Updated November 2026
The short version
- ZTNA grants access app by app, based on who the user is, the device they use and the context of the request.
- Unlike a typical VPN, it does not connect users to the whole network, which limits how far an attacker can move with stolen credentials.
- It is one of the core security services in SASE, and Cisco calls it a good start toward a zero trust approach.
What zero trust means
Zero trust is a security approach described by NIST in Special Publication 800-207. It assumes no user or device is trusted just because of where it is on the network or who owns it. Each person and device is checked before a session with a company resource starts.
NIST describes zero trust as a response to remote users, personal devices and cloud services that sit outside the company network. Protection moves from the network edge to the users, devices and resources themselves.
How ZTNA works
Cisco describes ZTNA as a service that verifies users and devices and grants access to specific applications based on identity and context policies. In practice, it works like this:
- Minimal access: each connection request is checked against policy, and users reach only the applications their role needs.
- Segmentation: boundaries around individual applications and assets limit how far a threat can spread.
- Hidden applications: apps are hidden from public discovery, and users are connected to the app without joining the network.
- Ongoing checks: user and device behavior keeps being monitored once access is granted.
ZTNA compared with a VPN
A VPN usually checks a user once and then connects them to a part of the network. ZTNA checks identity, device and context for each access and connects users only to approved applications.
- What users reach
- Typical VPN: A segment of the network
- ZTNA: Specific applications
- Trust
- Typical VPN: Often trusts more once logged in
- ZTNA: Checks identity, device and context for each access
- App visibility
- Typical VPN: Network resources may be discoverable
- ZTNA: Apps can be hidden from public discovery
- Cloud apps
- Typical VPN: Traffic may be routed back through a data center
- ZTNA: Users can connect directly to approved apps
- Contractors and partners
- Typical VPN: May need broad access or complex setup
- ZTNA: Can be given access to just the apps they need
Cisco notes that ZTNA can replace VPNs for remote, in-office and hybrid work. The move can happen in stages, keeping a VPN for some uses while ZTNA rolls out.
Client-based and clientless ZTNA
ZTNA can be set up in two ways, and many organizations use both:
- Client-based: software on a company-managed device checks the device's health and enforces policy. This suits employees on company devices.
- Clientless: browser-based access to specific web apps with nothing to install. This suits contractors, partners and personal devices.
How ZTNA fits with SASE and MFA
ZTNA is one of the core security services in SASE, alongside a secure web gateway, a cloud access security broker and firewall as a service. SASE delivers them together with SD-WAN networking, so the same rules apply at every office and for every remote worker.
ZTNA also depends on strong sign-in. Cisco's steps for setting up a zero trust network include defining multifactor authentication (MFA) policies so users and devices can reach the assets they need, then monitoring and checking access over time.
Getting started with zero trust
CISA's Zero Trust Maturity Model describes zero trust as a shift from protecting locations to protecting data, users and systems, and notes that it may require a change in how an organization thinks about cybersecurity. It lays out stages from traditional to optimal, so organizations can move step by step.
Cisco suggests a simple order: work out which assets matter most and how exposed they are, set MFA and access rules for the people and devices that need them, then keep monitoring and checking access.
How 5x5 Telecom can help
5x5 Telecom provides SASE, which by Cisco's definition includes ZTNA, along with network security services such as managed firewalls and secure remote access. The services in your plan are set in your service agreement.
Start with a free security consultation: a look at how your network, devices and staff are protected today, a few questions and general recommendations. Detailed testing and hands-on work are scoped in the plan we propose.