Skip to main content

Sophos ZTNA

NAC/ZTNA ZTNA

Overview​

Sophos ZTNA is Sophos' zero-trust remote access solution that replaces traditional VPNs with per-application, posture-aware access and is now a core component of the new Sophos Workspace Protection bundle. Sophos Workspace adds an enterprise browser, DNS security, and email monitoring around ZTNA to secure hybrid work and govern SaaS/AI usage from a single cloud console.

Sophos ZTNA provides secure, least-privilege access to private applications by connecting users only to specific apps, not the full network, effectively micro-segmenting users, devices, and applications and making those apps invisible to the internet. It verifies both user identity and device posture before granting access, applying Zero Trust principles ("trust nothing, verify everything") and continuously validating sessions to reduce lateral movement and VPN-style attack paths.

The service is cloud-delivered and managed via Sophos Central, with ZTNA gateways deployed as virtual appliances (on-premises or in public cloud) and built-in ZTNA gateway in every Sophos Firewall, allowing transparent access to internal apps without extra hardware. It integrates tightly with Sophos Endpoint (Intercept X) using Synchronized Security Heartbeat so device health and active threat status can drive access policy and automatic isolation.

As of early 2026, Sophos ZTNA is being bundled into Sophos Workspace Protection, a browser-centric, hybrid-work security platform that combines ZTNA, Sophos Protected Browser, Sophos DNS Protection for endpoints, and Sophos Email Monitoring System in a single user-based license. Existing ZTNA customers are automatically upgraded to Workspace Protection from late February 2026 and can immediately enable the new capabilities at no additional cost for the remainder of their term.

How to position​

Target customers​

Sophos ZTNA/Workspace targets organizations with significant remote or hybrid work, distributed applications (on-prem and cloud), and a desire to move away from legacy VPN toward app-centric Zero Trust access. It is particularly compelling for mid-market and lean security teams that want SASE/SSE-like outcomes (secure remote access, web and DNS security, SaaS/AI governance) without building and operating full SASE infrastructure.

Customers already invested in Sophos Central, Intercept X endpoint, Sophos Firewall, XDR, or MDR are prime candidates because ZTNA and Workspace plug directly into the same console, telemetry, and Security Heartbeat ecosystem. It also fits organizations that rely heavily on browser-based and SaaS applications and are concerned about Shadow IT and Shadow AI usage by employees.

Easy sell opportunities​

  • VPN replacement and consolidation: Anywhere you see aging VPN concentrators, split-tunnel sprawl, or VPN-related security incidents, position Sophos ZTNA as a per-app, posture-aware, "VPN without the network access" upgrade. Sophos explicitly markets ZTNA as "the ultimate remote access VPN replacement" that removes implicit trust and reduces ransomware attack surface from VPN exploits
  • Quick wins for remote/internal app access: Use ZTNA to front-end critical internal web apps, RDP/SSH access, and admin interfaces so they are no longer exposed on the internet and only reachable via authenticated, compliant users through Sophos Protected Browser or the agent. This is very tangible for IT: fewer open inbound ports, no direct RDP exposure, and simplified contractor access
  • Simplified SASE-grade protection: Position Workspace Protection as a lighter-weight alternative to traditional SASE/SSE stacks, delivering browser-centric protection (enterprise browser, ZTNA, DNS, email monitoring) without backhauling all traffic through cloud gateways. This resonates with customers who balk at the cost/complexity of full SASE but still want modern remote-work security
  • Shadow IT / AI governance: For customers worried about uncontrolled use of SaaS and generative AI tools, highlight the Protected Browser's ability to see and control which apps and AI tools are used, what data is uploaded, and to enforce policies directly in the browser. Pair that with ZTNA to ensure private apps and data are only accessed from compliant workspace.

