Zero-trust access, designed into the mesh
Vexaro Mesh, now in development, is designed to apply zero trust to network access: being connected grants nothing on its own. Every node and session is to be authenticated, access is least-privilege by role, and internal systems stay off the public internet. A flat VPN, by contrast, trusts whoever joins.
What zero-trust access means
Zero trust drops the old castle-and-moat assumption that everything inside the network is safe. Instead, every connection is verified, continuously, wherever it comes from.
Never trust by location
Connecting to the network doesn't make a user or device trusted. Each node and session is authenticated and checked against policy before it is allowed to reach anything.
Least-privilege access
Access is granted to specific systems by role, so users and services reach only what their job requires, not the whole network the moment they connect.
No implicit exposure
Internal systems are closed off from the open internet and reachable only through the access layer, removing the exposed ports and broad reach that flat VPNs leave behind.
How Vexaro plans to approach zero trust
The zero-trust controls are designed into the fabric itself.
Authenticated nodes and sessions
Every node and session is to be authenticated and evaluated against policy, so no trust is granted simply by being on the network.
Role-based access
Access is planned by department and site from one console, so reach is least-privilege rather than network-wide.
Audit and SIEM export
Every connection, with who connected and when, is planned to be logged and exportable to your SIEM, so access can be verified instead of assumed.
Zero-trust mesh vs a flat VPN
A comparison of zero-trust access on the mesh with a legacy full-tunnel VPN that drops users onto a flat network. These are different security models, not a ranking.
| Vexaro (zero-trust mesh, planned) | Legacy flat VPN | |
|---|---|---|
| Trust model | Verify every node & session | Trust once connected |
| Access scope | Least-privilege by role | Broad network reach |
| Internet exposure | Systems off the public net | Ports / gateways exposed |
| Per-session audit | Logged & SIEM-exportable | Limited / connection-level |
What we don't claim
The term "ZTNA" is mostly associated with large security platforms (such as Zscaler, Palo Alto and Cloudflare) that deliver zero-trust access as part of broad SASE suites. We don't claim to be a SASE platform or to replace one feature for feature. Vexaro Mesh, in development, is designed to apply zero-trust principles to access across its own mesh: authenticated nodes and sessions, role-based access and audit. This page also doesn't name the tunnel protocol; the traffic is planned to be protected with modern cryptography.
Where a zero-trust mesh fits
You want to retire broad VPN access where connecting equals trust, in favor of least-privilege access to specific systems.
You need internal systems such as admin panels, databases and OT kept unreachable from the internet and open only to authorized roles over the mesh.
You need an audit trail of who reached what, exportable to your SIEM, without standing up bastions.