Cato Universal ZTNA
You secured the remote path. The office kept its old assumptions — Most ZTNA secures remote users and leaves the office implicitly trusted — Cato applies one policy to both, with verification that continues through the session.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Cato SASE platform family
This page covers Universal ZTNA — access control. The rest of the platform:
Quick facts
30-second orientation- Product
- Universal ZTNA — one policy, all locations
- The gap it closes
- Office traffic on implicit network trust
- The mechanic
- Continuous verification, not one-time login
- Segmentation
- Per application, not per network segment
- Honest scope
- You need an application inventory first
- Overlap
- Private app access also appears in SSE
- Pricing
- Quote-only — typically per user
- In India via
- TechBag — INR/GST, scoping and support
Understand zero trust access before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is Cato Universal ZTNA?
One access policy for every location — office, home and mobile alike, with continuous verification and entitlement to applications rather than admission to a network.
A network you are admitted to vs an app you are entitled to — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A VPN, or implicit network trust | Universal ZTNA (Cato) |
|---|---|---|
| The office | Implicitly trusted network | The same policy as everywhere else |
| The check | Once, at login | Continuously, through the session |
| What access means | A place on the network | Entitlement to one application |
| Contractors | A VPN account nobody revoked | One application, time-bounded |
| Investigating access | Correlate across three systems | One data lake with network context |
| What it is NOT | — | Not an application inventory — you build that |
Application segmentation needs an inventory of your applications and who needs each: that is the project, and no vendor can supply it. Also confirm whether SSE or ZTNA covers private app access in your quote.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
One policy, every location
The same access rules in the office, at home or on a phone. Most deployments secure remote and implicitly trust the office — a gap attackers know.
Continuous verification
Identity and device posture are re-evaluated during a session, so a device that falls out of compliance after login loses access.
Application-level segmentation
Users reach the specific application they’re entitled to, not a network, limiting lateral movement — which needs an application inventory.
The shared policy framework
ZTNA policy shares the framework SD-WAN and SSE read, keeping access and network context together; the SSE overlap is a scoping question.
One access policy wherever the user sits — identity and posture re-checked in-session, apps reached without network access.
Six capabilities. Verify, entitle, re-verify.
Cato Universal ZTNA replaces implicit trust everywhere — continuous checks and the rest of the Cato Networks portfolio.
The office is not trusted either
One rule set across users and locations, including the office gap most ZTNA projects quietly postpone.
Re-check during the session
Posture and identity evaluated throughout the session, so a device falling out of compliance loses access.
Reach the app, not the network
Entitlement to a specific application, not a network, limits lateral movement when a credential is compromised.
What the endpoint looks like
Patch level, encryption and agent presence feed the decision — only as useful as your posture signals are accurate.
Contractors without a VPN
Give a supplier one application without network access — often an early win over an unrevoked VPN account.
Who reached what, when
Session records sit in the same data lake as network and security events, so access questions are answered in one place.
Watch Cato in action
Private access in practice, the modular platform, and agentic threats.
Cato Private Access: Zero Trust Without the Overhead
Private application access in practice.
Start Anywhere, Grow Everywhere: The Modular SASE Platform
How the modules deploy independently.
Defending Against the Next Generation of Agentic Attacks
Why implicit trust ages badly.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Being connected is not being trusted.
Here’s what genuinely sets it apart — and exactly where it stops.
The office is the half everyone skips
Most ZTNA projects give remote users zero trust and leave the office trusting anyone connected — two policy models and a seam an attacker inside the office exploits. Closing it is harder and often deferred. Every vendor does remote zero trust; the useful question is what happens to the office.
Continuous verification changes what a session means
A one-time login check stops asking once you’re in, missing a device falling out of compliance or a credential used elsewhere. Continuous verification re-evaluates during the session and can withdraw access. But it is only as good as your posture signals, so confirm which signals feed it and how current.
Application segmentation needs an inventory you may not have
Entitlement to one application rather than a network limits what a compromised credential can reach. But it requires knowing your applications, who needs each and how they’re reached — an inventory many enterprises lack. Building it is the real project; budget the discovery honestly, as software can’t supply it.
Where this overlaps with SSE, and why it matters commercially
Private application access appears in both this module and SSE, sharing one policy framework — sensible architecture, confusing licensing, and buyers nearly pay twice. Ask which module in the quote covers private access, and what you pay for twice if you license both.
The numbers behind the platform
What your zero trust rollout looks like
Find the seam
Where does implicit network trust still exist? For most organisations it is the office, and naming it is the start of the business case.
