- 235 users protected
- 0 unauthorised WeTransfer uploads*
- 85% below quoted ZTNA price
- 7 years customer relationship
*Customer-reported after deployment
At a Glance
Company: De Hooge Waerder, a Dutch full-service accountancy and advisory firm founded in 1980.
Challenge: Prevent confidential client files from being uploaded to WeTransfer and other unauthorised cloud services, with consistent enforcement across Windows and iOS.
Solution: Zenarmor Security Service Edge (SSE) on OPNsense, including cross-platform endpoint enforcement, action-level cloud controls, CASB, TLS inspection, and centralized management through Zenconsole.
Outcome: 235 users protected, zero unauthorized WeTransfer uploads reported after deployment, no user-facing outage, five sites managed centrally, and an annual SSE list price approximately 85% below an enterprise vendor’s quote for ZTNA alone.
The Challenge: Stop Confidential Client Data From Leaving Through the Front Door
Founded in 1980, De Hooge Waerder is a Dutch full-service accountancy and advisory firm with approximately 200 professionals across five offices, more than 3,000 clients, and annual revenue exceeding €23 million. Its services span accountancy, tax, audit, legal, payroll, and corporate finance. Ranked among the top 40 Dutch accountancy firms, De Hooge Waerder is also a member of Nexia, a global network of independent accounting and advisory firms spanning more than 100 countries.
That scale creates a demanding information-security environment: highly confidential client data, a growing workforce, multiple offices, cloud applications, and employees who need to work productively from different devices and locations.
At De Hooge Waerder, a potentially damaging security event could begin with a completely ordinary action: an employee uploading a confidential client file to WeTransfer because it was the fastest way to send it. For a firm entrusted with financial, tax, legal, payroll, and corporate-finance information, that moment of convenience could become a data-protection incident.
The firm needed to prevent unauthorized uploads without stopping legitimate work, and it needed the same policy to follow users across Windows and iOS. The core requirement was precise: keep the service usable, stop the risky action, and create evidence that the control was working.
Microsoft Conditional Access helped govern access in the firm’s Microsoft environment, but it did not deliver the consistent, action-level enforcement De Hooge Waerder needed across its mixed device estate. In particular, the team could not apply the WeTransfer upload restriction uniformly to iOS users.
- A uniform policy response: A user should not be able to upload a confidential client file to WeTransfer from a device outside the effective policy scope.
- Protection beyond the gateway: Gateway-only inspection could not protect traffic that never passed through the office gateway.
- Windows and iOS coverage: Windows controls did not solve the iOS gap.
- Demonstrable enforcement: A written policy was not enough; the firm needed enforceable, auditable proof.
A Six-Figure Alternative and a Better Path to Proof
The IT team evaluated several options. One enterprise vendor quoted approximately €200,000 per year for ZTNA alone. That price was difficult to justify for a mid-sized professional-services firm with broader cloud and endpoint security needs.
Zenarmor changed the buying motion. The team first discovered the platform through the OPNsense community and could validate it before making a large commitment. At an annual list price of €29,000 for the 235-user SSE deployment, Zenarmor was approximately 85% below the enterprise ZTNA quote, a difference of approximately €171,000 per year between the quoted prices. Long-standing customer upgrade discounts made De Hooge Waerder’s actual cost lower still.
Why De Hooge Waerder Selected Zenarmor SSE
The decision was not driven by a long checklist. Four capabilities mapped directly to problems the team had already experienced:
- Cross-platform policy enforcement: The same cloud-access rule could protect Windows and iOS users, closing the gap the existing approach left open.
- Action-level cloud control: De Hooge Waerder could target the risky action, uploading to WeTransfer, rather than bluntly blocking every use of the service.
- Proof before commitment: The free evaluation let the team test the control in its own environment before expanding the commercial relationship.
- Architecture without lock-in: Zenarmor ran with the firm’s OPNsense deployment and carried forward when the virtualisation layer moved from Hyper-V to Proxmox, without a hardware repurchase.
“User error remains our biggest security risk. We needed a practical way to prevent confidential information from leaving the organisation while meeting strict Dutch compliance requirements. Zenarmor running on OPNsense gave us a solution that was effective, simple to manage, and dramatically more affordable than the alternatives.”
— Eelco Akker, ICT Consultant, De Hooge Waerder
Seven Years of Earned Expansion
De Hooge Waerder did not make a single leap from firewall protection to SSE. It expanded step by step as its environment and risk profile changed. Each investment followed proven value, and the platform evolved without forcing the firm to rebuild what already worked.
- 2019: Started with the free version on virtualised OPNsense instances running on Hyper-V. The environment was still largely RDS-based, and Zenarmor added protection against malware, phishing, and malicious sites.
