Netskope will launch ZTNA Next, an evolution of its zero-trust network access (ZTNA) solution that leverages its recently announced software-based unified secure access service edge (SASE) client.

The vendor claims ZTNA Next not only enables the “complete retirement” of legacy VPNs – meeting all relevant remote Application access use cases –  but also supports on-premises scenarios like voice-over internet protocol (VoIP).

“The idea of fully replacing VPNs with ZTNA has been the utopian promise by industry vendors for years. But the vast majority of commercially available ZTNA solutions today lack key support for certain legacy applications that require server-initiated traffic flow, which forces organizations into a clumsy choice of adopting some ZTNA while maintaining parts of their VPN footprint for legacy applications,” said VP Naveen Palavalli in a Netskope announcement.

ZTNA Next aims to prevent tool sprawl by consolidating separate ZTNA and VPN products with a single agent, addressing legacy application compatibility issues with ZTNA and connecting users or devices to corporate resources regardless of location.

The ZTNA Next product will be generally available later this year.

Netskope touts single agent for security services edge (SSE) (including ZTNA) and SD-WAN.

Because Netskope ZTNA is a component of Netskope Intelligent SSE, these ZTNA capabilities can be converged with an SD-WAN with no hardware needed as part of the vendor’s software-based SASE client, software delivered to user endpoints without requiring any hardware appliance.

Netskope’s security service edge (SSE) combined with its Endpoint SD-WAN is essentially a “SASE for your laptop,” Netskope SVP Parag Thakore told SDxCentral.

Analyst firm Gartner predicts that by 2025, 70% of organizations that implement agent-based ZTNA) will choose either a SASE or SSE provider for ZTNA, rather than a stand-alone offering. Still, Netskope SVP Parag Thakore pointed out that the vendor is leaving optionality open to its customers.

“There will be people who want to use SSE with their legacy VPN, and they can. Or if they want to use just Endpoint SD-WAN, they can end up doing that,” Thakore told SDxCentral.

Although Thakore added that there is this power in using one agent for SD-WAN and SSE functions, including ZTNA, as it brings the benefit of operational simplicity and shared context.

Netskope’s Borderless SD-WAN and Endpoint SD-WAN use a context-aware zero-trust policy.

For example, the vendor has a cloud discovery engine supporting 60,000 applications that assigns a cloud confidence index to each application for automatic prioritization and configuration.