Infrastructure › Zero Trust Architecture

Pillar 06 · Zero Trust

Identity is the new perimeter.

VPN grants network-layer access to a user's whole device context. Zero Trust grants application-layer access only to what the user's identity and device posture earn. Netcom designs the identity fabric, the ZTNA broker, and the segmentation policy that make it real.

Talk to an Engineer See Reference Architectures

implicit-trust zones — every request authenticated, every session scoped

ZTNA platforms we design on — Zscaler, Cloudflare, FortiClient, Cisco Duo

CISA

Zero Trust Maturity Model — we map your current state to the pillars

Zero Trust · Identity Broker

Zero Trust reference architecture with IdP, posture check, ZTNA broker, and microsegmented resources

The Problem

VPN was never a security boundary. It was a convenience tunnel.

Once a remote user connects via VPN, they're inside the perimeter. Their laptop gets an internal IP. Everything on the corporate LAN is one network-layer hop away. If that laptop is compromised — unpatched OS, malware-laced browser extension, stolen credentials — the attacker now has lateral-movement potential across your entire network.

Zero Trust inverts the model. There's no perimeter. Every access request — from a laptop in the office, a phone at an airport, or a server-to-server API call — authenticates the identity, checks the device posture, and is authorized only for the specific application or resource it needs. Network location grants nothing. Identity + posture + policy grant everything.

The mistake most organizations make: "we bought Okta, we're zero trust." SSO is table stakes. Real zero trust requires an identity provider plus a posture-check agent plus a ZTNA broker plus microsegmentation inside the data center and cloud. Netcom designs all four layers so they actually enforce policy — not just log it.

Reference Architectures

Three maturity stages. Specific vendor stacks.

Zero Trust is a journey, not a product. Each tier below is a realistic starting point based on where your organization is today.

Okta + Duo + Cloudflare Access

Identity-first starter: SSO for every app, MFA everywhere, and Cloudflare Access in front of internal web apps. Replaces client VPN for 80% of workloads in 90 days.

Stage 1 · organization is on SSO but still VPN-dependent for internal apps

Identity + ZTNA starter — retire 80% of VPN in 90 days

The fastest first step. Land every SaaS and internal web app behind an identity provider with enforced MFA. Put Cloudflare Access or Duo Network Gateway in front of internal web applications so they're reachable via identity-aware proxy — no VPN required. The VPN stays for legacy non-web protocols, but 80% of remote-access traffic moves off it within the first quarter.

Role	Vendor & Model	Notes	License
Identity provider (IdP)	Okta Workforce Identity · Microsoft Entra ID	SSO · lifecycle management · SAML/OIDC	Per-user
MFA	Duo Security · Okta Verify	Push · WebAuthn · phishing-resistant	Per-user
ZTNA for internal web apps	Cloudflare Access · Duo Network Gateway	Identity-aware reverse proxy · no client install	Per-user
Endpoint posture (lite)	Duo Device Trust · Cloudflare WARP	Device registration · OS/patch checks	Per-device
Legacy VPN (retained)	Existing FortiGate / Meraki SSL VPN	For non-web protocols until Stage 2	Existing

Mid-market Zero Trust reference architecture with IdP, posture check, ZTNA broker, and microsegmented resources

Stage 2 · VPN fully retired · every access goes through a ZTNA broker

Zscaler Private Access + CrowdStrike posture + Okta

VPN is gone. Every application access — from anywhere, on any device — flows through a ZTNA broker that authenticates identity, validates device posture in real time, and authorizes only the specific application or service. Zscaler Private Access (ZPA) is the reference broker for mid-market to enterprise; FortiClient ZTNA is the equivalent for Fortinet-estate customers. Posture is enforced by the EDR agent (CrowdStrike, SentinelOne, Defender) — an out-of-compliance laptop can't reach finance apps until it's patched.

Role	Vendor & Model	Notes	License
ZTNA broker	Zscaler Private Access (ZPA)	Application-level access · no network exposure	Per-user
ZTNA for Fortinet customers	FortiClient ZTNA · FortiGate as proxy	Integrates with FortiGate policy fabric	Per-user
Identity provider	Okta · Entra ID · Ping Identity	SAML/OIDC federation to ZTNA	Per-user
MFA · phishing-resistant	YubiKey · WebAuthn · Okta FastPass	Hardware tokens or platform authenticators	Per-user + hardware
Device posture / EDR	CrowdStrike Falcon · Microsoft Defender for Endpoint	Real-time posture signal into ZTNA decision	Per-endpoint
Conditional access	Entra Conditional Access · Okta Policy	Risk-based step-up · anomaly detection	Per-user
Privileged access	CyberArk · BeyondTrust	Just-in-time elevation · session recording	Per-admin
SIEM integration	Splunk · Sentinel · Exabeam	All ZTNA decisions and denials logged	Per-ingest

Illumio + Aruba CX 10000 + Prisma SASE

Workload-level microsegmentation extending zero trust from user-to-app into east-west data center and cloud flows. Illumio for software-defined segmentation; Aruba CX 10000 or Cisco ACI for hardware-accelerated microsegmentation. Request a design session.

