Zero trust network access (ZTNA) is software that checks who a user is, and the state of the user's device, and then connects that user to one application only, never to the whole network. It is the newer replacement for the VPN. It is usually a part of SASE.
ZTNA follows the idea of zero trust: nobody is trusted just for being on the company network. It also follows least privilege: each person gets access only to what their work needs.
Here is how it differs from a VPN. A VPN gives the laptop an address inside the office network. From there, the laptop can usually reach almost every server. ZTNA gives the user no address on the network at all. Instead, the security cloud joins the user to each application separately. The applications are also hidden from the internet. A small program called a connector runs next to them, inside the company's data centre. The connector makes an outgoing connection to the security cloud, and the security cloud joins the user's connection to it. So there is no open entry point into the data centre for an attacker to find.
Take, for example, an employee in the finance team at a consumer goods company, working from home in Mysuru. At 8:50 p.m., she opens the payroll application, which runs in the company's data centre in Chennai. The ZTNA program on her laptop sends the request to the security cloud. The cloud asks single sign-on (SSO) to confirm her login, with a code on her phone. It asks unified endpoint management (UEM) about her laptop. The laptop is company-owned, its disk is encrypted, and its last update was three days ago. The rules say that the finance team may open payroll. So the cloud joins her to payroll, and only to payroll. Later, she tries to open a file server at the address 10.1.4.20. That server is not on her list, so the connection is refused.
The check happens again on every new connection, not only at login. If the security software on her laptop is switched off at 10 p.m., her next request is refused.
ZTNA also works for people who are not employees, such as contractors. Some companies give contractors a virtual desktop instead, which runs on a server and shows only a picture of the desktop on the contractor's laptop. On phones, mobile threat defence reports whether the phone is safe before ZTNA allows a connection.