Zero Trust Network Access (ZTNA) for Mid-Market India

Why VPN Is Dying

Classic VPN trusts any device that presents valid credentials and gives it broad LAN access. That was fine in 2010. In 2026 it means: one stolen MFA token = lateral movement across your entire environment.

ZTNA in One Sentence

Every connection is authenticated and authorized per-application, not per-network, regardless of where the user is.

Practical Starting Point (India SMB, 50–500 users)

1. Phase 1 (0–3 months): Deploy MFA everywhere — M365/Google Workspace, VPN, server SSH, AD. Audit privileged accounts.
2. Phase 2 (3–6 months): Pilot ZTNA for one app — typically the finance ERP or HRMS. Zscaler Private Access, Cloudflare Access, or Fortinet ZTNA are the common picks.
3. Phase 3 (6–12 months): Roll ZTNA to all internal web apps, retire VPN for staff. Keep a small VPN footprint for vendor/contractor access with time-bound credentials.

Hardware Implications

ZTNA is mostly cloud-delivered but some deployments use on-prem connectors (small x86 appliance or VM). Factor a SonicWall / Fortinet / Palo Alto firewall refresh into the same budget cycle — your perimeter box still handles ingress filtering, east-west segmentation, and SSL inspection.

What Doesn't Change

Site-to-site tunnels between branches, DC interconnects, and DR links remain on IPsec/SD-WAN. ZTNA targets user-to-app, not network-to-network.