Start with third parties
Contractor access is the clearest early win, and auditing existing VPN accounts usually produces an uncomfortable and persuasive list.
Build the application inventory
What the applications are, who needs each, how they’re reached. That inventory is the project, and takes longer than expected.
Verify your posture signals
Continuous verification of stale data produces confident wrong decisions faster. Check what feeds the decision and how current it is.
Extend policy to the office
The harder half, and the reason universal is in the product name. Deferring it to a phase two is how the seam survives for years.
Review entitlements
Applications change and people move roles. An entitlement model nobody reviews drifts back toward the flat access it replaced.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We had zero trust for remote users and an office that trusted anything plugged into it. Closing that seam was the whole reason we bought.”
“Contractor access without VPN accounts was the fastest win. We found VPN credentials for people who had finished projects two years earlier.”
“The application inventory was the project, not the software. Budget that honestly — nobody can hand it to you and it takes longer than you think.”
“Clarify whether SSE or ZTNA covers private app access before signing. We nearly paid for the same capability twice in one contract.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the zero trust access market — tap any vendor to see why it sits where it does.
TechBag Zero Trust Access Grid
Execution strength vs product vision — the classic market map, minus the paywall.
One policy, office included.
Per-App Scoping × Estate Coverage
The grid nobody publishes — how tightly access is scoped to an application vs coverage across every location and user.
Continuous, per application, everywhere.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Universal ZTNA vs the alternatives
Against remote-only ZTNA, a VPN, and flat network trust — on whether the office is covered and what a credential reaches.
| Dimension | Cato Universal ZTNA | Remote-only ZTNA | VPN | Flat network trust |
|---|---|---|---|---|
| Covers the office | Yes — the point | No | No | No |
| Verification model | Continuous | Usually one-time | One-time | None |
| Blast radius | One application | Per app, remotely | The whole subnet | Everything |
| Third-party access | One app, bounded | Good | A VPN account | Worse |
| Prerequisite work | App inventory | App inventory | Little | None |
| Published pricing | Quote-only | Varies | Often bundled | Free |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Cato Universal ZTNA if…
- Remote users are secured and the office still runs on implicit network trust
- Third-party and contractor access currently means VPN accounts nobody revokes
- You want continuous verification rather than a one-time check at login
- SD-WAN or SSE runs here, so access decisions sit beside network context
Remote-only ZTNA may be enough if…
- Your office footprint is small and the office risk is genuinely low
- Budget covers one phase and remote access is unambiguously the bigger exposure
- You have no application inventory and cannot fund building one this year
Do not expect…
- An application inventory — segmentation needs one and you have to build it
- Continuous verification to help if your posture signals are stale or wrong
- Clarity on private app access by default — confirm SSE versus ZTNA in the quote
Cato Universal ZTNA is one of 23 sase & sse products TechBag carries. The SASE & SSE guide narrows them to a shortlist and shows the reasoning. →
What does implicit trust cost you?
Drag the sliders (users and contractors; IT-hour cost as a loaded rate). Estimates model VPN account administration and the blast radius of a credential that reaches a whole subnet. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote-only — no published price, typically per user. TechBag checks the SSE overlap and how contractor users are counted, then quotes in INR with GST.
Universal ZTNA
Best when the office is still trusted
- One policy across every location
- Continuous verification in-session
- Entitlement per application
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ the wider platform
Best with SSE alongside
- Access decisions beside network context
- One policy framework, not two
- Session records in the same data lake
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Where does implicit network trust still exist in your estate? For most organisations it is the office, and that is the gap.
Do you know what your applications are and who needs each? Segmentation depends on it and the software cannot supply it.
What feeds the device posture decision, and how current is it? Continuous evaluation of stale data is worse than useless.
How many VPN accounts belong to contractors who finished? That audit is usually the most persuasive part of the case.
Does SSE or Universal ZTNA cover private application access in your quote? They overlap and can be paid for twice.
Is extending policy to the office funded, or deferred to a phase two? Deferral is how the seam survives for years.
Who reviews entitlements as people change roles? An unreviewed model drifts back toward flat access.
Is ZTNA priced per user, and how does it combine with SSE? There is no published figure to anchor against.
Questions buyers ask
Ready to evaluate Cato Universal ZTNA?
Audit your existing VPN accounts first — the contractors who finished years ago are usually the most persuasive part of the case — or let a TechBag advisor scope the application inventory work.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.