Talk to any ZTNA vendor and you will hear the same capabilities described in roughly the same way: identity verification, device posture, least-privilege access, continuous monitoring. The vocabulary is standardized. The implementations behind it are not.
That gap between consistent marketing language and inconsistent capability depth is where most enterprise ZTNA evaluations go wrong. Teams evaluate platforms on whether they have a feature - rather than on how deeply and reliably that feature works in the scenarios that production environments actually create.
The difference matters operationally. A ZTNA that verifies identity at login and considers the session trusted until logout is a fundamentally different product from one that re-evaluates risk continuously and adjusts access dynamically as conditions change. A ZTNA that secures web applications over HTTPS may be completely blind to the thick-client database connection, the RDP session, or the proprietary legacy protocol that a significant portion of enterprise workflows still depend on. Both platforms will tell you they support "continuous monitoring" and "broad application coverage" - and both statements will be technically accurate in ways that do not reflect the capability gap between them.
This guide is about the features that distinguish mature ZTNA from its lighter implementations - the ones that determine whether a deployment actually delivers zero trust or just applies an identity layer in front of a softer version of the network access it was supposed to replace.
The Features That Actually Define ZTNA Quality
Dynamic Risk Scoring - Not Just Point-in-Time Authentication
Authentication at login is a checkpoint, not a security posture. The session that begins on a clean, compliant device at 9 AM may be operating on a compromised endpoint by 11 AM. The credential that was legitimate at login may have been stolen during the session.
Dynamic risk scoring continuously evaluates the risk level of each active session by aggregating signals from multiple sources: current device compliance status, behavioral patterns relative to the user's established baseline, location and timing context, active threat detections from endpoint security tools, and changes in device configuration that occurred after the session began. When the risk score crosses a threshold, the system responds automatically - restricting access, requiring step-up authentication, isolating the device, or triggering inline threat inspection - without waiting for a human to investigate the alert.
Step-up authentication is the specific mechanism worth evaluating carefully. When a user attempts to access a high-sensitivity resource, or when their risk score changes mid-session, the ZTNA should be able to demand additional verification in real time - a hardware token, a biometric check, or a manager approval - without dropping the session or requiring the user to restart their workflow. Platforms that can only apply authentication at session initiation cannot enforce this contextual response.
Application Protocol Breadth - Web Apps Are Not the Whole Story
Many ZTNA implementations were built around web application access - the HTTP/HTTPS traffic that most modern SaaS and cloud applications use. That covers a significant portion of enterprise access, but rarely all of it.
A production enterprise environment still runs thick-client applications that use proprietary protocols: database clients connecting over TCP, RDP sessions for remote desktop access, SSH for infrastructure management, legacy ERP systems with non-standard communication requirements. ZTNA that enforces zero trust principles for web applications but leaves these protocols outside its scope has not replaced the network-level trust that users exercising those protocols still carry.
The evaluation question is specific: which application protocols does this ZTNA govern? HTTP/HTTPS is the baseline. RDP, SSH, and database client protocols are the test. Legacy and proprietary protocols are the differentiator.
Phishing-Resistant MFA - Not All MFA Is Equal
Multi-factor authentication is a baseline ZTNA requirement. What type of MFA matters more than whether MFA exists.
SMS-based one-time passwords are vulnerable to SIM-swapping attacks. Push notification MFA is vulnerable to MFA fatigue - the technique where attackers repeatedly send approval requests until an exhausted user approves one. TOTP codes are better but can be phished through real-time proxy attacks that capture and replay codes before they expire.
FIDO2-compliant authentication - hardware security keys, passkeys, and platform authenticators - provides phishing-resistant MFA that cannot be intercepted or replayed because the cryptographic response is bound to the specific origin the user is authenticating against. Evaluating which MFA methods a ZTNA platform supports, and whether phishing-resistant options are available, determines how much of the credential theft problem the deployment actually addresses.
Application-Level Access - Not Network-Level Access With an Identity Layer
This is the feature distinction that separates genuine ZTNA from what security architects are calling "identity-aware VPN" - a pattern where ZTNA verifies identity but then grants access to a network segment rather than a specific application.
In application-level ZTNA, the user accesses a specific application with no visibility into adjacent services, no ability to scan the network behind the access point, and no reachability to resources beyond what the policy explicitly permits. There is no concept of general network reachability. Access is defined in terms of applications, services, and ports - not network segments.
