Universal ZTNA is a market term for giving every user, whether remote, in an office or at a branch, the same zero trust access model: identity and device checks first, then access to a single application instead of a whole network. It is not a formal standard, so verify what a product does.
What is zero trust network access in the first place?
NIST's SP 800-207 defines zero trust architecture around the idea that no implicit trust is granted to assets or users based on physical or network location. Access decisions are made per request, using identity, device state and other signals, and resources are protected individually.
ZTNA is an application of that idea to remote access. Instead of a VPN that places a user on the internal network, a broker authenticates the user and device and then connects them only to the specific application they are allowed to use.
CISA's Zero Trust Maturity Model lays out the work by pillar, including identity, devices, networks, applications and data, with stages from traditional to optimal. It is useful for checking claims, because ZTNA mostly touches the network and application pillars while depending on the identity and device pillars.
What does "universal" add?
The word suggests one policy regardless of where the user sits. Historically, remote users went through ZTNA or VPN while office users were simply trusted on the local network. That created two classes of access with different rules, and an attacker on the office network got more trust than a remote employee.
A universal approach applies the same checks in the office and treats the office network as untrusted. This lines up with the zero trust principle, though what a vendor includes under the label differs. Some mean an agent on every device, some a cloud broker, some also cover unmanaged devices through a browser.
What should you ask a supplier?
- Is the same policy engine used for remote and on-site users, or two systems under one name?
- Which signals are checked at each connection: identity strength, device health, location, time?
- How are unmanaged devices and contractors handled?
- Does access cover non-web applications, legacy protocols and server-initiated traffic?
- What happens when the broker or the identity provider is down?
- How are sessions re-evaluated, and can access be revoked mid-session?
- What logs are exported, and how long are they kept?
What are the limits?
ZTNA controls who reaches an application. It does not fix a vulnerability inside that application, and a compromised user session with valid device state can still do what the user may do. Good authorization within the application, monitoring and least privilege remain necessary.
It is also a migration. Applications must be inventoried and described before policy can be written, and shared secrets inside applications often turn out to be the real dependency.
A constructed example
A firm has 60 internal applications. Staff in the office reach everything from the corporate LAN. Remote staff use a VPN with the same broad access. The team moves ten applications to per-application access with device checks for everyone. Office staff on those ten now authenticate and pass a device check like remote staff. The other fifty stay on the old model until they are described. This phased approach exposes undocumented dependencies in early moves, when they are cheap to fix.
How to check or apply this
- List applications by owner, protocol, users and sensitivity.
- Choose a first group of web applications with clear owners.
- Define device and identity requirements for that group, including multi-factor authentication.
- Apply the same policy to office, branch and remote users.
- Define the break-glass path for broker or identity provider outages.
- Review logs for denied and unusual access, and tune policy.
- Retire the broad network rules that the new policy makes unnecessary.
- Map progress to the pillars in the CISA model to see what remains.
Quick check
Does universal ZTNA remove the need for a firewall?
No. It changes how users reach applications. Network filtering, segmentation and egress controls still have a role.
Is it the same as a VPN replacement?
It often replaces remote-access VPN use, but the stricter point is per-application, per-request access decisions for all users, not just a different tunnel.
Sources
Last reviewed: 18 October 2026.
