Zero trust network access (ZTNA) and SASE solutions

Zero trust network access in one paragraph

Zero trust network access (ZTNA) replaces the idea of "connect to the network, then you are trusted" with "prove who you are, on what device, for this one application, every time". A user's request goes to a policy engine, which checks their identity, how strongly they signed in, whether the device is managed and healthy, and whether anything about the request looks unusual. Only then is a connection brokered to that single application, usually through an outbound-only connector that sits beside the application, so nothing needs to listen for inbound connections from the internet. Access is denied by default, scoped to one app at a time and re-checked as conditions change.

For a vendor-neutral explainer of the term itself, see our guide to ZTNA on Cloud Security. This site goes further into the mechanics, the UK guidance and the products: start with how zero trust network access works or the ZTNA vs VPN comparison.

The UK's National Cyber Security Centre (NCSC) published dedicated ZTNA guidance on 27 May 2026. Its central point is worth keeping in mind while you read any vendor material, including the product summaries below: zero trust is an architectural approach rather than a single product. A platform gives you the tools; the design, the identity and device foundations and the removal of old access routes are what make it work.

ZTNA, SSE or SASE: which do you need?

The three terms describe nested layers. ZTNA controls access to private applications. A security service edge (SSE) adds protection for web and SaaS use, typically a secure web gateway, CASB controls and often firewall as a service. SASE adds the networking: SD-WAN for branch offices. Most organisations do not need to decide everything at once.

The full comparison of how the layers fit together is on ZTNA vs SASE.

ZTNA and SASE platforms we supply

These are the zero trust access products Forever Systems supplies. Each is described from the vendor's own material; none is ranked, because the right answer depends on what you already run, how many users and sites you have and which applications need protecting.

The side-by-side detail, including where each enforces policy and what it adds beyond ZTNA, is on ZTNA providers we supply and SASE providers compared. Pricing depends on users, devices, term and add-ons, so ask us for a quote; what drives ZTNA cost explains the variables.

Where to start

Pick the route that matches the question you are trying to answer:

• Is ZTNA really better than our VPN? The ZTNA vs VPN comparison covers access scope, exposure, lateral movement and when a VPN is still reasonable.
• How does it work under the hood? How ZTNA works walks through a connection step by step, from sign-in to connector.
• We want to retire the VPN. Our guide to a VPN replacement project sets out the options and a migration plan.
• What does UK guidance say? NCSC zero trust principles and the NCSC ZTNA guidance summarise the official position.
• We are ready to plan. How to implement zero trust network access gives a phased rollout tied to the NCSC requirements.
• Which vendor? ZTNA providers compares every platform we supply and how to run a fair trial.

What good looks like, according to the NCSC

The NCSC's ZTNA guidance sets out eight design requirements and four anti-patterns. In plain terms, a sound zero trust access design:

• checks policy before any connection to an application is made, using several signals rather than one
• keeps private applications unreachable from the internet, usually behind outbound-only connectors or proxies
• limits what an attacker can reach if an account or device is compromised, which still needs segmentation inside the network
• re-evaluates access during a session, logs every decision centrally and is designed so a policy mistake does not lock everyone out

The NCSC says many ZTNA deployments fail not because of missing technology features but because legacy trust assumptions are carried forward. One anti-pattern it describes is deploying an SSE or SASE platform as a direct VPN replacement with the old, broad access model unchanged. Another is keeping legacy VPNs or static firewall rules that bypass the new policy engine. Both are design problems rather than product problems, which is why we start with the design. Small and mid-sized organisations should also read ZTNA for small business, which covers what a proportionate version looks like.

How Forever Systems helps

We supply several competing platforms, so we can give you an independent recommendation based on fit rather than steering you to a single vendor. A typical engagement:

1. Discovery: we map who needs access to what, the devices they use, your identity provider and the VPN or remote desktop routes in place today.
2. Shortlist: we compare two or three platforms against your applications, existing licences and budget, with the trade-offs written down.
3. Trial: we can run a proof of concept with a pilot group on real applications, which the NCSC recommends before committing.
4. Deploy and migrate: we can configure policy, connectors and clients, then move applications across in stages so users keep working.
5. Tidy up: we help you close the old inbound ports and legacy routes once each application has moved.

Scope and timescales are confirmed at quote, and pricing is per user or per device depending on the platform, so ask us for a quote. Contact us to talk through your remote access and what you would like to change.