Managed ZTNA · Infrastructure as a Service

Close every inbound port. Keep the access.

PISTIS delivers ZTARC as infrastructure-as-a-service ZTNA — securing SSH, web apps and jump-host access without exposing anything to the public internet.

Book a 30-minute walkthrough See how it works

Provided by Pistis Digital Indonesia

port scan — same application, two front doors

Behind a legacy VPN

$ nmap -Pn vpn.acme-legacy.net
Host is up (0.021s latency).

PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
443/tcp  open   https

Anyone on the internet can reach these.

3 open ports · discoverable

Behind ZTARC

$ nmap -Pn app.acme.internal
Host seems down. No response.

PORT     STATE  SERVICE
(all 65535 ports filtered)

The same app — reachable, but not findable.

0 open ports · no response

Both hosts serve the same internal app. Only one of them can be found.

Context

The perimeter is was the network.

Remote work, SaaS and multi-cloud dissolved the corporate LAN. The old “trust inside, block outside” model no longer maps to how work happens.

  • Legacy perimeter security leaves enterprises exposed to modern threats.
  • Zero Trust removes implicit trust — every user, device and request is verified.
  • ZTARC is cloud-native ZTNA built on WireGuard, with under 50 ms latency.

ZTNA market 2025

$1.34B

Global ZTNA market size in 2025.

Forecast 2030

$4.18B

Projected ZTNA market by 2030.

CAGR 2025 → 2030

25.5%

Compound annual growth — one of the fastest-growing security segments.

Source — MarketsandMarkets, ZTNA Market Report (Jul 2026)

The problem

VPNs and jump hosts leave the door open.

Symptom 1

Everything reachable is scannable

Any public IP and port is discoverable in minutes by mass scanners.

Symptom 2

“Inside” is not the same as safe

A VPN grants network-level trust — one compromised laptop pivots freely.

Symptom 3

Operational drag

DMZ firewall rules, certificate rotation and bastion access reviews consume weeks per year.

Every open port is a standing invitation.

Exposure

3.9M

SSH endpoints publicly reachable on port 22 across the IPv4 space.

Time

<5min

Median time from an IP going live to the first automated scan hitting it.

Breach cost

$4.45M

Average total cost of a data breach globally.

Attack vector

#1

Compromised VPN and remote-access services top the initial-access charts year after year.

The uncomfortable truth

You cannot patch fast enough. You cannot rotate keys fast enough.

The only winning move is to stop being discoverable.

Sources — IBM Cost of a Data Breach 2024 · Shodan internet survey · Verizon DBIR 2024

Our solution

ZTARC

Zero Trust Network Access, run for you. You keep your apps and servers exactly where they are — we take the ports off the internet.

What we do

Identity-aware and least-privilege

Every connection is authorised per user and per device, and only to the one service it needs.

Continuous authentication

Every session is re-evaluated as it runs, so trust is re-earned rather than assumed.

WireGuard-based fabric

Encrypted tunnels that default to direct peer-to-peer routing for speed.

How it is delivered

100% cloud-native

No hardware to buy or rack, which removes the physical attack surface with it.

Rapid deployment

Live in minutes instead of months, so the rollout does not stall the roadmap.

Global resiliency

Distributed points of presence backed by a 99.99% uptime SLA.

Architecture

Nothing listens on the internet.

Users and servers both dial out to the ZTARC hub + controller. The hub decides. The spoke opens a path to one service — and never a port to the world.

Policy engine

Never trust the network. Verify every single request.

Every request carries

Identity

A cryptographic key tied to a user or workload.

Context

Time, geography and risk score, evaluated per session.

The one question asked

May this identity reach this service, under these conditions, right now?

deny · by · default

One service at a time

  • SSH → prod-db-01.internal alice@corp · role: sre · 15-min ticket Allowed
  • HTTPS → grafana.internal alice@corp · role: sre · read-only Allowed
  • SSH → finance-server alice@corp · role: sre · not in policy Blocked
  • TCP → 10.0.0.0/8 (broad scan) no matching service policy Blocked

Core principle

Access is granted to a specific service, not to the underlying network. Compromising one workload does not imply access to any other.

