EasyAccess ZTNA: access without the network
Application-layer tunnels that give a user exactly the services their policy allows, and nothing else. Device posture is verified before the connection and continuously during the session, across 43 classes of check that need no MDM or EDR platform underneath them. All of it runs in your infrastructure.
- Device posture
- 43 classes of check, continuous
- Licensing
- Per concurrent session
- Deployment
- Your infrastructure only
The VPN was never an access control
A VPN answers one question, whether this device is allowed onto the network, and then stops asking. Everything after that is a routing problem, not a security decision.
That model made sense when the office was the perimeter. It does not survive contractors, personal devices, cloud workloads and staff who sign in from four countries in a month. The moment credentials are phished or a laptop is compromised, the attacker inherits the same network reach as the employee, and the VPN has no further opinion on the matter.
Virtual desktops are the usual escape hatch, and they trade the problem for latency, licence cost and a worse day for the user. Cloud-delivered ZTNA solves the control problem but routes your internal traffic through someone else's infrastructure, which is precisely what a regulated organisation cannot sign off.
Lateral movement is the default
Once on the network, a compromised device can reach everything the route table allows, including systems the user was never meant to see.
Device health is checked once, if at all
Antivirus disabled, disk encryption turned off or a firewall switched off mid-session goes unnoticed until the next connection.
Detection is somebody else's product
Anomalous transfers, vulnerable services and the incident that follows arrive as three more vendors, three more consoles and three more audit trails.
The audit trail is thin
Connection logs tell you a tunnel existed. They rarely tell you which service was reached, under which policy, or why an attempt was refused.
A complete access platform
Everything below ships in the same product, administered from one console and written to one audit log.
Zero Trust access
Per-service authorization over QUIC, with automatic WebSocket fallback where UDP is blocked. The network itself is never exposed.
- Application-layer tunnels, no network route
- Registered-devices-only mode
- TLS 1.3 with certificate pinning
- Virtual routing tables for traffic isolation
- Local SOCKS5 proxy and browser extension
Device posture
A single posture engine gates the connection and keeps re-evaluating it while the session is live, rather than checking once at connect time. Forty-three classes of check run on the device itself, so nothing has to be bought and rolled out underneath them first.
- Operating system version, patch level and pending reboots
- Antivirus, EDR, firewall and disk encryption
- TPM, Secure Boot and exploit protection
- File, registry, certificate and process checks
- Third-party VPN, Tor, proxy and virtual machine detection
- Observation mode that logs or warns before it blocks
Identity and MFA
Federate with the identity provider you already run, or use the built-in directory. Administrators get a separate portal with multi-factor authentication enforced.
- SAML 2.0 and OAuth 2.0 / OIDC single sign-on
- SCIM 2.0 user and group provisioning
- TOTP and WebAuthn (FIDO2) factors
- Role-based access control: 11 built-in roles, 92 permissions
- OAuth device authorization grant for CLI
- AWS IAM Identity Center synchronisation
Data protection
Tunnel traffic stays encrypted from client to service. There is no interception point and no decrypted copy, so policy works on how much data moves, when, and to which service.
- Volumetric thresholds per session and per service
- Off-hours and out-of-schedule transfer detection
- Tiered enforcement rather than a single block
- GeoIP filtering and work-time schedules
- Findings raised as incidents, not silent counters
Threat detection and response
Detection feeds an incident workflow with a defined lifecycle, kept separate from the audit log so that investigation does not pollute the record.
- Behaviour analysis on per-user baselines and rules
- Security incidents with triage and resolution
- Automatic quarantine with cluster-wide tunnel teardown
- CVE scanning across NVD, OSV, GitHub Advisories, CISA KEV and EPSS
- Optional automatic shutdown of a service on a critical finding
Operations
Built for the team that has to run it on a Tuesday: live dashboards, scheduled jobs you can pause, and a health report that produces one score.
- Security Health Center with cluster-wide grading
- Web application firewall in front of the EasyAccess portal and API
- Live dashboard and sessions over Server-Sent Events
- Audit log with filters, retention and CSV export
- Automatic Let's Encrypt certificates, synced across the cluster
- Prometheus metrics, Grafana dashboards, health probes
What your administrators see
One console for access policy, data protection, incidents and compliance evidence.
Management dashboard
Active sessions, security health, open incidents and licence utilisation, updating live over Server-Sent Events rather than on a refresh timer.
Security policies
Device posture requirements, geographic restrictions and time-based rules, composed per group and per service.
Security health
A cached, cluster-wide report that turns the state of the deployment into a single score and grade with the contributing findings.
Data loss prevention
Volumetric and off-hours detection with tiered enforcement, so a first offence need not be a hard block.
Web application firewall
OWASP Top 10 protection in front of the EasyAccess portal and API, with its own metrics and a distinction between WAF bans and security incidents.
Behaviour analysis
Anomaly detection across session activity: sustained downloads, off-hours access and volumetric outliers.
Geographic access
Where sessions originate, drawn on map tiles the server builds and serves itself. No third-party tile provider is contacted.
Audit log
Filterable, retained and exportable as CSV from the server.
Incidents
A SOC lifecycle with triage and resolution, separate from the audit trail.
Quarantine
Isolation that tears down tunnels across the cluster and locks sign-in.
Sessions
Who is connected, to which service, from where, right now.
Vulnerabilities
CVE exposure per published service, correlated across several sources.
API keys
Integration tokens with scoped permissions, rotation and usage audit.
What you run
A clustered control plane, a native desktop client and a browser extension, all released together under one version number.
Where the differences actually are
The meaningful choice is not between vendors, it is between three ways of delivering access control, and what each one does with your traffic.
| Legacy VPN | Cloud-delivered ZTNA | EasyAccess | |
|---|---|---|---|
| Traffic stays inside your perimeter | ✓ | ✗ | ✓ |
| Per-service authorization | ✗ | ✓ | ✓ |
| Continuous device posture during the session | ✗ | ~ | ✓ |
| Vulnerability scanning and behaviour analysis | Separate products | Priced modules | Included |
| Air-gapped deployment | ~ | ✗ | ✓ |
| Vendor can observe your traffic | No | By design | No |
| Commercial model | Appliance plus support | Per-seat subscription | Term licence, you host it |
Evidence, not assertions
EasyAccess ZTNA ships a control matrix in which every claim is tied to code in the product, with each control marked as implemented, partial or operational. Controls are mapped to:
- PCI DSS v4.0
- ISO 27001:2022
- SOC 2
- NIST SP 800-53 Rev. 5
- OWASP ASVS 4.0
- GDPR
- SWIFT CSP v2024
Mapping controls to a framework is not the same as holding a certificate. SOC 2 Type II certification is in progress; ISO 27001 certification is planned. We will say so plainly in a procurement process rather than let a logo imply otherwise.
Bring your own licence
You host the software and hold a licence for it. Licences count concurrent sessions rather than named employees, which is the cheaper unit for shift teams and contractors. They are cryptographically signed, bound to the deployment, audited across cluster nodes, and can be activated offline.
Ready to retire the VPN?
We will walk through EasyAccess ZTNA against your own services, identity provider and compliance obligations, and tell you where it does not fit, if it does not.