One Security App for Endpoints, Gateways, and Cloud Workloads
Short answer: a single-app security platform runs the same inspection engine on endpoints, network gateways, and cloud instances, and manages all of them from one console. Zenarmor works this way: one app enforces web filtering, zero trust access, CASB, firewall, IPS, DNS security, and DLP policy locally on each device, instead of routing traffic through a vendor's cloud.
This guide explains what "single app" means in practice, where enforcement happens, what runs where, and when the approach fits.
What does "single app" mean?
Most organizations protect their network with a separate product for each place traffic flows: an endpoint agent for laptops, a firewall at each office, a cloud gateway for remote users, and another tool for cloud workloads. Each product has its own policy language, its own logs, and its own console.
A single-app platform replaces that stack with one engine that can run in all of those places:
- On an endpoint, protecting a laptop wherever it connects
- On a gateway or CPE, protecting everything behind an office or branch router
- On a cloud or virtual instance, protecting workloads where they run
The same policy model applies in every location, so a rule written once means the same thing on a laptop in a hotel and on a branch firewall.
Where does enforcement happen?
There are two broad ways to deliver SASE-style security.
PoP-based architectures send user traffic to the vendor's points of presence (PoPs), inspect it there, and forward it on. That works well for organizations with no network equipment of their own. Every connection takes a detour, though, and a PoP round-trip typically costs 20 to 300 milliseconds.
Local enforcement inspects traffic on the device or gateway where it already flows. Zenarmor takes this approach: security is enforced at the point of connection, without re-routing through a vendor cloud. Inspection adds about 0.2 milliseconds.
Because traffic is inspected where it already flows, it doesn't pass through a vendor's cloud for inspection. Since release 2.7, organization admins can also choose the region where central reporting data is stored.
What runs where?
| Where | What Zenarmor runs on | Typical use |
|---|---|---|
| Endpoint | Windows, macOS, and Linux agents | Remote and hybrid staff, traveling users |
| Gateway / CPE | OPNsense and pfSense CE (one-click plugin), OpenWRT, FreeBSD, and Linux (Ubuntu, Debian, CentOS, Amazon Linux, RedHat) | Offices, branches, existing firewalls |
| Cloud / virtual | Linux and FreeBSD instances on any cloud, bare-metal or virtual | Cloud workloads, virtual networks |
In every location the engine identifies more than 5,000 applications by name rather than by port, and inspects traffic at layer 7, including encrypted TLS traffic.
One console for everything
Zenarmor deployments are managed from Zenconsole, a cloud-based, multi-tenant dashboard. It needs no dedicated management appliance. Recent releases have added:
- Zero-Trust Networks (2.5.1): a wizard that builds encrypted peer-to-peer mesh networks across endpoints and gateways
- SIEM and SOAR streaming (2.6): logs can stream to Elasticsearch or OpenSearch
- Device tags (2.6)
- Audit trails for admin changes (2.6), and audit logs for endpoints and gateways (2.7)
- A REST API for organizations (2.6), and for policies and Zero-Trust Networks (2.7)
- Endpoint protection in every edition (2.7), including the free tier
For large deployments with strict data requirements, self-hosted or air-gapped management is available as a custom offering. Contact sales or your account team to discuss it.
Does it fit existing infrastructure?
A single app only helps if it fits what you already run. Zenarmor installs as a one-click plugin on OPNsense and pfSense CE and runs on the Linux and BSD systems many teams already operate, so it needs no new hardware.
Identity carries over too. Users can sign in through your cloud identity provider, and since release 2.7, organization policies can also use Active Directory and LDAP identities, so existing group structures map straight into security rules.
When does the single-app approach fit?
It fits well if you:
- Already run your own gateways or firewalls and want to add protection without replacing them
- Have a mix of office, remote, and cloud traffic and want one policy for all of it
- Care about latency or about where traffic is processed
A PoP-based service may suit you better if you have no network equipment at all and want the vendor to operate everything. Zenarmor is built for teams that want security to run where their users and workloads already are.
Zenarmor reports more than 500,000 users and 25,000 inspection edges across 180 countries.
FAQ
Can one product really secure endpoints, gateways, and cloud workloads? Yes, if the same engine runs in all three places. Zenarmor runs as an endpoint agent (Windows, macOS, Linux), on gateways (OPNsense, pfSense CE, OpenWRT, Linux, FreeBSD), and on cloud or virtual instances. All of it is managed from Zenconsole.
Does local enforcement add latency? Very little. Zenarmor inspects traffic where it already flows, and inspection adds about 0.2 milliseconds. PoP-based architectures add a round-trip to the vendor's point of presence, typically 20 to 300 milliseconds.
Do I need new hardware? No. Zenarmor runs on hardware and operating systems you already have, including existing OPNsense and pfSense CE firewalls.
What happens if the management cloud is unreachable? Enforcement runs locally on each device, not in a vendor's cloud. Since release 2.7, peers on a Zero-Trust Network can also connect directly when the coordinator or relay servers are offline.
How is it priced? There's a free tier, and business plans start at $5 per user per month (10-user minimum), with a 15-day free trial. See plans.