As deployments grow, the questions change. It’s no longer just “can we block this threat.” It becomes “who changed this policy and when,” “can our analysts see Zenarmor data in the tools they already use,” and “can we automate this instead of clicking through it.” Version 2.6 answers those questions directly, with a common thread of visibility and operational control.

What’s New

Organization Admin Governance and Audit Trail

Most relevant to: Mid-market IT/SecOps teams in regulated verticals, and MSPs/MSSPs running multi-admin operations.

As more administrators touch a platform, accountability gets harder, and in regulated environments like healthcare, financial services, and legal that gap becomes a compliance problem. Zenarmor 2.6 introduces a comprehensive audit trail in Zenconsole. Every action, including policy updates, configuration changes, and the addition or removal of instances, is now logged with a name and timestamp, turning “we think it was configured this way” into documented fact and shortening investigations when something goes wrong. For partners with multiple technicians touching client environments, it also answers the “who changed this on which tenant” question that gets harder as the book of business grows.

External SIEM and SOAR Support

Most relevant to: Mature mid-market SecOps teams and MSSPs with an established analytics stack.

Security data is only useful where analysts actually work. Many teams have already invested in their own SIEM or SOAR and want Zenarmor data flowing alongside everything else. Zenarmor 2.6 streams session details directly to Elasticsearch and OpenSearch while keeping built-in cloud reporting, so teams can build dashboards, run deeper analysis, trigger automated playbooks, and correlate Zenarmor activity with the rest of their telemetry, inside the stack they already trained on.

Organization-Based RESTful API

Most relevant to: MSPs, MSSPs, and ISPs provisioning at scale, plus infrastructure-as-code shops.

Manual configuration doesn’t scale. Zenarmor 2.6 introduces a RESTful API for Zenconsole, letting administrators create gateways and retrieve organization details programmatically, see full docs at Zenarmor API. Security can now be wired into infrastructure-as-code workflows and onboarding scripts, reducing manual effort and removing a class of configuration mistakes. For partners onboarding new clients and service providers standing up gateways across many sites, it means growing your footprint at the pace of the business rather than the pace of clicking.

Tag Support for Zenarmor Instances

Most relevant to: MSPs, MSSPs, and ISPs managing instances across many tenants and sites.

A handful of gateways is easy to manage by name; hundreds are not. Zenarmor 2.6 adds system-defined and custom tags on gateways and endpoints. Administrators can label instances by region, business unit, function, or environment, then use those tags to organize device groups and dynamically provision resources into Zero-Trust networks, so membership follows logical rules instead of manual assignments.

Backup and Restore for Internet Security Policies

Most relevant to: MSPs standardizing baselines across clients, lean mid-market teams without spare hands to rebuild config, and regulated organizations that need to evidence policy state.

Security policies are living configurations, and without a way to capture a known-good state, a misstep means rebuilding by hand. Zenarmor 2.6 lets administrators back up and restore internet security policies directly in Zenconsole. Export selected policies to a file or upload a saved configuration to apply multiple policies at once, making it easy to standardize across environments or roll back to a baseline. For compliance, a saved policy set is also a point-in-time record of how controls were configured, the kind of evidence auditors look for and the baseline you can prove you restored to after any change.

Onboarding Widget for New Users

Most relevant to: New mid-market admins and MSPs bringing on new clients.

A feature-rich platform can be hard for first-timers to navigate. Zenarmor 2.6 introduces an onboarding widget that offers guided direction through key tasks, from setting up Zero-Trust networks to configuring policies, so new users always know what to do next and reach value faster. For partners, a smoother first experience means quicker time to value and less support overhead with every new client.

Improvements Worth Noting

Zenarmor 2.6 also includes a set of improvements that sharpen visibility and smooth daily operations: faster central reporting on cloud-based BigQuery; SSO awareness without TLS inspection (no internal CA certificate required on client devices); QUIC connections reliably blocked with an ICMP unreachable response on UDP port 443; a mobile-friendly subscription and pricing page; destination IP included in Threat and Activity Alert emails; destination domains in alert CSV attachments rendered as unclickable links; a direct link from alerts to related Live Sessions; fewer false positives as dead sites move from Advanced Security to the Web category; and Zero-Trust network status shown per gateway on the Gateway Dashboard.

