Hybrid work, collaboration with third parties, and the growing use of personal devices have turned what was once an exception into the norm: providing people and devices outside the organization’s control with access to corporate applications. How can organizations provide that access securely when they can’t, or don’t want to, install software on a user’s device? Traditional perimeter security was designed for people working inside the office, so it isn’t well suited to this reality. That challenge is driving interest in agentless ZTNA (Zero Trust Network Access).
For years, the answer was a VPN. Once connected, users were inside the network and could see far more than they needed. Zero Trust flips that logic. NIST SP 800-207, Zero Trust Architecture, sums it up simply: “Never trust, always verify.” With Zero Trust Network Access (ZTNA), users get access to a specific application rather than the network, with their identity and context checked each time they connect.
Traditional ZTNA often relies on software installed on the user’s device. That can be a problem when it isn’t practical to install an agent. According to MarketsandMarkets, the ZTNA market is expected to grow from $1.34 billion in 2025 to $4.18 billion by 2030, at a compound annual growth rate of 25.5%. Within this market, the agentless segment is expected to grow fastest. Many of the use cases behind that growth, including third-party access and BYOD, call for an agentless approach.
What is agentless ZTNA?
Agentless ZTNA enables Zero Trust access through a web browser without requiring client software to be installed on the device. The user visits a URL, signs in, and accesses only the application they’re authorized to use. Everything else stays hidden.
How does it work?
Instead of opening a tunnel into the network, access is mediated through a broker or reverse proxy. When a user requests an application, the platform verifies their identity and connection context, and only then establishes a session with the authorized resource. This verification isn’t a one-time check; identity and connection context are re-evaluated in every session, in line with Zero Trust principles.
Agentless access isn’t limited to web applications. Through the browser, users can also securely access services that use a range of protocols: HTTPS for web applications via a reverse proxy, RDP for remote desktop, VNC for live support (useful for kiosks or industrial HMI interfaces), SSH for text-based administration, and SFTP or SMB for file transfer. No additional software is required on the user’s device.
What problems does it solve?
Agentless access removes deployment friction when installing a client isn’t possible or practical. It’s a natural fit for third-party and contractor access, as well as for external vendors who need temporary access to a specific application without the IT team having to manage or provision their devices. It also works well for BYOD scenarios, where employees use unmanaged personal devices, and for critical infrastructure (OT, ICS/SCADA), servers, and industrial systems that should never be exposed to the Internet but still need secure, controlled remote access. Getting started is straightforward: the user opens a URL and signs in. That makes agentless access a good fit for pilots and teams with frequent staff turnover.
There are two more advantages. In proxy mode, application credentials stay protected and aren’t shared with the end user. Users can also connect from any device or operating system with a compatible browser.
Why does it outperform the traditional model?
Unlike a VPN, agentless ZTNA doesn’t expose ports or IP addresses. This keeps the network hidden from the Internet and reduces the attack surface that attackers can scan. By granting access to specific applications rather than the network, it limits lateral movement if a breach occurs. The same access policy follows users wherever they are, without requiring separate rules for office and remote work. There’s also no need to maintain and patch a legacy VPN concentrator, which can become a target for attackers when a new vulnerability is disclosed.
One point is worth clarifying: agentless mode doesn’t replace agent-based ZTNA; it complements it. An agent provides a detailed view of a device’s security posture. This includes its health, telemetry, and certificates, and is well-suited to devices managed by the organization. Agentless access is useful where an agent can’t be installed. A ZTNA approach that combines both can cover the full environment without leaving gaps.
Conclusion
Agentless access has moved from a niche capability to a baseline requirement. Where a VPN exposes too much of the network or an agent can’t be installed, agentless ZTNA provides secure, application-specific access for third parties, BYOD scenarios, and OT environments, with identity and connection context verified in every session. It’s a key piece of the puzzle when extending Zero Trust across the entire perimeter.
At Teldat, we address this challenge with be.Safe Pro ZTNA Agentless, our cybersecurity platform for universal ZTNA. It can be deployed on-premises or in hybrid mode and orchestrated through a guided interface. To find out how it could work for your organization, get in touch with our team.
