VPN-free access: how Zero Trust works in practice

It is possible to provide secure remote access to critical systems without relying on VPNs, using a Zero Trust architecture, a security model in which no device or user is considered trusted by default, even after authentication. In practice, this means that every IP address starts blocked, and only the authenticated device receives, in real time, authorization to connect to a specific application server, authorization that is automatically revoked upon each disconnection.

Why are companies replacing traditional VPNs?

A traditional VPN creates a network tunnel that, once established, typically gives the connected device broad access to the company's internal network, which becomes a risk if that device is compromised. Furthermore, traditional VPNs require configuration, consume more bandwidth, and don't always work well on limited connections. Zero Trust architecture solves this by authenticating and authorizing access to each application individually, not the network as a whole.

Read also: Secure VPN in practice: protocols, risks and real protection

How does Zero Trust authentication work in practice?

1. All IPs are blocked by default — there is no automatic trust just because you are "inside the network".
2. Authentication occurs before accessing the company's environment, completely isolating the user's device from the application and database servers.
3. Only the IP address of the authenticated device receives real-time authorization to connect to a specific application server.
4. This authorization is automatically revoked each time you disconnect, requiring new authentication for the next session.
5. Even if the user's equipment is compromised, corporate data remains protected, since the device never has direct access to the servers.

Here at Skyone, we apply the Zero Trust model, verifying all access to reduce risks, prevent lateral movement, and protect critical data.

Other layers of protection that reinforce the Zero Trust model

• MFA (Multi-Factor Authentication), with an option for QR Code-based application.
• Single Sign-On (SSO) with SAML 2.0, integrated with identity providers such as EntraID.
• reCAPTCHA with sophisticated risk analysis, protecting against bots and automated attacks.
• Monitoring and mitigation of brute-force attacks in real time, with automatic blocking of suspicious IPs.
• Security through ephemeral IP addresses: new servers receive dynamic IP addresses, renewed daily, making targeted attacks more difficult.
• Real-time access revocation: when a user's access is removed, the connection to the application is immediately dropped.

You may also be interested in: Cybersecurity and the evolution of cyberattacks

What does this mean for those who use basic devices or limited connections?

Since access is via a web browser, with low bandwidth consumption (starting at 100Kbps) and no need to install a VPN, this model works well even on unstable connections or devices with low processing power. This is especially relevant for companies with distributed operations or field teams.

Frequently Asked Questions

Does Zero Trust mean that the user needs to authenticate every time they use the system? Authentication is validated with each new access session, but this doesn't necessarily mean multiple manual logins — features like Single Sign-On allow for a seamless experience while maintaining the security of the Zero Trust model behind the scenes.

Is Zero Trust slower than a traditional VPN? Not necessarily. Because authentication and authorization happen on an application-specific basis, and not across the entire network, this model tends to be lighter in terms of bandwidth consumption than a traditional VPN.

Is it possible to use Zero Trust with an existing Active Directory within the company? Yes. It is possible to connect to an existing external Active Directory structure via LDAP, while maintaining full control over authentication and permissions within the client's own infrastructure.

Does Zero Trust protect against attacks that have already occurred within the network? Yes, that is precisely one of the main benefits of the model: since no device is trusted by default, even an attack that is already "inside" the traditional network would not have automatic access to application servers protected by Zero Trust.

Written by Skyone