A bug fix also resolves an SSO session display issue where a roaming user could incorrectly appear offline when working from an office that enforced SSO authentication.

Closing Thoughts

Zenarmor 2.6 is a release for teams whose security operations are growing up. The audit trail answers who did what and when. SIEM and SOAR streaming puts Zenarmor data inside the tools analysts already use. The RESTful API automates what you used to do by hand. Tagging, policy backup and restore, and guided onboarding each remove friction from running security at scale. This is what the Plug.SASE.Everywhere approach looks like as it matures: not only security that deploys anywhere, but security you can see clearly, govern accountably, and operate efficiently at any size.

Get Started Today

Zenarmor 2.6 is available now. Existing customers can access these capabilities immediately through Zenconsole, and developers can start building against the new API at Zenarmor API. For the full release notes, visit Release Notes.

Details:

• Date and Time: Friday, May 22, 2026, from 05:00 am - 05:30 am GMT(Summer Time) (00:00 am - 00:30 am EDT, Thursday, May 21, 2026, 09:00 pm to 09:30 pm PDT).
• Duration: 30 min
• Affected Service: Zenconsole Cloud Management Portal
• Reason for Maintenance: Resource Upgrade for Zenconsole

We thank you for your understanding and patience during this maintenance window and apologize for any inconvenience it may have caused.

Zenarmor Team

Zenarmor 2.5 ships with four new capabilities, a meaningful set of platform improvements, and a handful of targeted bug fixes. Whether you are running a lean IT team at a mid-market company or managing a complex distributed environment across hundreds of sites and thousands of endpoints, this release has something that will make your day-to-day operations meaningfully better.

Let’s get into it.

What’s New in Zenarmor 2.5

CrowdStrike Integration for Zero Trust Network Access (ZTNA) Device Posture Check

The Challenge

For years, organizations’s VPN / ZTNA solutions and their endpoint detection and response (EDR) platform operated in separate silos. A device could be flagged as compromised or high-risk in CrowdStrike Falcon, yet that same device would continue to have full access to internal networks and applications because the two systems had no way to communicate with each other. Security teams were left manually correlating data across platforms, often after the fact, and policy enforcement lagged dangerously behind the actual risk posture of devices on the network.

This is not a theoretical problem. In environments where contractors, BYOD devices, and remote workers are the norm, the attack surface exponentially increases as the device count increases. A device that fails a posture check should lose access immediately, not at the next manual review cycle.

The Zenarmor Solution

Zenarmor 2.5 introduces CrowdStrike integration for ZTNA device posture checks. Zenarmor now synchronizes device Zero Trust Assessment (ZTA) scores directly from CrowdStrike Falcon continuously. Administrators can build Private Access Policies that use these synchronized ZTA scores as “a dynamic” enforcement criteria, meaning access to private network resources is granted or denied based on continuously updated device health data pulled straight from CrowdStrike.

If a device’s ZTA score falls below a defined threshold, access is automatically restricted without manual intervention. The policy enforces itself.

Why This Matters

True Zero Trust is not a static configuration; it is a continuous evaluation loop. By pulling real-time posture data from CrowdStrike Falcon, one of the most widely deployed EDR platforms in the enterprise, Zenarmor ensures that access decisions reflect the device’s actual security state at any given moment.

For organizations already running CrowdStrike as part of their security stack, this is a force multiplier. You are not adding a new tool or a new process. You are connecting two systems you already trust and letting them work together to automatically enforce the access policy. That is the kind of integration that reduces alert fatigue, closes enforcement gaps, and makes your existing security investments work harder.

Automated Provisioning of Gateways at Scale

The Challenge

Scaling security infrastructure across a distributed environment is one of the more demanding operational challenges IT and security teams face today. Whether an organization is expanding into new branch offices, standing up retail locations, extending to edge computing nodes, or securing cloud-hosted workloads, the pace of that growth demands tooling that can keep up. In environments where speed matters, a new branch office needs to be secured before it goes live, and a new cloud region needs to be protected before workloads are migrated to it. Security must adapt to the pace of the business, not lag behind.

