Every VPN connection opens a door for users on your whole network, not just on the application they need. Steal or phish one set of credentials, and an attacker isn’t stuck in one app, they’re on the subnet, scanning for the next target. Most organizations now give contractors, freelancers, and remote staff a way in, so that’s a lot of doors held open at once. Ekinops U-ZTNA flips that. A user only connects to the applications he needs, not the network. Nothing else is visible from the outside. Every request is checked against identity, device, and context in real time, and the rest of your infrastructure simply isn’t there and cannot be found.
Over 500 organizations across Europe, including hospitals, local governments, and government agencies, already trust Ekinops.
Replacing a legacy VPN raises three questions most DSI and RSSI teams face early on:
Find your answer to common questions on Ekinops ZTNA solution for Modern Remote Access.
A traditional VPN places the user directly on the company’s physical network, giving them broad visibility and opening the door to lateral movement if their account is compromised. Ekinops ZTNA applies least-privilege access instead: the user reaches only the application they’re authorized for, through an isolated micro-tunnel. The rest of the internal network, and every other server on it, remains hidden from the internet.
Most Zero Trust vendors now hide your applications behind an outbound connector, non-exposure alone is no longer a differentiator. Ekinops U-ZTNA adds two things others don’t: cryptographic routing, which means even a compromised node in the infrastructure can’t find a route to your applications, and full independence, meaning you can operate the entire chain yourself, on-premise, with end-to-end encryption the infrastructure can’t decrypt. In short: invisibility and no trusted third party, including us.
For BYOD and contractors where you can’t install an agent, Ekinops U-ZTNA has an agentless portal: the user reaches the applications through their browser, authenticated via OIDC through your identity provider. It covers HTTP, HTTPS, SSH and RDP, with session recording (meaning “replayable” from the Manager) for the privileged protocols, much like a bastion. It’s a complement for unmanaged devices, not a replacement for the agent version, which remains the nominal mode and covers all of TCP.
For agent-based access, users and groups are provisioned from your identity provider via SCIM : creations, changes and deletions are pushed automatically, so you don’t manage users by hand in the Manager. Authentication itself is by X.509 certificate, passwordless, with the Manager’s own OTP-based MFA available on top.
For the agentless portal, where no certificate can be placed on the device, the portal connects to your IdP via OIDC and inherits whatever authentication, including MFA, you’ve configured.
A REST API is also available for bulk imports if needed.
NIS2 and DORA both require tight control over third-party access and full traceability of critical connections:
No. Ekinops U-ZTNA is designed to run as an overlay on top of your existing network, without changing IP addressing, DMZ zones, or topology, so it coexists with your current VPN concentrators. No “rip and replace” then: U-ZTNA is deployed application by application by installing a transfer agent in front of one service, publishes it, and grants access, all with outbound-only flows, without touching your existing VPN. The two can run in parallel while you migrate the applications that matter most first.
