Explain like I'm five · Security

What is ZTNA?

Zero Trust Network Access, told as a story about an escort who takes you to exactly one door.

homethe tunnel (VPN)KitchenVaultStudyout of the tunnel and you're in — anywhere you like

We used to dig a tunnel from home to the castle.Through the tunnel (VPN) and you're inside. After that, anywhere you like — just like the old castle.

tunnel mouththere it isKitchenopenVaultopenStudyopenStorageopenone tunnel opens the whole castle

Anyone can find the tunnel mouth.The tunnel door is visible from outside and gets broken often. One thief inside, and the whole castle opens.

homethe escortWho are you? ✓Your ring? ✓Mud on shoes? ✓no gate to knock onMeetingother rooms aren't even visiblenot into the castle — just to that one door

ZTNA is an escort who takes you to one door only.You never enter the castle — once checked, you're walked to that one door. The other rooms aren't even visible.

The escortthe only one who knows the way
The checkthe person and the device they brought
One doorto a door, not into the castle
The invisible castleno gate to knock on from outside
MeetingMeeting is on the listthat room isn't on your listVaulttomorrow it all gets asked again

Each room separately, every time again.Meeting was allowed; the Vault isn't on the list. Come back tomorrow and it's all asked again.

that shed isn't on my listthe old storehouse?this one still needs the tunnel

Rooms the escort doesn't know, you can't reach.Old storehouses not on the escort's list still need the tunnel. So for a while, both stay in use.

In one breath

ZTNA = never let people into the castle; check them, then have an escort walk them to exactly the door they need.

Zero Trust Network Access replaces the tunnel (VPN). It's the castle that always asks (Zero Trust), applied to people coming from outside. Named by Gartner in 2019; ships inside the SSE bundle.

When grown-ups say it

VPN
The tunnel. Through it, you're inside. Its mouth is visible from outside, so it gets attacked a lot.
Broker / controller
The escort. Checks who you are and decides which door you get walked to.
App-level access
One door only. One app, not the whole castle. → a key ring for every hat
Device posture
Mud on your shoes? Not just the person — the computer they brought. → the castle that always asks
Dark cloud / app hiding
The invisible castle. No gate to knock on from outside — and no gate means nothing for a thief to knock on.
Connector
A rope from inside the room. The room throws a rope out to the escort — inside-out, not outside-in.
Software-Defined Perimeter
The older name for the same idea. What the escort approach was called first.
SSE
The checkpoint bundle. Checkpoint (SWG) + shed broker (CASB) + escort (ZTNA).
Next story
Hubs All Over Town →
Want another term as a picture book? Request →