As organizations grow their Zenarmor deployments to match that pace, the natural next step is to enable administrators to provision multiple gateways in a single, coordinated operation rather than sequentially, reducing the time between infrastructure expansion and full security coverage. That is exactly what this update delivers.

The Zenarmor Solution

Zenarmor 2.5 updates the one-liner installation script to support bulk gateway operations. Administrators can now install or add multiple gateways in a single operation, dramatically reducing the time and effort required to bring new infrastructure online. What previously required individual attention for each gateway can now be handled in one coordinated step.

Why This Matters

Organizations with large branch footprints or who are aggressively expanding their footprint can now attach Zenarmor protection with greater ease and consistency across every gateway in their environment. For MSSPs and partners managing multiple client environments, this is particularly impactful. Onboarding a new client or expanding an existing deployment now happens in a fraction of the time, with the confidence that every gateway is configured correctly from day one.

It also reinforces one of Zenarmor’s core architectural advantages over cloud-only SASE: the ability to instantly deploy security exactly where you need it, on your infrastructure, on your timeline, without waiting for a vendor to provision capacity in a cloud POP that may or may not be geographically optimal for your users.

Real-Time Threat Alert Notifications for SSE and Higher Subscriptions

The Challenge

Visibility without action is just noise. Security teams are already drowning in data, and the last thing anyone needs is another dashboard to check. The real problem is not a lack of information; it is a lack of timely, targeted, actionable signals. When something important happens on the network, whether it is a spike in blocked malware detections, a command-and-control callback attempt, or a policy violation pattern that suggests a compromised device, security teams need to know about it immediately, not when they happen to log in and run a report.

For distributed organizations where a single administrator might be responsible for monitoring dozens of gateways and hundreds of endpoints, the manual review model simply does not scale. Threats move faster than scheduled check-ins.

The Zenarmor Solution

Zenarmor 2.5 introduces automated email-based threat-alert notifications for SSE and SASE-tier subscriptions. Administrators can now define specific criteria, and patterns that matter to their environment, and Zenarmor will automatically send alerts when those conditions are met. This is not a generic notification system. It is a configurable alerting framework that lets administrators focus on the signals that are most relevant to their specific threat model and compliance requirements.

Alerts are designed to drive immediate action, giving administrators the context they need to investigate and respond quickly rather than hunting through logs after the fact.

Why This Matters

The gap between detection and response is where breaches happen. By pushing real-time alerts to administrators based on criteria they define, Zenarmor significantly narrows that gap. A security team that knows about a threat within minutes of detection is in a fundamentally different position than one that discovers it hours later during a routine review.

This capability also has real compliance implications. Many regulatory frameworks, including those governing financial services, healthcare, and critical infrastructure, require documented evidence of timely threat detection and response. Automated alerting with configurable thresholds provides both the operational capability and the audit trail to support those requirements.

For lean security teams managing complex environments, this is the difference between being reactive and being proactive. And in security, being proactive wins.

Zenarmor Endpoint Application on Docker Containers for ZTNA and SASE Subscriptions

The Challenge

Containerized environments present a unique security challenge. As organizations accelerate their adoption of Docker and Kubernetes for application workloads, the security tooling available for those environments has struggled to keep pace. Traditional endpoint agents are designed for operating systems, not containers. Cloud-only SASE solutions can protect traffic leaving the network, but they cannot provide inline security inspection and Zero Trust private access for workloads running inside containerized infrastructure without forcing all traffic out to a cloud POP and back, introducing latency and creating architectural complexity that undermines the efficiency gains containers are supposed to deliver.

For organizations running containerized workloads in on-premises data centers, edge locations, even ephemeral networks or private cloud environments, this creates a genuine blind spot. The workloads are there, the traffic is flowing, but the security coverage is either absent or dependent on a cloud detour that defeats the purpose.

