ZTNA

ZTNA brokers access one application at a time. Instead of connecting a device to a network, it authenticates the user, checks the state of their device (patch level, managed status, and similar signals), and then permits a connection only to the named application they are entitled to reach, usually through an outbound-initiated tunnel so no service is exposed inbound. The application is not published to the internet; the broker is, and it reveals nothing about what sits behind it until a request is authorised. This is the concrete implementation of zero trust for access: no implicit trust from being on the network, a decision made per request, and access scoped to a single resource rather than a whole segment.

The common failure is ZTNA in name only. A team deploys a broker but back-ends it onto the same flat network, so once through the broker the user can still move laterally, which reproduces the exact problem a VPN has. Another is device posture that is checked once and never again, or policies so broad that “per-application” access is really access to a large group of applications. From the offensive side, the value of ZTNA is that a stolen credential should reach one app and stop; where the segmentation behind it is weak, that promise is empty, and a compromised session travels as far as the network permits.

We test whether access is genuinely scoped: from an authenticated session we attempt to reach applications and network paths beyond the one authorised, and we check whether posture and identity are re-evaluated rather than trusted once. Integration with conditional access is reviewed where the identity provider drives the decision. The finding is the reachable resource beyond scope, demonstrated. This is part of how we test per-application access controls.