ZTNA vs VPN for Indian enterprises
ZTNA vs VPN comes down to what a user can reach after they sign in. A VPN puts the user on your network. Zero trust network access (ZTNA) connects a verified user, on a device that passes a posture check, to one application at a time. For Indian enterprises, ZTNA also makes it easier to show the MFA for telework access that RBI's July 2026 Directions ask for, and to keep the logs CERT-In requires for 180 days in India. You do not have to switch overnight: run both, and move applications to ZTNA in phases.
Key facts
| Core difference | VPN grants network access; ZTNA grants per-application access |
| Zero trust principle | "No implicit trust" based on network location or asset ownership (NIST SP 800-207, August 2020) |
| RBI (banks) | MFA for telework access to critical systems; list remote-access devices (Para 114, 31 July 2026 Directions) |
| CERT-In | Incidents reported within 6 hours; ICT logs kept for 180 days within India (Directions, 28 April 2022) |
| DPDP Rules 2025 | Access control, encryption and logs kept for at least one year; substantive duties from about May 2027 |
| Enterprise VPN and CERT-In's VPN clause | Internal corporate VPNs are outside the VPN-provider record-keeping clause (MediaNama on MeitY FAQ) |
How VPN and ZTNA differ
A remote-access VPN builds an encrypted tunnel from the laptop to a concentrator at the edge of your network. Once the tunnel is up, the laptop is effectively on the LAN. Firewall rules may limit it, but in most estates a VPN user can reach far more than the one application they need.
ZTNA starts from the other end. The user connects to a policy broker, not to the network. The broker checks who the user is, what device they are on and whether that device meets policy. Then it connects them to one named application. Other applications stay invisible.
| Remote-access VPN | ZTNA | |
|---|---|---|
| What the user gets | A network connection | Access to specific applications |
| Trust decision | Once, at login | Per application, and re-checked during the session |
| Device posture | Often not checked | Checked before and during access |
| Exposure to the internet | Concentrator is internet-facing | Applications are not published to the internet |
| Lateral movement after credential theft | Wide, unless the network is tightly segmented | Limited to the apps that user's policy allows |
| Third-party and vendor access | Shared VPN accounts and firewall rules | Time-bound access to named systems |
| Visibility | Tunnel up/down and IP flows | Who reached which app, from which device, under which rule |
| Web, SaaS and data controls | Separate products | Often on the same SSE policy engine (SWG, CASB, DLP) |
| Best fit | Full-network admin tasks, legacy protocols | Most employee, vendor and contractor access |
VPN concentrators are also a common target. In January 2024, the US cyber agency CISA issued Emergency Directive 24-01, ordering federal agencies to mitigate actively exploited flaws in a widely used VPN gateway. Any internet-facing gateway needs fast patching. ZTNA reduces how much of your network sits behind one.
Identity and device posture
ZTNA decisions rest on two inputs.
- Identity. Who is the user, and which group are they in? Strong sign-in matters here. Passkeys resist phishing because there is no password to steal.
- Device posture. Is the device managed? Is the OS patched? Is disk encryption on? A device that fails gets restricted access or none.
This is what NIST SP 800-207 means by authenticating and authorising both the subject and the device before a session is set up. A VPN typically checks the user once and trusts the connection until it drops.
What RBI and CERT-In expect
No Indian regulator mandates ZTNA or bans VPN. The rules are technology-neutral. They set outcomes that ZTNA makes easier to show.
RBI, 31 July 2026 Directions. The commercial-bank version, RBI/DoS/2026-27/410 (RBI notification), asks for:
- MFA for privileged users of critical systems and critical activities (Para 110).
- MFA for enterprise access to critical systems when teleworking, and identification of all remote-access devices (Para 114).
- Cyber incidents reported on DAKSH within 6 hours of detection, and CERT-In notified (Para 182).
- Strong, non-deprecated cryptography (Para 140).
RBI issued seven versions for different entity types (commercial banks, SFBs, payments banks, UCBs, AIFIs, NBFCs and CICs), so check the one that applies to you. We walk through the network paragraphs in RBI Cybersecurity Directions 2026 and bank networks.
CERT-In, 28 April 2022 Directions. Report incidents within 6 hours of noticing them, keep ICT logs for a rolling 180 days within India, and sync clocks to NIC or NPL time servers. The Directions also impose record-keeping on VPN service providers. MeitY's FAQ clarified that this clause covers providers of VPN services to the general public, not enterprises running VPNs for their own staff.
DPDP Rules 2025. Rule 6 asks data fiduciaries for encryption, access control and logs that give visibility of access to personal data, kept for at least one year. These duties apply 18 months after the November 2025 notification, so from about May 2027.
| Requirement | Source | How ZTNA helps you meet it |
|---|---|---|
| MFA for telework access to critical systems | RBI 2026, Para 114 | Every app session requires strong sign-in, such as passkeys |
| Identify all remote-access devices | RBI 2026, Para 114 | Device posture checks give a live device list |
| MFA for privileged users | RBI 2026, Para 110 | Admin apps published only to admin groups, with MFA |
| 6-hour incident reporting | RBI Para 182; CERT-In | Per-session logs show who reached what, fast |
| 180-day logs in India | CERT-In 2022 | Logs hosted in India or in your own DC |
| Access control and 1-year logs | DPDP Rule 6 | Per-app policy and exportable access logs |
The obligation stays with your organisation in every case. A product supplies controls and evidence.
Data residency: inspection and logs
For Indian buyers, the first question about any ZTNA or SSE service is where traffic is inspected and where logs live. Ask every vendor to state in writing:
- where the policy broker and inspection points run;
- where session logs and user data are stored, and for how long;
- whether you can export logs to your own SIEM.
