Zero Trust Network Access
the network perimeter moved to the user. Trust nothing, verify everything.
ZTNA design and deployment across SoCal — corporate, healthcare, higher ed, government, regulated industries. Zscaler ZPA. FortiSASE / FortiZTNA. Cloudflare Access. Cisco Secure Access. Palo Alto Prisma. Identity-driven app access. Posture. Microseg. VPN replacement.
Zero Trust Network Access — the architecture that replaces the VPN and the flat network
The VPN gave every connected user the entire network. That worked when the network was the office. It stops working when the office is everywhere and the threat actors know to spear-phish a credential. NIST SP 800-207 defines the Zero Trust Architecture. CISA's Zero Trust Maturity Model sets the federal trajectory.
The scope: platform selection (Zscaler ZPA, FortiSASE / FortiZTNA, Cloudflare Access, Cisco Secure Access, Palo Alto Prisma Access), application discovery, identity provider integration, per-application policy authoring, device posture assessment, connector deployment in customer datacenters or cloud, VPN cutover planning, and integration with SIEM and the broader SASE stack.
Pairs with networking for connector placement, cybersecurity for the broader posture, managed SASE for ongoing operations, and SASE implementation for the umbrella architecture. Start with a free assessment.
Three patterns that drive ZTNA adoption
VPN was the right answer for 2005. It is the wrong answer for hybrid work, contractor access, and the threat model where one phished credential touches everything.
VPN gives the whole network
The traditional VPN client connects the user to the corporate LAN. From there, the user (or whoever phished them) can reach anything reachable on the LAN. ZTNA flips it: the user connects to a specific application, gated by identity and posture, with no LAN-level adjacency. Compromise of one credential does not give the network.
Contractors get over-permissioned access
Onboarding a contractor onto VPN means giving them the network. Off-boarding means revoking credentials and hoping. ZTNA scopes contractor access to specific applications with specific time bounds, audited per session. Day-90 contractor access reviews stop being a fire drill.
Application discovery never happened
Most enterprise environments have applications nobody documented — legacy file shares, internal tools running on someone's VM, vendor portals, dev sandboxes. ZTNA deployment starts with discovery because nothing else works until you know what's actually being accessed.
Why choose WCC for Zero Trust Network Access
ZTNA is platform selection + identity integration + application discovery + policy authoring + connector deployment + VPN cutover planning. WCC handles all six.
CSLB C-7 · C-10 · C-28
Active California contractor license. Network infrastructure, connector deployment in customer racks, and policy operations all under one license.
Zscaler · Fortinet · Cloudflare · Palo Alto
Multi-platform expertise. Vendor-neutral selection driven by existing identity stack, application mix, and broader SASE posture.
Azure AD · Okta · SAML · SCIM
Identity integration including Azure AD / Entra ID, Okta, Google Workspace, SAML federation, and SCIM provisioning. MFA and conditional access aware.
VPN Migration Discipline
Phased VPN cutover: parallel-run period, per-application migration, exception handling, then VPN decommission. The phasing prevents the all-or-nothing failure mode.
The six ZTNA capability areas
Each capability scopes to identity posture, application portfolio, and existing perimeter architecture.
Service Selection
Zscaler ZPA for ZTNA-focused or SSE-heavy organizations. FortiSASE / FortiZTNA for Fortinet-centric. Cloudflare Access for cost-conscious or Cloudflare-already. Cisco Secure Access for Cisco-stack. Palo Alto Prisma Access for Palo Alto stacks.
Application Discovery
Discovery phase using existing firewall logs, NetFlow, DNS records, and platform-provided discovery tools. Application inventory with owner, criticality, user base, and current access pattern documented.
IdP + Posture Integration
Identity provider integration (Azure AD / Entra ID, Okta, Google Workspace, Ping). Conditional access policy authoring. Device posture from MDM (Intune, Jamf, Workspace ONE) feeding access decisions.
Application Connectors
Connector deployment in customer datacenters, branch offices, and cloud VPCs. Connector redundancy, capacity sizing, and network reachability documented. Cloud-native or VM-based per platform.
Per-Application Policy
Policy authoring per application: who can access, from what posture, on what device, during what time, with what audit. Policy-as-code where the platform supports it. Change management workflow.
VPN Cutover Planning
Phased VPN cutover: pilot application migration, parallel-run period, per-application or per-user-group migration, exception handling for legacy access, VPN decommission. Documented rollback for each phase.
Zero Trust Network Access — common questions
VPN connects the user to the network — everything reachable on the LAN becomes reachable to the user (and to anything that compromises the user's session). ZTNA connects the user to a specific application, gated by identity, device posture, time, and policy, with no LAN-level adjacency. A compromised credential in the VPN model gives the network; in ZTNA it gives one application under one set of conditions.
Driven by existing identity stack, current security platform investments, and application portfolio. Zscaler ZPA for organizations going broader on Zscaler SSE. FortiSASE / FortiZTNA for Fortinet-centric. Cloudflare Access for cost-conscious or already Cloudflare. Cisco Secure Access for Cisco-stack continuity. Palo Alto Prisma Access for Palo Alto stack continuity. WCC scopes selection in the first assessment week.
Sometimes. ZTNA handles application access. Some workloads still need network-level access — admin access to network gear, certain legacy systems, lab environments. A residual VPN for those narrow use cases is common. The goal is to shrink VPN scope from "all users for everything" to "specific admins for specific networks" while ZTNA carries the application access load.
Legacy applications without SAML, OIDC, or modern auth integration get fronted by the ZTNA platform's connector. The connector handles the user-facing access via identity, and the connector talks to the legacy application on the back end with whatever the application understands (Kerberos, LDAP, header-injection, basic auth). The user experience is modern; the legacy stays legacy until refresh.
ZTNA is the secure-access pillar of SASE. SWG (Secure Web Gateway) and CASB cover internet and SaaS access. ZTNA covers private application access. DLP layers over all three. Most platforms (Zscaler, Fortinet, Cisco, Palo Alto, Cloudflare) sell SASE bundles that include ZTNA plus SWG / CASB / DLP. WCC scopes ZTNA standalone or as part of broader SASE depending on customer posture.
Platform license per user per month: Zscaler ZPA $5-15, FortiZTNA $4-12 (Fortinet-bundle pricing), Cloudflare Access $3-7, Cisco Secure Access $7-15, Palo Alto Prisma Access $8-20. Deployment services: $25K-75K for small / mid-sized rollouts (under 500 users), $75K-250K for mid-market or multi-region, $250K-1M+ for enterprise with extensive application discovery and VPN cutover.
ZTNA deployments across Southern California
WCC designs and deploys zero trust architectures across all six SoCal counties — corporate, healthcare, higher ed, government, regulated industries. Chino HQ.
ZTNA is the architecture that replaces the flat network and the over-permissioned VPN.
WCC designs and deploys Zero Trust Network Access: platform selection across Zscaler, FortiSASE, Cloudflare, Cisco, Palo Alto. Application discovery. Identity and posture integration. Per-application policy authoring. Connector deployment. Phased VPN cutover. NIST 800-207 aligned. CSLB C-7 / C-10 / C-28.