ZTNA.

ZTNA is a model that grants users access to specific private applications only after continuous identity, device, and context checks — never network-level access by default. It belongs to the Network Security category of cybersecurity.

ZTNA is a model that grants users access to specific private applications only after continuous identity, device, and context checks — never network-level access by default.

Zero Trust Network Access (ZTNA) replaces the traditional VPN tunnel into a corporate network with brokered, per-application access. A trust broker authenticates the user (typically via the corporate IdP and MFA), evaluates device posture, applies context such as geolocation and risk, and then proxies only the allowed application sessions. The user never sees the underlying network, so lateral movement is prevented even if a device is compromised. ZTNA is a core component of SSE and SASE offerings and is typically deployed alongside identity governance, EDR, and continuous-access evaluation to realize the Zero Trust principle of explicit, least-privilege access.

Defences for ZTNA typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Zero Trust Network Access, Software-defined perimeter (SDP).