A software-defined perimeter (SDP) is an access architecture that hides network resources and lets a connection form only after a user and device have been verified. Verification comes first and the network path comes second, so unauthorised clients cannot even see the service to probe it.
Where does the idea come from?
The Cloud Security Alliance publishes the SDP specification. Version 2.0, released in March 2022, updates a version 1.0 from April 2014. The CSA says SDP is an effective way to implement the principles of zero trust. Its stated aims are to let architects and application owners deploy dynamic software-defined perimeters, hide networks and resources, prevent unauthorised access to the services running on them, and enforce an identity-centric access policy model.
That reads like a direct answer to a standing problem. A service on an open port can be scanned, probed and attacked by anyone. A service that only accepts connections from authenticated clients cannot be.
What are the parts?
The specification describes architectural components, interactions and a basic security communications protocol. In plain terms there are three roles.
A client on the user's device that holds identity and device information and asks for access.
A controller that checks who the user is and whether the device is acceptable, and decides which services the client may reach.
A gateway in front of the protected resource. It accepts traffic only from clients the controller has approved, and it ignores everyone else.
The sequence matters. The client first talks to the controller, which verifies identity and device posture. Only then is the gateway told to accept that client for the specific resource.
What is single packet authorization?
The v2.0 specification lists the Single Packet Authorization (SPA) message format, the use of UDP, and alternatives among its topics. SPA is a technique where a client sends one authenticated packet to a gateway. The gateway keeps all ports closed and silent, and opens one only if that packet checks out. To a scanner, nothing responds.
SPA is one way to do the "hide first" step, not the only way. The specification discusses alternatives.
How does it differ from a VPN?
A traditional VPN, once connected, often places the user on a network segment where many resources are reachable. SDP aims to connect the user to a specific application, not a segment. NIST SP 800-207 describes zero trust as focusing on protecting resources, not network segments. SDP is one way to realise that resource-centred model.
What does a constructed example look like?
A company runs an internal reporting tool. Today it sits behind a VPN, so any employee on the VPN can reach it, along with everything else on that subnet. With SDP, the tool sits behind a gateway that is invisible from the network. An analyst's laptop sends its identity and device check to the controller. The controller confirms the analyst is in the reporting group and the laptop is encrypted and patched, then instructs the gateway to accept that laptop's connection to that tool only. A contractor on the same network sees no open port at all.
What are the limits?
SDP controls who may connect. It does not inspect what happens in an approved session, and it does not fix flaws in the application behind the gateway. A compromised approved device can still misuse its access. Pair it with logging, device health checks, session limits and a patched application. Also plan for availability: if the controller fails, who can reach what?
How to check or apply this
- List applications that sit behind a broad VPN or directly on the internet.
- Choose one with a clear user group as a pilot.
- Define the device checks you would require: disk encryption, patch level, managed status.
- Confirm the design for controller outage and for emergency access.
- Log every approval and denial with user, device and resource.
- Read the CSA SDP v2.0 specification to compare vendor claims against the architecture it describes.
Quick check
Is SDP the same as zero trust?
No. Zero trust is a set of principles. The CSA describes SDP as an architecture that can implement them.
Does SDP replace a firewall?
Not entirely. It controls who may connect to a resource. You still need network segmentation, application security and monitoring.
Sources
- Cloud Security Alliance, Software-Defined Perimeter Specification v2.0
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
