As hybrid work cements itself as the new norm, enterprises are making meaningful strides in adopting Zero Trust Network Access (ZTNA) to replace legacy VPNs. But there’s a major blind spot in how most organizations implement ZTNA: unmanaged devices.
ZTNA adoption tends to focus almost exclusively on corporate-managed laptops and desktops. The assumption is that every employee works on a hardened device, with security tools installed and configurations locked down by IT. But that assumption is outdated—and dangerous.
Today, 47% of companies allow enterprise access from Bring Your Own Devices (BYOD) or non-corporate endpoints, such as those used by contractors, freelancers, or partner firms. These devices are outside IT’s control, but they still touch critical systems and data. And when left unsecured, they open the door to data loss, compliance violations, and serious breaches.
The risks are well-documented and growing. But many of the traditional approaches to securing these endpoints fall short—adding complexity without truly mitigating the threat. It’s time to rethink how we extend Zero Trust to every user, regardless of who owns the device they use.
The Risk Landscape: Unmanaged Devices in the Enterprise
The challenge of unmanaged endpoints is no longer theoretical. In the modern enterprise, consultants, contractors, and partners are integral to getting work done—and they often need immediate access to internal systems and sensitive data.
BYOD scenarios are equally common. Executives check dashboards from personal tablets, marketers access cloud apps from home desktops, and employees work on personal laptops while traveling. In each case, IT has little to no visibility or control over the device’s security posture.
This lack of visibility leads to four major risks:
- Inconsistent Security Posture: Enterprises spend millions to harden corporate laptops, but when a contractor connects from an unmanaged MacBook, all that work is undone. Different devices mean different patch levels, malware protection, and access methods. There’s no consistent enforcement of policies like multi-factor authentication (MFA), endpoint compliance, or data loss prevention (DLP).
- Operational Complexity: IT teams often patch together multiple tools to provide access to different categories of users. There might be one VPN for employees, another for partners, and a third for privileged consultants. This approach creates silos, complicates troubleshooting, and increases the risk of misconfiguration.
- Poor User Experience: Non-corporate users typically rely on VPNs, which weren’t designed for today’s fast-moving, cloud-centric work. They suffer through repeated logins, sluggish performance, and broad access that’s hard to scope down. Productivity suffers—and frustration mounts.
- Compliance Gaps: Regulations like PCI-DSS, GDPR, and HIPAA require consistent policy enforcement and detailed audit logs. Traditional VPNs can’t verify the health of unmanaged devices, nor do they provide granular controls for data access or sharing. As a result, organizations using legacy access tools for BYOD risk falling out of compliance.
Band-Aid Approaches and Why They Fail
In response to challenges faced by IT teams, many attempt to retrofit controls onto their legacy infrastructure. Some common methods include Split VPN Access, VDI (Virtual Desktop Infrastructure), and Third-party Agentless ZTNA.
Split VPN Access allows BYOD or third-party users to access only a subset of applications through a limited VPN tunnel. However, it still depends on perimeter-based access and cannot provide context about the user or device state. It is also difficult to scale securely across geographies and networks.
VDI redirects unmanaged users to a virtual environment hosted in the data center or cloud. However, it requires costly infrastructure and creates a clunky user experience, often pushing users to seek workarounds.
Third-party Agentless ZTNA adds a separate product or browser-based solution for unmanaged access, distinct from the main ZTNA stack. While it may address access needs in isolation, it requires separate policy engines, consoles, and integration frameworks, creating two security postures: one for managed devices, one for everyone else.
None of these tools offer a unified Zero Trust architecture, and in today’s world, fragmentation is the enemy of security.
The Right Way: ZTNA for Everyone, Everywhere
To truly solve the BYOD and contractor problem, enterprises need a comprehensive ZTNA solution that applies to all users and all devices under a single policy framework.
The foundation of this approach is simple: trust no one, verify everything, and enforce policies consistently. That means:
- Contextual Access Control: Access decisions are based on identity, device posture, location, and behavior—not just credentials.
- Device-Agnostic Architecture: Whether a user is on a corporate laptop, a personal iPad, or a contractor’s home desktop, they receive the same level of protection, policy enforcement, and user experience.
- Unified Policy Engine: IT defines policies once and applies them everywhere—no more separate consoles for managed and unmanaged access.
- Clientless and Agent-Based Options: Employees may use an always-on ZTNA client, while contractors and BYOD users can connect through a secure browser portal, with consistent inspection, data loss prevention, and control.
- Granular Visibility and Logging: Every access request is logged, every action is monitored, and every policy is enforced across all users and devices.
This approach doesn’t just close the security gaps. It simplifies IT operations, improves compliance posture, and enhances the user experience.
Use Cases: What It Looks Like in Practice
- A contractor logs in from their personal laptop. Before granting access, the ZTNA solution checks the device’s OS, browser version, and IP address. It verifies identity via SSO and MFA. Based on these factors, the contractor is allowed access only to a specific cloud-based app, and only in read-only mode.
- An employee at a hotel uses a tablet to check work email. Since the device lacks endpoint protection, the ZTNA platform grants access via Remote Browser Isolation (RBI), preventing any local data caching or downloads.
- A partner logs in to a shared dashboard from a location outside their typical geography. The ZTNA system flags the session for additional verification and restricts data export functions.
In every case, access is precise, policy-driven, and secure—without needing separate tools or processes.
The Path Forward
The shift to hybrid work is permanent. That means BYOD and third-party access are not exceptions—they’re standard operating procedures.
It’s time for enterprises to stop treating unmanaged devices as an edge case and start securing them as part of a unified Zero Trust strategy.
By adopting a comprehensive ZTNA solution that covers all users and all devices through a single policy framework and management interface, organizations can reduce risk, improve operational efficiency, and deliver a seamless experience to everyone—without compromising on security.
In a world of complexity, Zero Trust simplicity is not just possible. It’s essential.
