- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Enterprise Application Access
Your contractors need three internal apps. A VPN account hands them the whole subnet — Akamai Enterprise Application Access opens one private app at a time after checking identity, place, time and device, clientless for web apps and through the Zero Trust Client for RDP, SSH and other TCP or UDP traffic.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Akamai platform family
This page covers Enterprise Application Access — Akamai’s zero trust access. The rest:
Quick facts
30-second orientation- Product
- Identity-aware access to private web, RDP, SSH and TCP/UDP apps through connectors that only dial out
- Maker
- Akamai Technologies, Cambridge, Massachusetts; NASDAQ: AKAM; CEO Dr. Tom Leighton
- Scale
- Security lines earned $2.243B of the $4.208B total Akamai reported for FY2025, over half of it
- Price
- Quote-only; Akamai publishes no price or licensing unit, and offers a free trial
- Connectors
- VMs or containers on VMware, OpenStack/KVM, Hyper-V, AWS, Google Cloud, Azure, Docker or Podman
- Access
- Clientless for web apps; the Zero Trust Client’s Access module, successor to the EAA Client, for the rest
- Identity
- SAML with Akamai IdP, Google, Ping, Okta or Entra ID; OpenID Connect; SCIM from Azure and Okta
- Posture
- Firewall, OS-update and anti-malware checks, plus risk signals from SIA, Carbon Black and CrowdStrike
- India
- No Indian EAA point of presence documented; Akamai’s Bengaluru facility (2018) houses its NOC and SOC
- In India via
- TechBag — apps sorted by protocol, connector placement, quote in INR with GST
Understand zero trust access before you switch off the VPN
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is zero trust access?
Each user reaches one approved application, never the network behind it, once identity and device have been checked.
A remote-access VPN vs Akamai EAA — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A remote-access VPN | Enterprise Application Access |
|---|---|---|
| What a login reaches | The network segment behind the concentrator | Only the apps the policy lists for that user |
| Contractor onboarding | A VPN account plus a client install | A browser link for web apps, nothing installed |
| Device health | Seldom checked after the tunnel is up | Firewall, OS-update, anti-malware and EDR signals |
| How apps are exposed | A concentrator listening on the internet | Connectors that dial out to Akamai |
| Where identity comes from | Local VPN accounts or RADIUS | SAML or OIDC from your IdP, SCIM for groups |
| What it is NOT | — | A web gateway, a server-initiated path, or listed-price |
The cheapest test is Akamai’s free trial: two connectors, one IdP group and one web app, measured from an Indian office for a fortnight.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Edge
Users never land on the app network. Akamai’s service weighs identity, location, time of day and device posture for each request, then joins the user to one app.
Connectors
Connectors are VMs or containers on VMware, OpenStack/KVM, Hyper-V, AWS, Google Cloud, Azure, Docker or Podman; each dials out to Akamai, never awaiting inbound calls.
Entry
Web apps open in a browser with nothing installed. RDP, SSH and other TCP or UDP apps use the Access module of the Akamai Zero Trust Client, successor to the EAA Client.
Policy
SAML from Akamai IdP, Google, Ping, Okta or Entra ID, or OIDC, names the user; SCIM syncs groups, and device checks plus SIA, Carbon Black or CrowdStrike signals judge the laptop.
Connectors dial out from your sites and clouds — users arrive by browser or Zero Trust Client, and policy decides per app.
Nine capabilities. Connect, verify, extend.
Akamai EAA lets each user open the private apps they are allowed, and nothing else on the network.
Web apps in any browser
HTTP and HTTPS applications open from a browser with no software on the device, which suits contractors, auditors and BYOD laptops.
RDP, SSH, TCP and UDP
The Access module of the Akamai Zero Trust Client carries the non-web traffic: remote desktops, SSH sessions and other TCP or UDP apps.
Eight places to run them
Connector VMs or containers run on VMware, OpenStack/KVM, Hyper-V, AWS, Google Cloud, Azure, Docker or Podman, close to the apps.
Location and time rules
Policies weigh where the user is and when they connect, alongside who they are, before any application is offered to them.
Device health checks
Firewall status, OS update level and anti-malware state are read from the device and written into the access policy for each app.
EDR verdicts count too
Posture can draw on risk signals from Akamai SIA, Carbon Black and CrowdStrike, not only on what the access client sees locally.
Bring your own IdP
SAML with Akamai IdP, Google, Ping, Okta or Microsoft Entra ID, plus OpenID Connect, with SCIM provisioning from Azure and Okta.
SaaS, bookmark and tunnel
Beyond web and client apps, EAA defines SaaS apps for identity bridging, bookmark apps and tunnel apps; one edge-transport type is beta.
