In short
Check Point ZTNA is Private Access in the Check Point SASE Platform (formerly Harmony SASE, built on Perimeter 81). It applies identity-centric zero trust policy for employees, third parties and branch offices, through the SASE agent, agentless browser access or the Enterprise Browser, over Check Point's private backbone, and is licensed per user as Private Access Complete.
Get a quote for Check Point ZTNA
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Check Point ZTNA is
Check Point acquired Perimeter 81 in 2023, and its platform became Harmony SASE. Check Point's website now calls it the Check Point SASE Platform (formerly Harmony SASE), and perimeter81.com redirects to Check Point's SASE site. The zero trust network access part of that platform is Private Access.
Check Point describes Private Access as applying an identity-centric zero trust access policy that accommodates any employee, third party or branch office, over a full-mesh global private backbone. In practice that means a user is given the specific applications their role needs, from a device that meets your requirements, rather than a route onto the network.
The wider platform adds Internet Access (web security inspected on the device, or hybrid with Check Point's cloud), SaaS Security and SD-WAN, which is what makes it a single-vendor SASE. This page focuses on the ZTNA angle. For the full product in depth, see Check Point Harmony SASE on our specialist Check Point site, and for its history, Perimeter 81.
Ways to connect
| Access method | How it works | Typical users |
|---|---|---|
| Agent-based ZTNA | The Check Point SASE agent on managed devices connects users to the applications and networks their policy allows, with device posture checked before connecting and again while connected | Staff on managed laptops |
| Agentless ZTNA | Browser access to published HTTP/HTTPS, RDP, SSH and VNC applications, with nothing installed on the device | Contractors, partners' staff, short-term access |
| Check Point Enterprise Browser | A managed browser that adds data controls for work on unmanaged devices | BYOD and third parties handling sensitive data |
| Site and cloud connections | Offices, data centres and cloud networks join through IPsec tunnels or Check Point's own connector installed inside the network | Branches, data centres, cloud workloads |
The agentless and browser options matter for organisations with many third parties. They are covered in more depth on agentless ZTNA and, for the browser itself, Check Point Enterprise Browser.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Key Private Access capabilities
- Identity-centric policy: rules grant access to specific applications by user and group, tied to your identity provider; Check Point documents integrations with Microsoft Entra ID, Okta, OneLogin, JumpCloud, AD FS and on-premises Active Directory, with SCIM provisioning from Entra ID or Okta
- Device posture checks: checks such as endpoint protection running, disk encryption, operating system, device certificate and domain sign-in, enforced for Private Access and repeated while the device stays connected
- Dedicated gateways: cloud gateways in the regions you choose, each with its own static IP address, so SaaS and partner systems can allow-list your traffic; Check Point withdrew shared gateways from 12 August 2026
- Global private backbone: traffic between Check Point's points of presence runs over its own backbone in a full-mesh design, so a user can reach an application in one region and a server in another without going through head office
- Firewall as a service: network-level policy in the cloud alongside per-application rules
- One console: users, groups, networks, applications and posture rules are managed together in the Check Point Portal (formerly Infinity Portal)
Check Point ZTNA and the NCSC requirements
The NCSC's ZTNA guidance sets out eight design requirements. No product meets them on its own, but it helps to see which Check Point features support each one, and where your design work comes in:
| NCSC requirement | Relevant Check Point SASE capability | What remains your design decision |
|---|---|---|
| Enforce policy before granting access | Identity-centric Private Access rules per application | Writing least-privilege rules, not broad network access |
| Use multiple signals | Identity provider sign-in plus device posture checks | Which posture checks each group must pass |
| Minimise exposure of applications | Applications reached through Check Point's gateways and connectors | Removing old inbound VPN and port-forward rules |
| Continuously re-evaluate access | Posture re-checked while connected | How quickly leavers and failed devices are cut off |
| Ensure the architecture is observable | Central console and logging | Sending logs to your SIEM and reviewing them |
| Design for resilience | Multiple dedicated gateways and regions | Gateway count, regions and site tunnel redundancy |
The NCSC also warns against recreating the old trust model inside a new platform. Moving every VPN user into one Private Access group with access to whole subnets would do exactly that, so we design per-application rules from the start.
