ZTNA是把零信任的持续验证与最小权限原则与网络访问控制产品结合、替代传统VPN一次认证全网通行粗粒度模型的网络访问方式，核心是基于身份与设备态势的逐次授权，能力包括持续身份验证、设备信任评估与动态访问决策。它解决的是VPN接入后横向移动风险高与权限难以收敛的问题，并不解决终端设备自身被植入恶意代码的问题。
ZTNA的核心是持续验证，它可以帮助企业实现以下目标：
让每次访问都被重新判定。身份、设备状态与访问上下文被持续评估，权限随环境变化自动收缩。设备健康状态来自终端管理平台的持续上报，包括补丁水平、磁盘加密状态与安全软件运行情况，这些信号共同构成信任评分。
让访问范围收敛到具体应用。授权颗粒度从整个内网降到单个应用，横向移动路径被大幅压缩。访问决策通常结合身份、设备与行为三类信号，上下文变化时权限会自动收缩，而不是像传统边界模型那样一次授权长期有效。
让远程接入与内部访问同一套策略。员工、外包与合作伙伴走相同的授权链路，例外配置减少。
让信任状态可被观测。身份与设备的信任评分被持续更新，异常状态能够触发会话中断。会话记录与会话中断机制让风险处置不必等到连接自然结束，在评分跌破阈值时可立即切断正在进行的访问。
总之，ZTNA可以帮助企业实现远程访问从网络级信任到应用级授权的转变，降低边界一旦突破后的横向扩散风险，收敛权限范围与审计粒度，支撑零信任架构在访问层的实际落地。
翻译
ZTNA is the combination of zero-trust continuous verification and least-privilege principles with network access control products, replacing the coarse-grained model of traditional VPN where one authentication grants broad network access. Its core is per-request authorization based on identity and device posture, with capabilities covering continuous identity verification, device trust assessment and dynamic access decisions. It solves the problems of high lateral-movement risk after VPN access and of permissions being hard to narrow, but it does not solve the problem of malware already implanted on endpoint devices.
At the heart of ZTNA is continuous verification, which can help companies achieve the following:
Re-evaluate every access request. Identity, device state and access context are assessed continuously, and permissions contract automatically as conditions change.
Converge access scope to specific applications. Authorization granularity moves from the whole intranet to individual applications, sharply compressing lateral movement paths.
Apply the same policy to remote and internal access. Employees, contractors and partners travel the same authorization chain, reducing exceptions.
Make trust state observable. Identity and device trust scores are updated continuously, and anomalous conditions can trigger session termination.
In short, ZTNA can help enterprises shift remote access from network-level trust to application-level authorization, reduce lateral spread risk once a boundary is breached, narrow permission scope and audit granularity, and support practical deployment of zero-trust architecture at the access layer.
