or Enterprise Browser | ZTNA agent or Sophos Protected Browser |
| Where access is brokered | Barracuda PoPs, or your own Barracuda firewalls and Edge Services | Cisco's cloud, and Secure Firewall on site with universal ZTNA | Check Point's cloud gateways over its private backbone | A Sophos ZTNA gateway on Sophos Firewall or a virtual machine |
| Inspection on the same connection | Advanced Threat Protection; web security on higher plans | Secure Internet Access | Internet Access tiers | Sophos Workspace Protection |
| Often suits | Smaller IT teams and Barracuda firewall estates | Cisco Secure Firewall, Secure Client and Duo estates | Many third parties and multi-site organisations | Sophos Firewall and Sophos Endpoint estates |
See Check Point ZTNA, Sophos ZTNA (opens in a new tab) on our Sophos site, and every product side by side on ZTNA vendors. If you are weighing SecureEdge Access against Zscaler Private Access, see Zscaler competitors.
Deploying SecureEdge Access and moving off VPN
Barracuda says SecureEdge Access guides you step by step through implementation, and when you are ready for production you "flip the switch". A typical project with us looks like this:
- Map current remote access: which users reach which applications over the VPN today, and from which devices.
- Connect identity: link Microsoft Entra ID, Okta or another SAML or OpenID Connect provider, with SCIM so joiners and leavers flow through.
- Choose access points: Barracuda's PoPs, or your existing Barracuda firewalls as private points of presence if you run them.
- Define resources and ZTNA policies per group, with the device posture checks each group must pass.
- Pilot with one team: enrol their devices, test each application and review the logs together.
- Roll out in waves, then close the old VPN and any port-forwards so there is no second route around the new policy.
One practical point from Barracuda's documentation: Barracuda CloudGen Access and the SecureEdge Access Agent cannot both be active on the same device, and third-party agents that intercept DNS have to be tested one by one, so we check the software already on your devices before the pilot. The wider project is covered on VPN replacement.
Licensing and how Forever Systems helps
SecureEdge Access is licensed per user on the plan you choose, and it can be billed monthly, with terms confirmed at quote. Ask us for a quote based on your users and the applications they need; the cost drivers for any ZTNA product are on ZTNA cost.
Forever Systems can quote and set up Barracuda SecureEdge Access. We can:
- Assess your current VPN, firewalls, identity provider and the applications people need
- Recommend the right plan, and whether to use Barracuda's PoPs or your own firewalls as access points
- Deploy the agent, policies and posture checks, starting with a pilot group
- Support the rollout and later policy changes, with scope confirmed at quote
Contact us to talk through your remote access.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is Barracuda SecureEdge Access?
Barracuda SecureEdge Access is Barracuda's zero trust network access service, which Barracuda describes as a simple yet powerful ZTNA solution. Users connect through the SecureEdge Access Agent and reach only the private, cloud or SaaS applications their policy allows, with traffic inspected by Barracuda Advanced Threat Protection.
Does Barracuda ZTNA need hardware?
No. Barracuda says SecureEdge Access has an easy-to-use web interface and no hardware to install, using Barracuda's cloud points of presence. If you already run Barracuda CloudGen Firewalls, they can act as private points of presence on the Private Access plan.
Does Barracuda SecureEdge Access replace a VPN?
For most application access, yes. Barracuda positions it as zero trust access instead of a VPN that puts users on the network, granting access per application with device posture checks. We review your applications first, then move users across in stages and close the old VPN.
Which devices does the SecureEdge Access Agent support?
Barracuda lists Windows 10 or later, macOS 11 or later, iOS 12 or later, Android 11 or later and Linux. The same agent provides zero trust access and, on the higher plans, web security.
Is SecureEdge Access the same as Barracuda SecureEdge?
SecureEdge Access is the user-focused part of Barracuda SecureEdge. The full SecureEdge platform adds Secure SD-WAN and firewall as a service for sites, which our sister site covers under Barracuda SecureEdge SASE.
Still have a question about Barracuda SecureEdge Access?
Ask us and a member of our team will get back to you.
More zero trust access guides
Check Point ZTNACheck Point Private Access: agent-based and agentless zero trust network access over a private backbone.
Cisco universal ZTNAOne per-app zero trust policy for remote and on-site users, enforced by Secure Access and Secure Firewall.VPN replacementRetiring a remote access VPN: the options, an NCSC-aligned migration plan and what changes for users.