The Zenarmor Solution

Zenarmor 2.5 extends the SASE application to Docker containers and is available to ZTNA and SASE subscribers. Organizations can now deploy Zenarmor SASE directly as an endpoint within containerized environments, bringing the full suite of Zenarmor’s security and private access capabilities to Docker workloads without requiring a separate physical or virtual appliance. This means containerized applications can participate in private secure networks, have their traffic inspected and controlled by policy, and be managed through the same Zenconsole interface as every other endpoint in the organization.

Why This Matters

This is a natural and important extension of Zenarmor’s Plug.SASE.Everywhere philosophy. Security should follow the workload, not the other way around. As more organizations shift critical workloads to containers, the ability to deploy Zenarmor natively in those environments ensures that security coverage keeps pace with evolving infrastructure.

It also highlights a fundamental limitation of cloud-only SASE architectures. A vendor whose security model depends on routing traffic through their cloud infrastructure cannot protect workloads that should never leave your environment in the first place. Zenarmor’s decentralized, deploy-anywhere model means that containerized workloads in a data center, a manufacturing-floor edge node, or a development cluster receive the same level of protection as a remote worker connecting from a hotel in another country.

Improvements Worth Noting

Beyond the headline features, Zenarmor 2.5 ships with several improvements that will make a real difference in day-to-day operations.

Improved Performance on Secure Private Networks. Latency between secure private network peers has been meaningfully reduced, resulting in faster and more reliable connections. For organizations relying on Zenarmor’s Zero Trust overlay networks for real-time collaboration, voice, or latency-sensitive applications, this is a direct quality-of-life improvement.

Bulk Gateway Updates Across the Organization. Administrators can now push updates to all gateways in their organization in a single operation. Combined with the bulk provisioning capability introduced in this release, this makes large-scale gateway fleet management significantly more efficient. Consistency across your gateway estate is no longer a manual effort.

Endpoint Application Update via CLI. For Linux environments and headless deployments, users can now update their endpoint applications directly from the command line with the --update-app helper command. This is a small but meaningful improvement for teams managing endpoints in server or containerized environments where a GUI is not available.

Subscription Expiration Visibility in the Subscriptions List. An info icon now appears next to subscriptions approaching expiration, giving administrators an at-a-glance warning before service interruption occurs. It is a simple addition, but the kind of operational detail that prevents avoidable disruptions.

Simplified macOS Uninstallation. Zenarmor endpoint applications on macOS can now be removed by dragging the app to the Trash, with the engine fully uninstalled in the process. Clean, simple, and consistent with how macOS users expect software removal to work.

Subscription-Aware Policy Configuration. The policy configuration page now displays only the features available under the user’s current subscription tier. This reduces confusion and streamlines the configuration experience, particularly for organizations managing multiple subscription types across their environment.

Bug Fixes

Zenarmor SASE 2.5 also resolves several issues that have been affecting specific environments and use cases:

• Multiple DNS records being generated in Microsoft Active Directory environments for Windows endpoints registered to Secure Private Networks have been resolved.
• Category and Signature labels in the blocked sessions details pane within Gateway Live Sessions and Centralized Live Sessions are now fully visible.
• Certain CASB applications that could not be blocked are now correctly enforced.
• HTML tags displaying incorrectly in warning messages on the OPNsense UI have been fixed.
• Applications incorrectly labeled as “Dynamic Classifier” during Live Sessions are now identified correctly.

Closing Thoughts

Zenarmor SASE 2.5 is a release that rewards organizations that are thinking seriously about how their security infrastructure needs to evolve. The CrowdStrike integration for device posture is a statement about where ZTNA is going: toward continuous, automated, data-driven enforcement that does not depend on manual oversight or static rules. The bulk provisioning and bulk update capabilities are a statement about how security operations need to scale: efficiently, consistently, and without creating a deployment tax that slows down the business. The Docker endpoint support is a statement about the future of the workload: wherever it runs, security follows.

If you are already a Zenarmor customer, updating to 2.5 is fast & straightforward. If you are evaluating Zenarmor for the first time, this release is a strong representation of what the Plug.SASE.Everywhere approach looks like this in practice: instant, simple, comprehensive, flexible, and built for how modern organizations actually operate.

