---
title: "Zero-trust access — company access that asks every time"
description: "What zero-trust access is, why the classic VPN has become a risk, and who should switch — company access verified per request, as a per-user block."
canonical: "https://corevatis-redesign.pages.dev/en/services/zero-trust-zugang/"
lang: en
schema_type: WebPage
---
# Zero-trust access — company access that asks every time

What zero-trust access is, why the classic VPN has become a risk, and who should switch — company access verified per request, as a per-user block.

## The short version

- **What:** Access to company applications verified on every request: who are you, is your device healthy, may you reach exactly this application.
- **Why:** A classic VPN only knows inside or outside — whoever is in once reaches everything. Exactly what attackers exploit.
- **For whom:** From the first home-office seat, for external providers, and wherever local applications must be reachable from outside.
- **Billing:** Per user per month, as its own position.

A good fit if:

- The VPN is slow, moody — and still the gate to everything
- Externals need one application but get the whole network
- You want to prove who accessed what, when

## What is zero-trust access — in one sentence?

Instead of letting your people "into the company network", zero-trust access connects them to **individual applications** — verifying on every request: is it really this person, is their device in healthy shape, and may they reach exactly this application?

## Why the classic VPN has become a risk

The VPN comes from a time when "being on the network" meant "being trusted". That assumption is now the weakness:

- **In once means in everywhere.** A stolen VPN credential opens the building, not a door.
- **The VPN appliance itself is target number one.** Vulnerabilities in VPN gateways have been among the most exploited entry points for years.
- **Externals get too much.** The contractor who should maintain one system usually receives the whole network — and their access gets forgotten after the project.
- **And day to day, it is friction:** slow tunnels, client fiddling, "is the VPN down again?" tickets.

Zero trust flips the logic: nobody is trusted for being "inside" — trust is earned per request. For your people it feels like less friction, not more security: open the application, work.

## Who needs it?

- **Every company with home office** — the remote seat is the most common way in.
- **Every company with external providers** accessing single systems.
- **Companies with several sites** or local applications (ERP) that must be reachable from outside without standing on the internet.
- **Anyone who needs evidence:** who accessed what, when — [logged instead of assumed](/en/use-cases/zero-trust-baseline).

## What we take on

- Access rules per application — defined with you, documented, maintained
- Device-health checks before access: only current, protected devices get through — interlocking with the [Managed Workplace](/en/services/managed-workplace)
- Rollout without migration pain: application by application, the old VPN keeps running until it is empty
- External access with expiry dates — the maintenance access ends with the project, not with forgetting

## Billing

Per user per month, as its own position — [like every block](/en/services/add-ons). Replacing the old VPN is a small, clearly scoped project.

## FAQ

**Does this replace the firewall?**
No — it complements it. The [firewall protects the site](/en/services/netzwerk-standort); zero-trust access protects your people's path to the applications.

**Does it work with our local applications?**
Yes — that is exactly what it is built for. Your ERP stays in-house and becomes safely reachable from outside without standing on the internet.

**What happens to our existing VPN?**
It runs in parallel during the transition and gets relieved application by application. In the end you switch it off — or keep it for the two cases that truly still need it, decided from access logs, not gut feeling.

## Related topics

- [IT security overview — how the protection blocks interlock](/en/services/it-sicherheit)
- [Setting access rules once, properly — the zero-trust baseline](/en/use-cases/zero-trust-baseline)
- [Identity protection (ITDR) — the guard on the account](/en/services/identitaetsschutz)