Trend Micro Zero Trust Secure Access (ZTSA)

What Trend Micro ZTSA is

Zero Trust Secure Access (ZTSA) is the access-control service in Trend's Vision One platform. Trend Micro now uses the TrendAI brand, so you will see the product called both Trend Vision One Zero Trust Secure Access and TrendAI Vision One ZTSA; it is the same service.

ZTSA covers the main security service edge (SSE) functions: zero trust network access to private applications, a secure web gateway with cloud access security broker (CASB) controls, and a service for governing staff use of generative AI. Trend describes it as continuously verifying and assessing each identity and device, and positions it as a way to move remote access off VPN, with access to specific resources able to change as risk rises or falls.

If you already run Trend Vision One for endpoint or XDR, ZTSA plugs into the same console and the same risk data. For how SSE relates to ZTNA and SASE, see ZTNA vs SASE.

ZTSA components

Private Access and Internet Access can be used together for the same users, and Internet Access and AI Secure Access are offered as a combined option. Licensing detail is on Trend Micro Zero Trust Secure Access licensing.

How ZTSA Private Access works

Private Access follows the standard ZTNA pattern described on how zero trust network access works, with Trend's own names for the parts:

• Private Access Connector: deployed close to your applications, in your data centre or cloud environment, and each private application is registered against a connector. Trend recommends at least two connectors per environment for high availability and load balancing
• Secure Access Module: installed on users' devices and integrated with your identity provider, it passes connection attempts to the right connector or internet access gateway, where the rules are enforced
• Browser access: for contractors and unmanaged devices, users reach published applications through a Vision One user portal in the browser, with nothing installed
• Access rules: built in the Vision One console and able to use the user, the device, time of day and location, with identity from your directory such as Microsoft Entra ID

As with any ZTNA design, the connectors need outbound access to Trend's service, so we plan firewall rules and connector placement as part of the design.

Risk-based access: the distinctive part

Most ZTNA products check identity and device posture when access is requested. ZTSA can also use risk data from the rest of Vision One. Risk control rules score users and devices on their behaviour, and can block private or internet access for an individual user when conditions you set are met.

In practice: if Vision One's exposure management or XDR flags a laptop as compromised, or a user account starts behaving unusually, the rules you set can remove that user's access to sensitive applications without anyone having to intervene.

This maps well to the NCSC's requirement to continuously re-evaluate access as context changes, and to its user behaviour signal. It is strongest where Vision One already protects the endpoints, because that is where the risk signals come from. Without that, ZTSA still works as an SSE, but the differentiator is smaller.

Who ZTSA suits

• Existing Trend Vision One customers who want access decisions to use the risk data they already collect
• Organisations replacing an ageing VPN for a defined set of internal applications
• Teams giving contractors access to one or two applications through the browser portal, without network-wide access
• Organisations concerned about generative AI use who want AI governance alongside web security

ZTSA is not a SASE platform with SD-WAN; if branch networking is part of the brief, compare SASE providers. For every ZTNA product side by side, see ZTNA providers.

Planning a ZTSA pilot

1. Choose the first applications: two or three internal applications with a known user group, ideally one web application and one that needs the Secure Access Module.
2. Confirm identity and devices: connect your directory, check MFA is enforced, and confirm which devices run Trend's endpoint protection so risk signals are available.
3. Deploy connectors: at least two per environment, placed close to the applications, with outbound firewall rules agreed in advance.
4. Write the rules: per application and group, including what happens when a user's or device's risk rises.
5. Pilot with real users, including at least one contractor using browser access, and review the allow and deny logs together.
6. Expand in waves, then remove the VPN routes those applications used, so the old path cannot bypass the new policy (one of the NCSC's ZTNA anti-patterns).

The same approach applies to any product; the general version is on how to implement zero trust network access.

Licensing

ZTSA options are licensed per user under TrendAI Flex: Private Access, Internet Access and AI Secure Access can be taken on their own or together, with the sandbox add-on per user and the static IP add-on sized by bandwidth. Trend offers a free trial, which we can use as the basis for a pilot. We do not publish prices: ask us for a quote based on your users and the applications they need. The cost drivers for ZTNA in general are on ZTNA cost.

How Forever Systems helps

We can map which users need which applications, deploy and size the Private Access Connectors, roll out the Secure Access Module, set up browser access for contractors, build web and AI policies and connect risk control rules to the Vision One signals you already have. Users then move across from VPN in stages, and we help you close the old access routes afterwards. Scope and timescales are confirmed at quote. Contact us to plan a pilot.