In network-level access patterns, even with identity verification, the authenticated user reaches a network zone where other services are discoverable and potentially reachable depending on internal segmentation quality. This is ZTNA in name only - it reduces the initial access surface but does not eliminate lateral movement potential once access is granted.
Evaluating this requires testing, not feature documentation. Ask the vendor to demonstrate what a verified user can reach beyond the specifically authorized application. If the answer reveals a network surface, the implementation is not application-level ZTNA regardless of what the product is called.
Complete Session Auditability
Every ZTNA access decision should produce a structured, queryable record: which identity, from which device, with which posture, accessed which application, at what time, with what policy outcome, and what happened during the session. Not a log file. An auditable, structured telemetry stream that feeds compliance reporting, threat detection, and forensic investigation simultaneously.
This auditability requirement has regulatory teeth in 2026. NIST SP 800-207, CMMC 2.0, HIPAA, NIS2, and GDPR all require documented evidence of access controls functioning as intended. The ZTNA platform that generates this evidence automatically as a byproduct of normal enforcement operations converts a compliance overhead into an operational output.
Our Recommendation: Versa Networks
For enterprises evaluating ZTNA features against the criteria above - dynamic risk scoring, application protocol breadth, phishing-resistant MFA, true application-level access, and complete auditability - Versa Networks provides the most complete and architecturally deep implementation available.
Unified Endpoint Risk Scoring With CrowdStrike Integration
Versa's dynamic risk scoring goes beyond internal posture assessment. Through integration with CrowdStrike Falcon, Versa pulls a Zero Trust Assessment (ZTA) score into its Unified Endpoint Risk Scoring engine - a composite score built from over 120 endpoint settings including sensor health, OS security configurations, patch status, firewall and encryption status, active threat detections, and policy compliance state. This score updates in real time and feeds directly into Versa's SASE policy engine.
When the ZTA score crosses a defined threshold, the policy response is automatic and immediate: deny internet access, isolate the device from the network segment, or trigger full inline inspection of all subsequent traffic. No manual intervention. No investigation queue. The response happens before an analyst receives the alert - because the risk score that triggers it is evaluated continuously, not checked periodically.
This is what dynamic risk scoring looks like when it is implemented with production depth rather than checkbox coverage.
Full Protocol Coverage Including Thick Clients and Legacy Applications
Versa ZTNA governs access across web applications (HTTP/HTTPS), thick-client applications including RDP and SSH sessions, database connections, and legacy applications with proprietary protocols - not just the web tier. This breadth is critical for enterprises whose workflows include infrastructure management, remote desktop access, database operations, or any application that predates the web-first era.
Client-less ZTNA access is available for unmanaged devices through secure browser-based sessions - including privileged access to RDP and SSH targets without requiring software installation on the endpoint. The access controls and session monitoring apply consistently regardless of whether the user is on a managed corporate device with the Versa client or a contractor device using browser-based access.
Adaptive Access That Responds to Session-Level Risk Changes
Versa ZTNA dynamically adjusts security measures based on real-time analysis of user behavior and network conditions throughout the session - not just at login. When behavioral analytics detect a deviation from established patterns, the policy responds proportionally: step-up authentication for a sensitive action, access restriction for an elevated risk signal, or session termination for a critical threshold breach. Business continuity is maintained for compliant sessions while anomalous ones face progressive enforcement.
Auditability Across the Unified Platform
Because Versa ZTNA runs on VOS™ - the same operating system as Versa SD-WAN, NGFW, SWG, CASB, and DLP - every ZTNA access event flows into the same unified data lake as every other security and network event. The compliance record is not assembled from separate log sources. It exists as a unified, continuously maintained telemetry stream that answers regulatory inquiries, feeds threat detection analytics, and supports forensic investigation from a single, queryable source.
ZTNA features are only as valuable as the depth of their implementation. The list of capabilities a platform claims to have is the starting point for evaluation, not the conclusion. Test the dynamic risk scoring against a simulated mid-session compromise. Test the application coverage against the legacy protocol your most sensitive application uses. Test the auditability against the specific regulatory framework that governs your industry. The platform that passes all three tests in production is the one worth deploying.
Sign in to leave a comment.