Comparison

ZTARC against a legacy VPN.

Capability ZTARC (ZTNA) Legacy VPN
Least-privilege access Yes No
Continuous authentication Yes No
Deployment complexity Easy Hard
Scalability Unlimited Limited
Access visibility Full audit log Limited

Use cases

Two things every team needs on day one.

Use case 01

Secure web application access

Access flow

  1. 01 User signs in through SSO Your identity provider — Okta, Azure AD or Google.
  2. 02 Client connects ZTARC validates group membership before anything is routed.
  3. 03 WireGuard tunnel comes up An encrypted peer-to-peer tunnel to the spoke inside your private network.
  4. 04 The request is routed Traffic flows through the tunnel — the app server is never exposed.
  5. 05 The application loads Served from its private IP, with no inbound port anywhere.

Network topology

Browser Remote user device
ZTARC controller Cloud policy and routing engine
ZTARC spoke Spoke peer — private subnet
Internal web app 10.x.x.x — zero public exposure

What you get

  • Zero public exposure. The app server stays completely hidden from the internet.
  • Verified before connecting. Identity is checked prior to the connection, not after it.
  • No inbound ports. Removes external port scanning and lateral movement.
  • Works with your SSO. Uses the Okta, Azure AD or Google login you already run.

Use case 02

Secure SSH and server access

Access flow

  1. 01 Engineer authenticates through SSO The IdP issues a token and ZTARC validates group membership.
  2. 02 Policy is evaluated Only the devops and sre groups may reach this server peer.
  3. 03 WireGuard tunnel comes up Encrypted peer-to-peer — the server never opens port 22.
  4. 04 SSH straight to the private IP ssh [email protected], routed through the secure network.
  5. 05 Optional built-in SSH The local agent can act as the SSH server, with keys injected automatically.

Network topology

Engineer 10.100.0.2
WireGuard · E2E
Server 10.100.0.5
terminal 
sysadmin@laptop:~$ ssh [email protected]
Connecting to 10.100.0.5 via secure mesh…
tunnel active · policy verified
Welcome to prod-server-01 (Ubuntu 24.04 LTS)

What you get

  • Bastion hosts and jump servers go away entirely.
  • Port 22 is never exposed, so lateral movement has nowhere to start.
  • Access is revoked instantly, and every session is auditable.

Deployment

Four stages, and none of them is a forklift.

  1. 01

    Connect

    Integrate your identity provider in minutes.

  2. 02

    Register

    Register your application and infrastructure resources.

  3. 03

    Enforce

    Apply Zero Trust policy across all users, devices and spoke.

  4. 04

    Monitor

    Continuous visibility and reporting.

Positioning

Why ZTARC, and not the alternatives.

Option A

Self-host ZTNA

  • Full control, open source
  • You own the HA controllers
  • You run the multi-region edge routers
  • You handle PKI, upgrades and patches
  • You are the one paged at 3am
  • Three to six months to production

Option B

Big-vendor ZTNA

  • Managed SaaS
  • Closed source, vendor lock-in
  • Per-seat pricing with opaque markups
  • Your data plane runs through their cloud
  • Limited protocol coverage
  • Migrating means a full rewrite

Option C · recommended

ZTARC

  • Fully managed — no SRE burden
  • Any protocol — SSH, HTTPS, TCP, gRPC, databases
  • Transparent pricing — flat per identity
  • Hours to production — not months
  • 99.95% SLA — 24/7 on-call

Close the ports. Open the door.

Protect everything. Trust nothing.

Book a 30-minute technical walkthrough. Bring one SSH server or one internal web app — we will have it reachable, without inbound ports, before the call ends.

Talk to sales [email protected]