Core Features​

  • Per-application Zero Trust access: Users are granted access only to authorized applications, not the full network, with each user/device acting as its own micro-perimeter
  • Device posture and Synchronized Security: Access policies incorporate device health from Sophos Endpoint via Security Heartbeat; compromised or non-compliant devices can be automatically blocked from applications
  • Cloud management via Sohos Central: ZTNA and Workspace are fully cloud-managed with centralized deployment, policy, reporting, and integration into the Sophos Data Lake for XDR/MDR threat hunting
  • Flexible gateways and scale: ZTNA gateways run as virtual applicances and a gateway is built into every Sophos Firewall, supporting clustering and tens of thousands of agent connections across up to nine nodes
  • Sophos Protected Browser (Workspace): Hardened Chromium-based enterprise browser (powered by Island) that embeds ZTNA, web filtering, app usage controls, and data handling policies directly in the browser
  • DNS Protection for endpoints: Cloud-delivered DNS security to block malicious and unwanted domains across browsers and applications, extending protection beyond just HTTP/S traffic
  • Email Monitoring System: Additional inspection and monitoring for cloud email platforms (Microsoft 365, Google Workspace) to detect malicious or unwanted content and tie email signals into the broader workspace view
  • Integrated RDP/SSH access: Rich RDP and SSH client capabilities integrated into the Protected Browser to enable secure, seamless remote access to servers and systems without direct network exposure
  • Automated threat response: ZTNA participates in Synchronized Security and Active Threat Response, automatically isolating or limiting access from endpoints identified as compromised until remediation

Feature Overview​

Access model and user experience​

Sophos ZTNA brokers secure, outbound-initiated connections between users and applications, so applications remain "dark" to the public internet and only accessible after user authentication and device posture checks. Users can connect via a lightweight agent or via Sophos Protected Browser, which embeds ZTNA so that browser traffic to approved private apps is transparently tunneled without the user managing VPN clients or complex profiles.

Within the Protected Browser, users can also launch RDP or SSH sessions to internal systems, which are proxied through ZTNA gateways, avoiding direct RDP exposure or flat network access. This model is attractive for contractors, third parties, or BYOD scenarios where you want strong control and visibility via the browser without deploying a full endpoint agent in every case

Architecture and deployment​

ZTNA is configured and monitored entirely through Sophos Central, alongside other Sophos products, which simplifies onboarding and daily operations for teams already using the platform. Gateways are deployed as virtual appliances on-premises or in public clouds like AWS, forming the bridge between users and protected apps, and can be clustered (up to nine nodes) to scale to as many as 90.000 concurrent agent connections.

For customers with Sophos Firewall, a ZTNA gateway is built in, so you can expose internal apps via ZTNA using existing firewall infrastructure instead of spinning up separate nodes. Licensing is per user, and the gateways themselves are free to deploy in as many locations as needed, giving flexibility to place gateways close to applications or users.

Security automation and analytics​

Through Synchronized Security, Sophos ZTNA shares and consumes device health information (Security Heartbeat) from Sophos Endpoint and other products so that an endpoint flagged with an active threat can automatically lose access to sensitive applications. Active Threat Response capabilities mean ZTNA participates in automated containment workflows, helping stop lateral movement by ensuring compromised devices cannot use remote access to propagate attacks.

Telemetry from ZTNA flows into Sophos XDR and MDR via the Sophos Data Lake, letting analysts see user and app access events, denied attempts, and anomalous usage patterns in the same console as endpoint, firewall, and email telemetry. This unified view supports advanced investigations like correlating suspicious browser behavior, unusual AI tool access, and abnormal app connections for a specific identity or device

Sophos Workspace and AI/shadow IT governance​

Sophos Workspace Protection wraps ZTNA with a browser-centric security model that recognizes most work now happens in the browser and in SaaS. The Sophos Protected Browser, built on Island's enterprise browser technology, introduces granular controls over which web and SaaS apps can be used, how data can be copied or downloaded, and how generative AI tools can be accessed and what data they see.

Instead of routing all traffic through remote SASE PoPs, Workspace enforces policy directly at the browser and endpoint, reducing latency and eliminating the need for centralized SSL inspection and traffic backhaul. DNS Protection extends this to non-browser traffic by blocking malicious and unwanted domains at the resolver level, and the Email Monitoring System adds an extra layer of visibility over email threats in Microsoft 365 and Google Workspace, feeding into the same Central-managed workspace view.

Together, ZTNA and Workspace Protection give you a coherent story: secure, posture-aware access to private apps; browser-level control over SaaS and AI tools; DNS and email protections; and unified management and analytics via Sophos Central, optimized for hybrid work without full SASE complexity.