For full release notes, visit zenarmor.com/docs/support/release-notes.

SD-WAN has become a core part of modern networking, enabling organizations to connect distributed users, sites, and applications with greater agility, visibility, and control.

Zenarmor delivers secure connectivity through a single-app, single-stack, single-pass architecture combining networking and security in one platform. This allows organizations and partners to build and operate high-performance, resilient networks without added infrastructure or operational overhead.

“This year’s winners are trailblazers redefining what’s possible in modern networking.”

— Rich Tehrani, CEO of TMC

We are proud to be recognized among them.

Thank you to our customers, partners, and team for making this possible.

Zenarmor, Inc., the company pioneering a distributed Single-App, Single-Stack, Single-Pass Secure Access Service Edge (SASE) architecture for modern networks, today announced significant new advancements to its platform that expand the Zenarmor SASE Anywhere Architecture™ to support mobile endpoints and containerized environments, while enabling sovereign deployments across partner-operated and customer-controlled infrastructure, including managed service providers, network operators, and enterprise environments. This architecture enables security enforcement to run directly within partner or customer infrastructure rather than relying on centralized cloud inspection points.

These advancements expand Zenarmor’s distributed enforcement model to support modern hybrid workforces and cloud-native infrastructure. Unlike traditional SASE architectures that depend on centralized cloud points of presence (PoPs), Zenarmor enables sovereign SASE deployments where security enforcement runs directly within partner or customer environments. This distributed enforcement model replaces centralized PoP inspection, eliminating traffic backhaul entirely, reducing latency, and preserving operational control over security infrastructure.

“Service providers need security platforms that integrate directly into their infrastructure without forcing architectural compromises,” said George Burne, Chief Technology Officer at WiLine Networks. “Zenarmor’s latest advancements to its distributed architecture allow us to embed security directly within our network stack, giving customers secure connectivity, full visibility, and operational control rather than relying on external cloud inspection points.”

As organizations adopt hybrid work models and increasingly distributed application environments, many find that cloud-only SASE architectures can still introduce performance tradeoffs, operational complexity, and reliance on vendor-controlled infrastructure.

The Zenarmor SASE Anywhere Architecture™, built on a Single-App, Single-Stack, Single-Pass design and forming the foundation of the company’s ONE.APP. SASE™ model addresses these challenges by placing security enforcement directly in the traffic path, allowing inspection to occur closer to users, applications, and workloads without relying on centralized cloud inspection points. Zenarmor’s latest platform advancements extend its distributed SASE architecture to mobile endpoints, enabling roaming users to receive the same inspection, policy enforcement, and threat protection regardless of where they connect.

“Many organizations struggle to introduce modern security capabilities without disrupting existing network deployments,” said Eelco Akker, ICT Consultant overseeing network and security infrastructure at De Hooge Waerder Accountants, a Netherlands-based accounting and advisory firm. “Zenarmor’s latest architecture advancements allow security to be inserted directly into the traffic path with minimal disruption, enabling organizations to strengthen their security posture while maintaining performance and operational continuity.”

Mobile Endpoint Security

Zenarmor gateways now function as both secure internet exit points and comprehensive inspection engines for roaming iOS and Android devices. Mobile users can securely connect to the nearest Zenarmor gateway, where traffic is inspected inline before reaching the internet or corporate resources. This allows organizations to apply the full suite of Zenarmor’s security capabilities to mobile users across any network, including:

• Application-aware security policies that follow users across networks
• Advanced threat protection including malware detection, phishing prevention, and command-and-control blocking
• Content filtering and web categorization to prevent access to risky or inappropriate sites
• Full visibility into application usage, bandwidth consumption, and security events
• Intelligent routing to the nearest Zenarmor gateway for optimal performance

Unlike cloud-only SASE providers that require traffic to traverse centralized vendor-operated inspection points, Zenarmor allows organizations to deploy security enforcement wherever it makes operational sense including in their own data centers, branch locations, cloud environments, or directly on user endpoints. Mobile users connect to their organization’s infrastructure, preserving both performance and operational control.