Pairs with MFA and SIA
Akamai MFA, Secure Internet Access and App & API Protector are documented integrations, each sold apart; events can feed a SIEM.
Watch Akamai EAA in action
Akamai’s 2026 episode on unified zero trust, plus the 2020 and 2018 EAA overviews filmed before the Zero Trust Client. All from Akamai’s official channel.
Unified Zero Trust: Connecting East-West and North-South Security | Episode 5
Akamai’s 2026 take on joining user-to-app access with segmentation inside the data centre, the pairing EAA belongs to.
Akamai Enterprise Application Access: Simple and Secure Identity-Aware Access
A 2020 overview of identity-aware access, filmed before the Akamai Zero Trust Client replaced the EAA Client.
Enterprise Application Access Overview
The original 2018 explainer of the connector model; check any feature it shows against today’s documentation.
Want a live, India-context walkthrough for your environment?
Book a guided demo →A VPN trusts a device once the tunnel is up. EAA decides app by app on identity and posture.
Here’s what genuinely sets it apart — and exactly where it stops.
Web access with nothing to install
Contractors, auditors and staff on personal laptops open internal web apps from a browser, with no VPN account to issue and no client to package. Each person sees only the apps on their policy, so a borrowed login reaches that list, not a subnet.
Connectors wherever the apps already live
Connector VMs or containers run on VMware, OpenStack/KVM, Hyper-V, AWS, Google Cloud, Azure, Docker or Podman, so racks plus three clouds need no new appliance type. Every connector dials out to Akamai, keeping apps off the inbound path.
Posture from tools you already run
Beyond the client’s firewall, OS-update and anti-malware checks, EAA takes risk signals from Carbon Black, CrowdStrike or Akamai SIA. Identity arrives over SAML or OIDC from Akamai IdP, Google, Ping, Okta or Entra ID, with SCIM for Azure and Okta.
Where it stops
Akamai prints no price or licensing unit. Server-initiated protocols are not documented, so softphones may stay on the VPN. No Indian EAA PoP is named. The Akamai Zero Trust Client is covered by the May 2026 advisory for CVE-2026-34354; run a fixed build.
The numbers behind the platform
What your Akamai EAA rollout looks like
Sort the VPN apps by protocol
List every app the VPN carries and mark it web, RDP, SSH or other TCP/UDP; anything server-initiated goes on its own list.
Wire identity before apps
Federate EAA with your IdP over SAML or OIDC, switch on SCIM for Azure or Okta groups, and map groups to the pilot apps.
Place a pair of connectors
Deploy two connector VMs or containers near the pilot apps in your Indian site or cloud account and confirm they reach Akamai.
Contractors first, then admins
Move one contractor group to clientless web access, then roll the Zero Trust Client to admins who need RDP and SSH.
Add posture, shrink the VPN
Turn on firewall, OS-update and anti-malware checks, add EDR signals, and remove VPN accounts app by app as each moves.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Auditors now open our reconciliation portal in a browser on their own laptops. No more quarterly VPN logins for them.”
“CrowdStrike already scored every laptop; feeding that into EAA policy cut ERP access for machines with a broken sensor.”
“We ran connectors as Podman containers beside the apps. The network team approved fast once they saw only outbound links.”
“Admins use the Zero Trust Client for RDP and SSH. Pushing it to 400 laptops took longer than writing the policies.”
“Our call-centre softphones still need the old concentrator. Prove server-started traffic before setting a VPN shutdown date.”
“No figure to budget against until the quote came, and nobody could say which Indian location our sessions would use.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the zero trust access market — tap any vendor to see why it sits where it does.
TechBag Zero Trust Access Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only with a free trial; sold apart from MFA and SIA.
Protocol Reach × Decision Depth
The grid nobody publishes — how many app types and protocols the product reaches vs how many signals feed each access decision.
Web, RDP, SSH, TCP/UDP; posture adds SIA, Carbon Black, CrowdStrike.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Akamai EAA vs the zero trust access field
Against Zscaler Private Access, Netskope One Private Access, Palo Alto Prisma Access, Cloudflare Access and InstaSafe ZTNA — on connectors, access modes, protocols, posture, identity, inspection, scale, price and India.
