“Never trust, always verify” is easy to agree on. Putting it into practice is harder: many projects stall because they try to change everything at once, stack new tools on top of old ones, or risk disrupting users who just need to get their work done. Meanwhile, internet-facing VPN gateways remain a prime target, with critical vulnerabilities exploited within 24 hours of disclosure in 2026 (Lupovis).
Ekinops makes Zero Trust practical by applying it in two places. Universal ZTNA verifies every user and device before granting access to an application, and only to that application. Zero Trust Internet Access applies the same logic to the web: only verified, legitimate content gets through. Both deploy alongside your existing firewalls, VPN, and identity provider, application by application, starting where the risk is highest. Over 500 organizations across Europe, including hospitals, local governments, and government agencies, already trust Ekinops.
A Zero Trust rollout usually starts on three fundamentals:
With the access that would hurt most if compromised: administrator accounts, external contractors, and your critical applications. Publish them through Universal ZTNA first, keep your VPN for everything else, then extend application by application. The exposed surface shrinks with each step.
Two flows. Access to your applications: Universal ZTNA verifies identity, device, and context on every connection and grants access to one application at a time, with no port exposed to the internet. Access to the web: Zero Trust Internet Access only allows domains already classified and verified as legitimate, blocking unknown and freshly created domains by default.
No. Universal ZTNA runs as an overlay on your existing network, without changing IP addressing, DMZ zones, or topology. Users and groups are provisioned from your identity provider via SCIM, logs go to your SIEM, and your VPN keeps running until you no longer need it.
Each device holds a cryptographic certificate, combined with one-time password MFA. Its compliance is then checked continuously: antivirus/EDR status, local firewall, OS version, screen lock, connection time, and geolocation. If a device falls out of compliance, its access is cut immediately.
NIS2 (Art. 21 measures): least-privilege access, strong passwordless authentication with MFA, end-to-end AES-256 encryption, a reduced attack surface, and logs exportable to a SIEM.
DORA: Universal ZTNA can be operated entirely by your organization, on-premise, with infrastructure that cannot decrypt your traffic. That directly addresses the regulation’s focus on dependence on critical third-party providers.