- 2020: Expanded to Sensei Premium across the firm’s high-availability OPNsense instances, adding the advanced filtering the IT team needed.
- 2021 – 22: Moved on-premises servers to Microsoft Cloud, migrated OPNsense from Hyper-V to Proxmox, and progressed through Sensei Business to Zenarmor NGFW Business following the product rebrand.
- 2023: Moved users from RDS to Intune-managed laptops and evaluated Zenarmor SSE. Endpoint enforcement became essential as users and traffic moved beyond the gateway.
- 2024 – 25: Centralised administration in Zenconsole, giving the IT team one place to manage distributed instances and policy as the organisation continued to grow.
- 2026 – 27: Evaluating ZTNA and broader SASE capabilities to extend least-privilege access and unified policy as the environment scales toward 500 users.
The result is a customer journey built on proof, not a rip-and-replace event.
Implementation: The Customer Helped Shape the Control
The 2023 move from Zenarmor NGFW Business to SSE was the most significant step in the relationship. De Hooge Waerder tested the platform intensively, and Zenarmor extended the evaluation period so the IT team could validate the design thoroughly before committing to production.
During that process, the team identified two missing capabilities that mattered to its environment:
- WeTransfer upload control: The ability to block upload actions to WeTransfer specifically.
- Whitelist-only TLS inspection: A mode that allowed the team to focus decryption where it was required.
Zenarmor implemented both requests and included them in the production release. The customer was not asked to redesign its requirement around the product; the product was strengthened around a real customer control gap.
The production rollout protected 235 users without a user-facing outage or loss of productivity. Previous tier transitions had also been described by the customer as hassle-free, giving the team confidence that the architecture could grow with the organisation.
“Many organisations struggle to introduce modern security capabilities without disrupting existing network deployments. Zenarmor’s architecture allows security to be inserted directly into the traffic path with minimal disruption, enabling organisations to strengthen their security posture while maintaining performance and operational continuity.”
— Eelco Akker, ICT Consultant, De Hooge Waerder
Sovereign by Design: Inspection Without Mandatory Cloud Backhaul
For a Dutch firm handling confidential client information, the location and path of inspection matter. Many enterprise SSE and SASE platforms depend on centralised, vendor-operated cloud points of presence. Depending on the vendor, service region, and tenant configuration, inspected traffic may traverse US-hosted or other externally controlled infrastructure, creating questions about data residency, foreign-jurisdiction exposure, latency, and operational control.
Zenarmor’s distributed model works differently. Policy enforcement runs on the customer’s endpoints and gateways, so protected traffic does not need to be backhauled through an external inspection PoP. Client traffic can remain within infrastructure controlled by De Hooge Waerder rather than being routed through a mandatory vendor inspection layer.
- Inspection stays close to the traffic: Security policy is enforced on customer-controlled endpoints and gateways, without mandatory backhaul to a US-hosted cloud PoP.
- Operational control is preserved: The firm retains control over the enforcement points, policy, and audit data used to protect confidential client information.
- Data-residency objectives are supported: The architecture reduces unnecessary movement of inspected client traffic across third-party infrastructure and jurisdictions.
That distinction supports De Hooge Waerder’s data-residency and operational-control objectives while avoiding an unnecessary traffic detour. It also lets the firm modernise beyond the gateway without surrendering the OPNsense-based architecture it already trusts.
From a Written Policy to a Demonstrable Control
AVG, the Dutch name for the GDPR and an information-security programme aligned with ISO/IEC 27001 require more than a rule that tells employees not to use an unsanctioned service. The organisation needs proportionate technical measures, consistent enforcement, and evidence that those controls operate in practice.
For De Hooge Waerder, the deployment is directly relevant to ISO/IEC 27001:2022 Annex A controls including A.8.20, Network Security; A.8.22, Segregation of Networks; and A.8.12, Data Leakage Prevention. Cross-platform enforcement, selective upload control, TLS inspection, centralised policy, and logging help the firm implement and demonstrate the technical controls behind those requirements.
NIS2 Article 21 requires entities in scope to take appropriate and proportionate technical, operational, and organisational measures to manage risks to network and information systems and minimise the impact of incidents. Its minimum measures cover risk analysis and information-system security; incident handling; business continuity and crisis management; supply-chain security; secure acquisition, development, and maintenance; vulnerability handling and disclosure; assessment of control effectiveness; cyber hygiene and training; cryptography and encryption; human-resources security, access control, and asset management; and multi-factor or continuous authentication and secure communications where appropriate.
- Policy follows the user: Enforcement is not limited to traffic that happens to cross the office perimeter.