Stage 3 · microsegmentation of east-west traffic · workload-identity policy

Microsegmentation — zero trust all the way down to the workload

User-to-app zero trust is stage two. The final stage is workload-to-workload zero trust: an application server doesn't trust the database just because they share a VLAN. Microsegmentation enforces per-workload policy using either software agents (Illumio, Guardicore, VMware NSX) or hardware switches with stateful services (Aruba CX 10000, Cisco ACI). Every east-west flow is identity-tagged, policy-scoped, and loggable. Ransomware lateral movement stops at the first segment boundary.

Role	Vendor & Model	Notes	License
Software microsegmentation	Illumio Core · Guardicore	Agent-based · workload-identity policy	Per-workload
VM-layer microseg	VMware NSX · VMware Avi	Hypervisor-integrated · L7 policy	Per-vCPU
Hardware microseg (switch)	Aruba CX 10000 · Cisco ACI	Stateful L4 services in-switch · line-rate	Per-port / per-fabric
SASE · SSE platform	Palo Alto Prisma Access · Zscaler ZIA	Secure internet access · DLP · CASB	Per-user
Cloud workload protection	Prisma Cloud · Wiz · Microsoft Defender for Cloud	CSPM + CWPP · policy across AWS/Azure/GCP	Per-workload
Service mesh (for modern apps)	Istio · Linkerd · HashiCorp Consul	mTLS between services · zero-trust by default	OSS or commercial
Identity governance	SailPoint · Saviynt	Lifecycle automation · access reviews · SoD	Per-user
Policy orchestration	Illumio Policy Generator · ACI tenant policy	Natural-language and graph-based policy	Included

Vendor Fit

Which zero-trust stack for which starting point.

The recommendation depends on your identity provider, your security estate, your regulatory profile, and how much VPN baggage you're carrying. Here's how Netcom thinks about it.

Starting point	Primary	Alternates
Microsoft 365 shop · Entra ID in place	Entra Conditional Access + Defender	Okta + Zscaler
Okta-estate customer · SaaS-heavy	Okta + Cloudflare Access / Zscaler	Okta + Duo Network Gateway
Fortinet-estate · fabric-consistent	FortiClient ZTNA + FortiGate	Zscaler + FortiGate termination
Cisco-estate · Duo and ISE in place	Duo + Cisco Secure Access	Cisco SSE + ThousandEyes
Fast retirement of SSL VPN	Cloudflare Access	Zscaler Private Access · Twingate
Regulated · financial services · HIPAA	Zscaler ZPA + CrowdStrike + SailPoint	Palo Alto Prisma Access + Wiz
Government / DoD · CMMC 2.0 Level 2+	FedRAMP-authorized stack (per contract)	Microsoft GCC High · Zscaler Gov
Software microsegmentation (VMs + cloud)	Illumio Core	Guardicore · VMware NSX
Hardware microseg in the data center	Aruba CX 10000	Cisco ACI · Arista MSS-T
Cloud-native · Kubernetes workloads	Istio / Linkerd service mesh + Wiz	Consul + Prisma Cloud

What Netcom delivers

Zero Trust Maturity assessment mapped to the CISA Zero Trust Maturity Model
Identity provider architecture — primary IdP selection, federation, lifecycle
MFA rollout with phishing-resistant methods (WebAuthn, hardware tokens)
ZTNA broker design and deployment with posture integration
Application inventory and ZTNA-readiness scoring — which apps to onboard first
VPN retirement sequence — phased cutover with rollback criteria
Microsegmentation policy model (if Stage 3) with label taxonomy and enforcement plan
Optional managed service: 24/7 monitoring via our NOC partner with Netcom as your named engineer, policy change management, quarterly access reviews

Our design process

Discovery: application inventory, user directory, device fleet, current VPN dependencies
Maturity scoring against CISA ZTMM pillars (Identity, Device, Network, Apps, Data)
Gap analysis with quick wins and strategic investments labeled
Target architecture selection based on existing estate and regulatory profile
Pilot cohort: one department, one critical app, VPN-off by end of pilot
Rollout sequence prioritized by business value and technical complexity
Operational runbook: access reviews, policy change control, incident response
Measurement: VPN concurrent-user decline, ZTNA adoption rate, posture compliance %

Identity is the new perimeter.

VPN was never a security boundary. It was a convenience tunnel.

Three maturity stages. Specific vendor stacks.

Identity + ZTNA starter — retire 80% of VPN in 90 days

Zscaler Private Access + CrowdStrike posture + Okta

Microsegmentation — zero trust all the way down to the workload

Which zero-trust stack for which starting point.

What Netcom delivers

Our design process

Where identity-first access stops being optional.

Healthcare

Government

Industrial

Education

Ready to retire VPN for good?

Identity is the new perimeter.

VPN was never a security boundary. It was a convenience tunnel.

Three maturity stages. Specific vendor stacks.

Identity + ZTNA starter — retire 80% of VPN in 90 days

Zscaler Private Access + CrowdStrike posture + Okta

Microsegmentation — zero trust all the way down to the workload

Which zero-trust stack for which starting point.

What Netcom delivers

Our design process

Where identity-first access stops being optional.

Healthcare

Government

Industrial

Education

Pairs naturally with

Security & Firewall

Wireless

Switching

Ready to retire VPN for good?