Replacing the VPN with access that shrinks the moment risk rises

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

A VPN checks a device once and then trusts it with a whole subnet. ZeroGate grants each user and device access to named applications and servers only, re-evaluates device health and risk continuously, and cuts or narrows access within seconds when a device turns risky — with no inbound port on your network.

2The challenge

A classic VPN puts a user on the whole subnet and checks the device once, at login. A compromised laptop keeps its access until someone notices.

The TotalHeal approach. Each user and device gets access only to the applications and servers a policy allows, and device health and risk are re-evaluated continuously. When a device’s risk rises, its access shrinks or is cut within seconds.

3Architecture

4How it works

1. EnrolUsers install the TotalHeal app and enrol with a profile key; devices can wait for manual approval and are refused on bad posture.
2. GrantWrite who may reach which app or server, with which ports, verbs and logins, under which conditions — validate and simulate before saving.
3. ConnectThe client gets only the peers and routes it is granted, over an encrypted overlay, direct or relayed.
4. Re-checkPosture and risk are re-evaluated continuously; access narrows, isolates or ends as risk rises.
5. AuditEvery grant, session, SSH command and just-in-time approval lands in the tamper-evident audit.

5Capabilities in detail

• Grants, deny by defaultWho (user, group, tag, device, profile) may reach what (app, tag, device, subnet, host), with which capabilities (protocol, ports, HTTP verbs, SSH logins) and under which conditions (posture, risk, MFA age, time, country). Validate and simulate before you save.
• A private encrypted network per organisationEach organisation has its own overlay network; a device only sees the peers and routes it is granted.
• Device postureOS supported, patch age, critical CVEs, rooted, EDR and AV healthy, disk encryption, firewall, Secure Boot, UEM enrolment, certificate and MFA give a healthy, risky or compromised verdict.
• Risk-adaptive accessFull, restricted, sensitive apps blocked, isolated or quarantined as risk rises. In our tests a high-risk device lost its connections in under a second.
• Enrolment profiles and approvalNine profile kinds, one-time or reusable keys, a manual approval queue and automatic rejection on bad posture.
• Just-in-time accessRequest, automated risk analysis, human approval (never your own), a time-boxed grant (default up to 8 hours) and automatic expiry.
• Gateways for private appsA Linux node as subnet router, exit node or app connector for private HTTP/TCP apps; routes approved by an admin.
• Secure SSHIdentity-based SSH and SFTP with no distributed keys, per-session authorisation, recordings (always on for root) and a searchable command audit.
• Micro-segmentation and responseDeny guards between tags, environments and departments. XDR can revoke access or quarantine a device while a forensic channel stays open.

6Security and data handling

• Deny by defaultA device sees nothing it has not been granted; an empty policy is no access.
• No inbound portsGateways and clients dial out; nothing on your network listens to the internet.
• Your own network per organisationEach organisation has its own encrypted overlay; relays admit only known devices.
• Humans approve elevationJust-in-time access needs a different person’s approval and expires on its own.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• TotalHeal desktop app on macOS or Windows for users
• A Linux host for each gateway or connector
• Outbound HTTPS and UDP 3479 to the relay
• A Sttiz account per user

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.