ZTNA (Zero Trust Network Access)

ZTNA is a security model that gives users access to specific private applications without putting them on the full corporate network.
Example: Company employee want to access Jira only(no other application), then providing access to this application only is ZTNA.
Core idea: “Never trust, always verify.” A user on a home laptop or at an airport gets the same scrutiny as someone in a branch office.

Example

A bank employee working from home needs the internal loan-processing app (hosted in a private datacenter).
Without ZTNA: Employee connects VPN → lands on corporate LAN → can reach many servers if ACLs are loose.
With ZTNA: Employee opens the ZTNA client, signs in with Okta MFA, passes device compliance check → broker opens access only to loan-app.internal.bank → traffic flows through an app connector; no VPN, no broad network access.
Vendor Examples
Zscaler Private Access (ZPA), Netskope Private Access, Cloudflare Access, Microsoft Entra Private Access

How ZTNA works (vs traditional VPN)

flowchart LR
  subgraph user_side [User]
    U[Remote user]
  end
  subgraph cloud [ZTNA broker cloud POP]
    PE[Policy engine]
    AC[App connector]
  end
  IDP[Identity Provider]
  APP[Private app on-prem / VPC]

  U -->|1 SSO / MFA| PE
  PE -->|2 verify| IDP
  PE -->|3 posture check| PE
  U -->|4 request app| PE
  PE --> AC
  AC -->|5 micro-tunnel| APP
  APP --> AC --> PE --> U
        

ZTNA vs SWG (Secure Web Gateway)

ZTNA vs Zero Trust Forward Proxy (ZTFP)

A Zero Trust Forward Proxy applies zero-trust principles to outbound HTTP/HTTPS traffic — the same path as an SWG or enterprise forward proxy. It authenticates the user, enforces identity-aware policy, may do SSL inspection, DLP, and audit logging before traffic leaves to the internet.

Terms and components included in ZTNA