What is ZTNA?
ZTNA (zero-trust network access) is an approach to access in which no user or device is trusted just because it is on the network. Every request to reach a resource is checked against verified identity and policy, and access is granted narrowly, to specific applications or systems, rather than to the network as a whole. It applies the zero-trust principle of "never trust, always verify" to the question of who can reach what.
ZTNA (zero-trust network access) grants access to specific applications based on verified identity and policy, never trusting a user or device just for being on the network.
What defines ZTNA
- 01
Identity- and policy-driven: access decisions are based on who or what is asking and whether policy allows it, not on network location.
- 02
Least privilege: a user or service is granted access only to the specific resources it needs, not broad network reach.
- 03
No implicit trust: connecting to the network grants nothing on its own; every session is verified.
- 04
Resources stay hidden: internal applications aren't exposed to the open internet and can be reached only through the access layer, by authorized requests.
ZTNA vs a traditional VPN
A traditional VPN authenticates a user once and then places their device on the network, often with broad reach: anyone who connects can probe whatever the routing allows. ZTNA works the other way round. It grants access to individual resources, per session, based on continuous verification, so a connected device can reach only what policy explicitly permits. This sharply limits the damage a stolen credential or compromised device can do, because there is no flat network to roam once you are "in".
How ZTNA is delivered
ZTNA comes in different forms. Large security vendors offer it as part of broad cloud-delivered SASE platforms, where a global service brokers access to applications. Other implementations build zero-trust access into a network fabric or overlay, authenticating every node and session and enforcing least-privilege access by role and segment. What they share is the principle: verify identity, grant minimal access to specific resources, keep those resources off the open internet, and log every connection.
How this relates to Vexaro Mesh (in development)
Vexaro Mesh, now in development, is designed to apply zero-trust principles to access across its mesh rather than as a standalone SASE platform: every node and session authenticated and checked by policy, access granted by role, and internal systems closed off from the public internet and reached only over the fabric, with every connection logged and exportable to your SIEM.
See the planned features