Replacing or shrinking the corporate VPN with identity-based access to internal apps and networks using OpenZiti, NetBird, Headscale or Pomerium, and how access patterns, regulations and deployment limits change the design.
The common starting point: a VPN that gives every user the whole network. This page covers choosing between an overlay network (NetBird, Headscale, OpenZiti) and an identity-aware proxy (Pomerium), migrating app by app, device posture and running both during cutover.
Giving contractors and partners browser access to selected internal apps without a VPN client: Pomerium in front of the apps, policies per route tied to your identity provider, short sessions and logs of every request.
Keeping the control plane, coordination servers and logs of a ZTNA deployment under EU control: self-hosting NetBird or OpenZiti instead of a US-run service, relay placement, and what data each component holds.
Segmenting access inside networks that never touch the internet: running the full OpenZiti or NetBird control plane on premises, internal identity providers, certificate handling and how dark services reduce lateral movement.
Overlapping IP ranges and two identity providers make network merges slow. This page covers giving acquired staff access to selected apps through an overlay or proxy before networks are joined, and keeping the two sides segmented during integration.
Remote clinicians, imaging vendors and connected clinics: identity-based access to EHR and PACS front ends instead of site-to-site VPNs, device posture for clinical laptops, and HIPAA transmission security considerations.
Banks and fintechs reducing VPN exposure: per-application access to trading and back-office tools, posture checks on managed devices, access logs for regulators and keeping the control plane in their own infrastructure.
Agencies moving toward the federal zero trust strategy: identity-based access to internal applications, device signals, encrypted connections and self-hosting the control plane, mapped to the OMB M-22-09 goals.
Reaching plant systems and remote sites without opening inbound firewall ports: OpenZiti edge routers that dial out, NetBird routes to OT segments, vendor access controls and keeping production networks segmented.
For SaaS companies whose engineers reach staging, internal tools and databases from anywhere: WireGuard overlays with NetBird or Headscale, SSO groups as access policy, exit nodes and the point where a PAM tool is the better fit.
Mapping the NIST zero trust architecture components (policy engine, policy administrator and policy enforcement points) and deployment models to open-source pieces: an identity provider, an overlay or proxy, and device signals, with the gaps that remain.
CMMC Level 2 requires monitored and controlled remote access, encryption of remote sessions and routing through managed access control points (AC.L2-3.1.12 to 3.1.14). This page maps them to a self-hosted ZTNA design and its logs.
Requirements to settle before choosing a ZTNA approach: users and devices to cover, app types (web, SSH, RDP, databases, UDP), identity provider and posture signals, client versus clientless, self-hosted control plane, logging and edition limits.
Questions for ZTNA vendors and partners: where the control plane and relays run, what traffic they can see, offline behavior, posture integrations, migration from the VPN, licensing of self-hosted editions and support.
Cost of self-hosted ZTNA against managed ZTNA services: control plane and relay infrastructure, published per-user plans from NetBird and Pomerium for comparison, migration effort per application and ongoing operations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.