Is Check Point ZTNA the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Licensing
Check Point SASE is licensed per user. In the catalogue we supply from:
- Private Access Complete covers zero trust access to private resources
- Internet Access comes in Essentials, Premium and Complete, each available on-device or hybrid, and can be added for the same users
- Gateways are licensed alongside users, and every network needs at least one dedicated gateway
Billing terms are confirmed at quote. Check Point offers a 30-day trial in the Check Point Portal, which is a good basis for a pilot. We do not publish prices: ask us for a quote. Edition detail is on Harmony SASE licensing, and the cost drivers across all ZTNA products are on ZTNA cost.
Who Check Point ZTNA suits
- Organisations replacing a remote access VPN who also want web and SaaS protection from the same vendor
- Businesses with many third parties, where agentless access and the Enterprise Browser avoid shipping laptops
- Multi-site organisations that want branches and cloud networks on the same mesh as remote users
- Existing Check Point customers, for example those running Check Point Endpoint Security (formerly Harmony Endpoint), which is managed in the same Check Point Portal, or Check Point firewalls, which can connect to the SASE network by IPsec
It may be more than you need if you only want remote desktop access (see TruGrid SecureRDP) or a small team's access to a few servers (see NordLayer ZTNA). Compare all options on ZTNA providers.
How Check Point ZTNA compares
Buyers comparing Check Point's Private Access with other ZTNA products usually weigh four points:
| Question | Check Point SASE Private Access | What to compare elsewhere |
|---|---|---|
| Where is web traffic inspected? | On the device by the agent, or hybrid with Check Point's cloud (Internet Access) | Cloud proxy designs such as Cisco Secure Access or Trend Micro ZTSA |
| How are unmanaged devices handled? | Agentless ZTNA for web, RDP, SSH and VNC, plus the Enterprise Browser | Browser-native access such as Island Private Access |
| Are branches included? | Yes: sites join the same mesh, and SD-WAN is part of the suite | SSE-only products that need a separate SD-WAN |
| How is it licensed? | Per user, with dedicated gateways | Per-device products such as Todyl SASE |
None of these makes one product better in general; they decide which fits your estate. The SASE vs SSE guide explains the single-vendor question in more depth, and a short trial of two shortlisted products is the most reliable way to settle it.
Moving from a VPN to Check Point ZTNA
- Audit current VPN use: which users reach which applications, over which protocols.
- Connect identity: link your identity provider and set up SCIM so joiners and leavers flow through automatically.
- Set up gateways and networks: choose regions, connect data centres, offices and cloud networks by IPsec or connector.
- Publish applications and write rules per application and group, with posture checks for managed devices and agentless access for third parties.
- Pilot: move a friendly group across first. Check Point warns that other agents that tunnel or inspect traffic can conflict with its agent, so each device moves in one step.
- Migrate in waves, then close the old VPN and any legacy routes that bypass the new policy.
Our VPN replacement project guide covers the same journey for any product. Contact us to plan yours; scope and timescales are confirmed at quote.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Does Check Point have ZTNA?
Yes. Check Point's ZTNA is Private Access, part of the Check Point SASE Platform (formerly Harmony SASE). It grants per-application access based on identity and device posture, through an agent, agentless browser access or the Check Point Enterprise Browser.
Is Perimeter 81 ZTNA the same as Check Point ZTNA?
Yes. Check Point acquired Perimeter 81 in 2023 and its platform became Harmony SASE, now called the Check Point SASE Platform. Perimeter 81's zero trust access is today's Check Point SASE Private Access.
What is Check Point agentless ZTNA?
Browser-based access to published applications without installing the SASE agent. Check Point's administration guide covers HTTP/HTTPS, RDP, SSH and VNC applications. It suits contractors and unmanaged devices, with the Enterprise Browser available for stronger data controls.
Does Check Point ZTNA check device posture?
Yes. Posture checks such as running anti-malware, disk encryption, operating system and device certificate are enforced for Private Access and repeated while the device remains connected.
How is Check Point ZTNA licensed?
Per user, as Private Access Complete, with Internet Access tiers optional and dedicated gateways licensed alongside. Ask us for a quote.
Still have a question about Check Point ZTNA?
Ask us and a member of our team will reply by email.
More zero trust access guides
Cisco universal ZTNAOne per-app zero trust policy for remote and on-site users, enforced by Secure Access and Secure Firewall.Agentless ZTNAClientless ZTNA through the browser for contractors, partners and personal devices, and its trade-offs.VPN replacementRetiring a remote access VPN: the options, an NCSC-aligned migration plan and what changes for users.SASE providersThe SASE and SSE platforms we supply, compared on components, delivery, licensing unit and fit.