- The risky action can be controlled: The firm can stop an upload while preserving legitimate access where policy allows it.
- The control creates an evidence trail: Centralised management and logging help the team show that policy is applied across the environment.
These capabilities support compliance and audit readiness; they do not, by themselves, guarantee ISO 27001 certification or compliance with AVG/GDPR or NIS2. For organisations assessing NIS2 obligations, the same emphasis on risk-based controls, governance, and demonstrability is directly relevant.
The Partner Perspective
“Network segmentation protects the internal network. SSE focuses on the user, the cloud session and the data movement.”
— Secrotec
Secrotec, a Netherlands-based ISO 27001 Lead Auditor and Zenarmor partner, uses this distinction to explain why gateway controls alone cannot govern a remote employee’s direct upload to a cloud service. The partner’s practical guidance connects selective upload controls, audit evidence, and data-residency considerations for Dutch organisations.
Read Secrotec’s WeTransfer, SSE, CASB and DLP guide | Read the broader Zenarmor architecture guide
The Results
De Hooge Waerder established a cross-platform SSE control for the specific cloud-upload risk that began the project, while preserving the architecture and operating model the IT team already trusted. The deployment produced several important outcomes:
- Zero unauthorised WeTransfer uploads reported after deployment: The upload gap that began the project was addressed across the device types in scope.
- Consistent enforcement across iOS and Windows: The same cloud-access policy applied across the mixed device estate.
- Continuity preserved for 235 users: The SSE rollout completed without a user-facing outage or loss of productivity.
- Five sites managed centrally: Zenconsole centralised policy and operational visibility for the distributed environment.
- Action-level cloud control: The firm could preserve access to useful cloud services while controlling the actions that created data-loss risk.
- Architecture retained: The same OPNsense and virtualised foundation continued to serve the business; no new security appliance rollout was required.
- No re-procurement during platform changes: The virtualisation move and successive product-tier expansions did not require the firm to discard its security foundation.
- A vendor relationship that delivered: Two requested controls were converted into shipped product capabilities.
Security Economics Without Security Compromise
At an annual list price of €29,000, Zenarmor SSE protected 235 De Hooge Waerder users with cross-platform enforcement, cloud-action control, TLS inspection, and centralised management. A leading enterprise vendor had quoted approximately €200,000 per year for ZTNA alone. Zenarmor’s SSE deployment was priced approximately 85% below that quote, a difference of €171,000 per year, while addressing a wider range of the firm’s immediate security needs.
The economic value extended beyond licence cost: lower operating complexity through centralised policy and visibility; reduced exposure from unauthorised cloud uploads across the mixed device estate; no re-procurement when the virtualisation platform changed or the product tier expanded; and room to scale without a hardware refresh or a second stack of point products.
Looking Ahead: From Cloud Control to Least-Privilege Access
De Hooge Waerder is evaluating Zenarmor’s ZTNA and broader SASE capabilities for 2026–27 as the environment scales toward 500 users. The next step is not another migration; it is an extension of the architecture already in place.
Where SSE secures users’ access to the web, SaaS applications, and cloud services, ZTNA extends the model to private applications and resources. Identity- and context-aware, least-privilege policy verifies users and devices rather than granting broad trust simply because a connection originates inside the network. This creates a software-defined perimeter in which applications are exposed only to authorised users under the right conditions.
Full SASE brings SSE and ZTNA together with SD-WAN and unified policy management across sites, users, devices, internet access, and private access. Instead of managing network connectivity and security as separate stacks, the firm can apply one governance model that follows the user across offices, remote locations, and future branches.
For De Hooge Waerder, the practical value would include more precise control over which employees can access specific client-data systems, stronger protection across its five-location network as it expands, and a single auditable policy framework for office staff, remote workers, and new locations. The existing OPNsense and Proxmox foundation, together with centralised management in Zenconsole, provides a path to these capabilities without a hardware refresh, a new vendor, or a disruptive rearchitecture.
A Blueprint for Professional-Services Firms
De Hooge Waerder’s experience is relevant far beyond one Dutch accounting firm. Independent accounting, legal, tax, and advisory organisations face the same structural pressure: mobile workforces, mixed devices, cloud applications, sensitive client data, and budgets that cannot absorb every six-figure security proposal.
As a Nexia member serving a global professional-services network, De Hooge Waerder provides a strong peer example: start with a precise business risk, prove the control in the real environment, expand without discarding the existing architecture, and preserve control over where enforcement happens.
The strongest security transformation is not necessarily the one with the largest stack. It is the one that closes a real risk, fits the operating model, and keeps working as the organisation grows.