| Dimension | Enterprise Application Access | Zscaler Private Access (ZPA) | Netskope One Private Access | Palo Alto Prisma Access (ZTNA) | Cloudflare Access | InstaSafe ZTNA |
|---|---|---|---|---|---|---|
| What it is | Akamai’s ZTNA | Zscaler’s private access | Module of Netskope One | Prisma Access ZTNA | Part of Cloudflare One | India-built, IP layer |
| Connector design | 8 connector hosts | App Connectors, outbound | Brokered in NewEdge | Prisma Access locations | Tunnel connectors | Dark until checked |
| Access modes | Clientless + client | Client + browser | Client + clientless | GlobalProtect + browser | WARP + browser | Agent + agentless |
| Apps and protocols | Web, RDP, SSH, TCP/UDP | Web, SSH, RDP, thick | Widest documented | Web, SSH, RDP, thick | Web, SSH and RDP | Thick clients, devices |
| Server-initiated flows | Not documented | Via extra appliance | Documented | Not established | Not established | Not documented |
| Device posture | Checks + EDR signals | Rechecked mid-session | Per-request checks | Agent and browser | WARP or browser | Agent and browser |
| Identity and SSO | SAML, OIDC, SCIM | SAML, OIDC, SCIM | SAML, OIDC, SCIM | Adds conditional access | SAML, OIDC, SCIM | SAML and OIDC |
| Inspection on the path | Separate Akamai SKUs | DLP sold separately | One DLP policy | Add-ons on top | Elsewhere in the suite | Access only |
| Scale evidence | One customer named | Most widely deployed | Above 5,000 users | Verified at scale | Above 5,000 users | Mid-market documented |
| Pricing model | Quote; unit unpublished | Per user, by edition | Per user, platform-tied | Per user, per year | Free tier, then per user | Per user, published |
| Published entry price | Not published | ~$6–11 reported | Not published | Not published | $0 to 50, then $7 | ~$8/user/month |
| Standalone or bundled | Own product, own trial | Standalone | Platform module | Not standalone | Standalone | Standalone |
| India presence | No EAA PoP named | PoP cities unconfirmed | 8 Indian data centres | Mumbai documented | 6 Indian cities | Built and hosted here |
| Best fit | Akamai security estates | Full VPN switch-off | VoIP and SCCM apps | Palo Alto firewall shops | Priced, quick start | Indian, GeM buyers |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Akamai EAA if…
- ✓You already run Akamai SIA, MFA or App & API Protector and want private-app access from the same vendor and client
- ✓Contractors need internal web apps from their own laptops while admins need RDP and SSH through one managed client
- ✓Access decisions should weigh CrowdStrike or Carbon Black verdicts, not only the access client’s own device checks
Compare alternatives if…
- ✓Softphones, SCCM or other server-initiated traffic must leave the VPN — Netskope documents it, and Zscaler adds a Network Connector
- ✓You want a printed price before a sales call — Cloudflare is free to 50 users and InstaSafe publishes about $8 a user
- ✓Indian points of presence must be on record — Netskope lists eight Indian data centres and Cloudflare six cities
Do not expect…
- ✓A list price, or a published licensing unit, for EAA
- ✓Documented support for server-initiated protocols such as VoIP
- ✓A named Indian EAA point of presence, or an analyst ranking for EAA by itself
Enterprise Application Access is one of 23 zero trust access products TechBag carries. The Zero Trust Access guide narrows them to a shortlist and shows the reasoning. →
What does running the VPN cost your helpdesk?
Drag the sliders (remote users on the VPN today; IT support-hour cost). Estimates assume each remote user costs 1.5 support hours a year in VPN tickets, account changes and access reviews, and that per-app access driven by IdP groups removes 70% of it. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Akamai publishes no price or licensing unit for Enterprise Application Access; the product page offers a free trial and a sales contact. Akamai MFA, Secure Internet Access and App & API Protector are separate products, each quoted on its own, so settle early which of them the deal includes. TechBag sorts your apps by protocol and counts users first, then quotes in INR with GST.
EAA free trial
Best for proving one app first
- Free trial from akamai.com
- Connectors on your own VMs or containers
- Clientless web access from day one
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
EAA subscription
Best for retiring VPN accounts at scale
- Quote only; no public price or unit
- Akamai MFA and SIA sold separately
- Zero Trust Client for non-web apps
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which VPN apps are web, which need RDP, SSH or other TCP/UDP, and which are server-initiated and may have to stay?
Will connectors run on VMware, Hyper-V, OpenStack/KVM, a cloud account, Docker or Podman, and how many per site?
Is your IdP Akamai IdP, Google, Ping, Okta or Entra ID, and do you need SCIM provisioning from Azure or Okta?
Which checks matter — firewall, OS updates, anti-malware — and will CrowdStrike, Carbon Black or SIA feed risk in?
Is every managed device on a Zero Trust Client build that fixes CVE-2026-34354, and who owns client updates?
Can contractors do their work through clientless web access alone, or will some of them need the client?
Akamai names no Indian EAA PoP, so will the trial measure session latency from each of your Indian offices?
Which unit does the quote count, which other Akamai products are bundled in, and is it itemised in INR with GST?
Questions buyers ask
Ready to evaluate Akamai EAA?
List your VPN apps by protocol and user group first, or let a TechBag advisor scope an EAA trial that moves one contractor team to clientless web access.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.