Zero trust access and SSE, with post-quantum encryption
Users reach applications, not the network. Identity and device posture are checked before every connection, and web, SaaS and private-app traffic is inspected under one policy.
- 1 client
- ZTNA, SSL VPN and IPsec VPN
- Passkeys
- Sign-in with device posture checks
- TLS 1.3
- With hybrid post-quantum key exchange
In short. Nexapp SSE gives users access to applications, not to the network. It checks identity and device posture before every connection, and inspects web, SaaS and private-app traffic under one policy engine: ZTNA, SWG, CASB, DLP, FWaaS and sandbox. Connections use post-quantum TLS 1.3 and hybrid ML-KEM key exchange, making it the SSE half of Nexapp's quantum-safe SASE.
Key facts
- Six services, one policy engine: ZTNA, SWG, CASB, DLP, FWaaS and sandbox.
- Zero trust by identity and device: access decided per user and per device posture.
- Passkey sign-in: phishing-resistant sign-in built in.
- AI Security, Detection & Response built in.
- Post-quantum: X25519MLKEM768 TLS 1.3 on SSE inspection; hybrid ML-KEM key exchange and ML-DSA authentication on tunnels.
- Multi-tenant: built for enterprises and managed service partners.
Nexapp SSE Console
Every user, app and policy in one place
ZTNA, SWG, CASB and DLP in one policy engine, with posture checks, passkey sign-in and a live view of what was allowed, blocked or escalated.
Dashboard / Overview
Security overview
Total events
48,210
All services · 30 days
Blocked
38,912
↓ 12% vs last month
DLP incidents
64
9 escalated
SaaS connectors
6
M365, Google Workspace…
ZTNA · Private access
4 of 4 gateways onlineMatched data types
- Credit card21
- Aadhaar number17
- Access keys12
- Source code9
- Other5
Events over time
SWGDLPCASBZTNAIllustration with sample data.
- One policy engineUsers, device posture, apps and actions for ZTNA, SWG, CASB and DLP together.
- InstaAccess clientOne client for ZTNA/SSE, SSL VPN and IPsec VPN, so migration is gradual.
- DLP with escalationSensitive data such as card and Aadhaar numbers blocked, logged or escalated.
- Post-quantum TLSConnections protected with hybrid post-quantum key exchange.
Why replace the VPN
A traditional VPN puts a remote user on the network. Once connected, they (or an attacker using their credentials) can reach far more than they need. ZTNA reverses that. Each user reaches only the applications their policy allows, and only while their device meets posture checks.
What changes for the business:
- Smaller attack surface. Private applications are not exposed to the internet, and users never see the wider network.
- Fewer tools. Web security, SaaS control, data protection and firewalling run under one policy instead of separate products.
- Better evidence. Access and inspection logs support your CERT-In 6-hour reporting and 180-day log obligations. They also support the MFA and telework-access requirements in RBI's 31 Jul 2026 Directions, and the DPDP security safeguards that apply from about May 2027.
- One vendor from branch to user. The same vendor runs your SD-WAN, NGFW and SSE, on the same firmware family and post-quantum encryption.
What each service does
| Service | What it does |
|---|---|
| ZTNA | Grants per-application access based on identity and device posture; replaces network-level VPN |
| SWG (secure web gateway) | Filters and inspects web traffic from users anywhere |
| CASB (cloud access security broker) | Gives visibility and control over SaaS use |
| DLP (data loss prevention) | Detects and blocks sensitive data leaving through web and SaaS |
| FWaaS (firewall as a service) | Applies firewall policy in the cloud, not only at the branch |
| Sandbox | Detonates unknown files in isolation before delivery |
| AI Security, Detection & Response | On request |
How it works
- Connect identity. Integrate your identity provider and enable passkey sign-in.
- Check the device. Device posture is evaluated before access and during the session.
- Write one policy. Define who can reach which application, and which web, SaaS and data rules apply, in one policy engine.
- Inspect and enforce. Traffic is inspected under post-quantum TLS and allowed, restricted or blocked.
- Log and respond. Events feed reports and detection and response workflows.
Deployment options: users connect with the InstaAccess client, one client that supports ZTNA/SSE, SSL VPN and IPsec VPN. The Nexapp browser extension extends ZTNA and DLP controls into the browser.
Where traffic is inspected and logs are kept
Indian buyers ask first where inspection happens and where logs live. Management is available Nexapp-hosted in India or self-hosted. We will state this in writing for your risk assessment.
Quantum-safe SSE
Remote-access sessions carry credentials and sensitive data that attackers can record today and try to decrypt later. Nexapp SSE uses post-quantum TLS 1.3 (X25519MLKEM768) for inspection, hybrid classical + ML-KEM key exchange (NIST FIPS 203) on tunnels, and ML-DSA (FIPS 204) authentication. A CBOM documents the cryptography in use. Post-quantum mode is on by default.
Proof
- Nexapp secures 75,000+ devices for 400+ enterprise and banking customers across India and APAC.
- Company certifications: ISO/IEC 27001:2022, ISO/IEC 20000-1:2018, ISO 9001:2015.
Related guides
Frequently asked questions
Can our users keep a VPN while we move to ZTNA?
Yes. The InstaAccess client supports ZTNA, SSL VPN and IPsec VPN, so you can move applications to ZTNA one at a time while the VPN still covers the rest.
For how ZTNA differs from a VPN, see secure remote access.
What is the difference between SSE and SASE?
SSE is the security half: ZTNA, SWG, CASB, DLP, FWaaS and sandbox.
SASE adds the networking half, SD-WAN. Nexapp offers both from one vendor, so you can start with either and add the other later.
Are logs retained for 180 days in India?
CERT-In requires ICT logs to be kept for 180 days within India.
Nexapp SSE helps you meet this obligation; responsibility for it remains with your organisation.
Which identity providers and MFA methods are supported?
Passkey sign-in is built in.
Is an agent required on user devices?
Managed devices use the InstaAccess client, which supports ZTNA/SSE as well as SSL VPN and IPsec VPN, so one client covers zero-trust access and any VPN you keep during migration.
The Nexapp browser extension extends ZTNA and DLP controls into the browser.
Is Nexapp SSE quantum-safe?
Inspection uses post-quantum TLS 1.3 (X25519MLKEM768), tunnels use hybrid classical + ML-KEM key exchange (NIST FIPS 203), and peers authenticate with ML-DSA (FIPS 204).
This protects against harvest-now, decrypt-later attacks.
Can partners run it for multiple customers?
Yes. Nexapp SSE is multi-tenant, so managed service partners can run separate customer tenants from one platform.
See zero trust access working on your own applications.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.