Nexapp SSE management runs Nexapp-hosted in India or self-hosted in your environment. We state inspection points and log locations in writing for your risk assessment.
ZTNA vs SSL VPN, IPsec VPN and NAC
"VPN" covers several technologies, and buyers often compare ZTNA with each one:
| What it does | How it compares with ZTNA | |
|---|---|---|
| SSL VPN | Remote-access VPN over TLS, usually through a browser portal or client | Still gives network-level access after login; ZTNA gives access to one application at a time |
| IPsec VPN (remote access) | Remote-access VPN over IPsec, through a client | Same network-level model as SSL VPN, with different encryption; ZTNA replaces both for user access |
| IPsec VPN (site-to-site) | Links office networks to each other | Not a ZTNA use case. Site-to-site links stay on IPsec, usually under SD-WAN |
| NAC (network access control) | Decides which devices may join the office LAN, often with 802.1X | Complementary: NAC controls who plugs into the LAN; ZTNA controls which applications a user reaches, from anywhere |
In practice, ZTNA replaces SSL VPN and remote-access IPsec VPN for most users. NAC stays for the office LAN, and site-to-site IPsec stays for branch links. Nexapp's InstaAccess client covers ZTNA/SSE, SSL VPN and IPsec VPN in one client, so you can move user groups across in phases.
When a VPN still makes sense
ZTNA is not right for every flow.
- Site-to-site links between branches and data centres belong on SD-WAN IPsec tunnels, not on user ZTNA.
- Legacy applications that need full network reach, or unusual protocols, may stay on VPN for a while.
- Network admins sometimes need broad access. Keep it tightly scoped, with MFA, and log it.
The practical answer for most Indian enterprises is ZTNA for most users and apps, with a small, controlled VPN for what remains.
A 7-step plan to replace VPN
- Inventory access. List who uses the VPN, from which devices, and which applications they actually reach. VPN logs usually show that most users touch a handful of apps.
- Connect identity and turn on strong sign-in. Integrate your identity source. Enable passkeys or MFA for every user.
- Define posture. Decide the minimum device standard for each app: managed or not, patch level, disk encryption.
- Start with high-risk access. Move vendors, contractors and privileged users first. They carry the most risk and are the smallest groups.
- Publish applications, not networks. Move apps to ZTNA one at a time. Keep the VPN running in parallel for the rest.
- Check evidence. Confirm that session logs flow to your SIEM, stay in India for 180 days, and support a 6-hour incident report.
- Retire VPN profiles. Remove each group's VPN access once all its apps are on ZTNA. Keep a small, audited VPN only for flows that need it.
With Nexapp, users run one InstaAccess client that supports ZTNA/SSE, SSL VPN and IPsec VPN. They keep the same client throughout the move, and you retire VPN profiles as each group finishes.
Where Nexapp fits
If you are looking for zero trust network access in India from an Indian OEM, as a VPN alternative, Nexapp SSE gives per-application ZTNA based on identity and device posture, with passkey sign-in. SWG, CASB, DLP, FWaaS and sandbox run on the same policy engine. Connections use post-quantum TLS 1.3 (X25519MLKEM768) and hybrid ML-KEM key exchange, so recorded sessions are protected against harvest-now, decrypt-later (why that matters). It is multi-tenant for managed service partners, and part of the same platform as Nexapp SD-WAN and NGFW. See the secure remote access solution for the use case, and SASE vs SD-WAN vs SSE for where ZTNA sits in the wider picture.
Sources
- NIST SP 800-207, Zero Trust Architecture (August 2020)
- RBI Directions RBI/DoS/2026-27/410 (31 July 2026)
- CERT-In Directions No. 20(3)/2022-CERT-In (28 April 2022); MeitY FAQ on VPN service providers via MediaNama
- MeitY, Digital Personal Data Protection Rules, 2025
- CISA Emergency Directive 24-01 (January 2024)
Frequently asked questions
What is the main difference between ZTNA and VPN?
A VPN connects a user to a network.
ZTNA connects a verified user, on a device that passes a posture check, to one application at a time. That limits what a stolen password can reach.
Is ZTNA a good VPN alternative for Indian banks?
Yes, for most user and vendor access.
It gives per-app access with MFA and device checks, which supports the telework MFA and remote-device requirements in Para 114 of RBI's 2026 Directions. Site-to-site links still use IPsec.
Does RBI require ZTNA?
No. RBI's 2026 Directions are technology-neutral.
They require MFA for telework access to critical systems and for privileged users, plus fast incident reporting. ZTNA is one way to meet them.
Do CERT-In's VPN rules apply to our corporate VPN?
No. MeitY's FAQ on the 2022 Directions says the VPN-provider record-keeping clause covers services offered to the general public.
Enterprises running VPNs for internal use are outside it. The 180-day log and 6-hour reporting rules still apply to you.
What is the difference between ZTNA and SSL VPN?
An SSL VPN gives a user network access over TLS once they log in.
ZTNA checks identity and device posture and connects the user to one named application, keeping the rest of the network invisible.
Is ZTNA a replacement for NAC?
No. NAC controls which devices can join the office LAN; ZTNA controls which applications a user can reach from anywhere.
Many organisations run both.
Can we run ZTNA and VPN together?
Yes, and most migrations do.
Move applications and user groups in phases, starting with vendors and privileged users, and retire VPN profiles as each group moves.
Does ZTNA need an agent on every device?
Managed employee devices usually run an agent so posture can be checked.
Nexapp's InstaAccess client covers ZTNA/SSE, SSL VPN and IPsec VPN in one client.
Where should ZTNA logs be stored?
In India, for at least 180 days, to meet CERT-In.
DPDP Rule 6 adds a one-year log duty for personal-data access from about May 2027. Confirm locations with your vendor in writing.
See per-app zero trust access working on your own applications, with logs kept in India.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.