App Connector
termcloudsecurity
ZPA's lightweight VM/container beside a private application, making only outbound TLS connections to Service Edges - enrolled with a provisioning key, discovering apps via its own DNS vantage.
No inbound listener means the app is absent from the reachable internet, not hidden behind something.