ZTNA
acronymcloudsecurity
Zero Trust Network Access: per-application access granted after verifying user, device, and context - no network-wide tunnel, no flat inside.
The VPN's successor in the zero-trust story: you reach the app, not the subnet.
ZTNA replaces the remote-access VPN with per-application brokering. Rather than authenticating a user and then placing their device on a network segment, it authorizes a specific identity to reach a specific application and nothing else, evaluating that decision continuously rather than once at login.
The architectural move that delivers it is outbound-only connectivity. A connector beside the application dials out to the broker and never accepts inbound connections, the client dials out too, and the broker joins them. The application therefore needs no inbound firewall rule and no public exposure, which removes it from internet scanning entirely rather than defending it there.
The security claim is defensible and worth stating precisely, because it is often overstated. A compromised VPN session gives an attacker a network position to explore; a compromised ZTNA session gives them one application. That is a real reduction in blast radius, not an elimination of risk. The cost is that access becomes an inventory problem: every application must be defined, and migrations reliably surface things nobody knew were still running.