Zero trust network access and remote access
A traditional VPN puts a remote user on the internal network. Zero trust network access (ZTNA) grants access to one application or server at a time, after checking who the user is and the state of the device. That shrinks what a stolen password or a lost laptop can reach.
What we do
- Access policy design by group and resource
- Identity and device posture integration
- Server and database access with audit trails
- Gateway for legacy RDP and SSH
- Contractor access with an end date
- Log forwarding to the SIEM
- Migration from a flat VPN
Our team works with Tailscale and Twingate for private access to internal applications, with Teleport for short-lived, audited access to servers, databases and Kubernetes, and with Apache Guacamole for browser-based RDP, SSH and VNC sessions through a gateway. We tie each one to the customer identity provider and multi-factor authentication, and we write the access policy per group and per resource.
This group links to our Cybersecurity and Managed IT services. The mesh VPN group covers WireGuard and IPsec tunnels between sites. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Tailscale
- Twingate
- Teleport
- Apache Guacamole
- Cloudflare Access
- Zscaler Private Access
Platforms and practices
- Per-application access policy
- Identity provider and MFA integration
- Device posture checks
- Browser-based RDP and SSH gateway
- Short-lived server and database credentials
- Session recording and audit logs
- Replacing a flat VPN in stages
- Contractor and vendor access
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Zero trust network access and remote access for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDoes zero trust access mean we can switch off the VPN on day one?
No. Most companies replace a flat VPN in stages: first one application or one group of users, then more, while the old VPN stays as a fallback. Legacy systems that cannot speak to a modern access tool can sit behind a gateway such as Apache Guacamole until they are retired. The VPN is switched off only when nothing depends on it.
What does a device posture check look at?
It checks the state of the laptop or phone before it is allowed in: whether the disk is encrypted, the operating system is current, a screen lock is set and endpoint protection is running. A device that fails can be denied or limited to low-risk apps. What can be checked depends on the tool and on how the device is managed, so we confirm it during design.
How do contractors and vendors get access without a company laptop?
Give each person a named account tied to your identity provider, limit it to the specific application or server they need, and set an end date. A browser-based gateway lets them reach a desktop or server without installing anything on their own machine. Every session can be logged, and the account is removed when the job ends.
What happens if the access service goes down?
It depends on the design. Access policy can fail closed, so nobody gets in until the service returns, or users can have a documented emergency path, for example a break-glass administrator route. We agree on this with you in advance and test it, since an outage should be a planned event and not a surprise.