“SASE was originally envisioned as a way to bring networking and security closer to users and applications, but most implementations have reintroduced centralization through cloud inspection points,” said Murat Balaban, Founder and CEO of Zenarmor. “With Zenarmor, security enforcement runs directly where traffic flows – at the branch, in the cloud, on endpoints, or within partner infrastructure, giving organizations the performance, control, and deployment flexibility that modern distributed networks require.”

Containerized Gateway Deployment

Zenarmor’s latest advancements also introduce containerized gateway deployment, allowing Zenarmor gateways to run as Docker containers across cloud-native environments and edge infrastructure. This enables organizations and service providers to deploy inline security inspection directly within Kubernetes clusters, ephemeral networks, development platforms, and distributed edge locations without requiring dedicated appliances or centralized cloud inspection infrastructure.

Endpoint connectivity and policy enforcement are centrally managed through Zenconsole, allowing organizations to deploy and manage Zenarmor agents across distributed endpoints and gateways. The platform integrates with enterprise device management solutions such as Microsoft Intune and Jamf, enabling organizations to extend consistent Zero Trust policies across corporate laptops, mobile devices, and remote user environments.

“Traditional SASE architectures introduce integration challenges and operational blind spots due to their dependence on cloud-based PoPs,” said Shamus McGillicuddy, Vice President of Research at Enterprise Management Associates (EMA). “By eliminating PoPs and enabling direct, point-to-point secure connections with inline inspection, Zenarmor’s latest advancements reinforce a next-generation SASE architecture that reduces latency, accelerates deployment, and lowers operational complexity. This differentiated approach is why EMA recognized Zenarmor as a Vendor to Watch.”

Zenarmor is also developing an integration with the CrowdStrike Falcon® platform to incorporate device posture signals into policy decisions, further enhancing Zenarmor’s Zero Trust enforcement capabilities. This capability is planned for a forthcoming platform release.

By combining distributed enforcement with centralized management and reporting, Zenarmor enables organizations and partners to build scalable SASE deployments that maintain performance, operational flexibility, and data sovereignty.

“Perimeter-dependent security is an outdated assumption. Users are constantly moving between networks, and security must move with them,” said Mark Weinberger, Client Solutions Director, Spectrum Networks, a leading Australian ISP. “Zenarmor’s latest platform advancements enable us to move beyond gateway-only models to distributed enforcement with centralized visibility and control, a necessary evolution for modern SASE architectures built for today’s distributed workforce.”

For enterprises and service providers operating modern distributed networks, Zenarmor’s architecture provides a flexible approach that supports partner-operated infrastructure, sovereign security policies, and high-performance security enforcement without centralized traffic backhaul. Zenarmor continues to expand its distributed SASE platform to support enterprises, managed service providers, and network operators delivering modern security services across increasingly complex digital environments.

Availability

The latest advancements in Zenarmor SASE are available today. For technical details, visit Zenarmor 2.4 Release.

About Zenarmor

Zenarmor, Inc. delivers ONE.APP. SASE™, a Secure Access Service Edge (SASE) category built on a Single-App, Single-Stack, Single-Pass architecture. Unlike traditional cloud-centric SASE models, Zenarmor performs inline inspection and Zero Trust enforcement directly at the point of access, eliminating forced traffic backhaul, reducing latency, and simplifying security operations.

Built on the Zenarmor SASE Anywhere Architecture™, the platform enables security enforcement to run wherever users, devices, and workloads operate across branch, edge, endpoint, and cloud environments. This distributed approach allows organizations, MSPs, MSSPs, and ISPs to deploy high-performance security within their own infrastructure while preserving privacy, data sovereignty, and operational control. The company is venture backed and headquartered in Cupertino, Calif., with European headquarters in Germany supporting customers and partners globally. For more information, visit zenarmor.com.

_{^{Zenarmor is a registered trademark of Sunny Valley Cyber Security, Inc.}}

Zenarmor SASE Recognized for Its Single-App, Single-Stack, Single-Pass Architecture Delivering Real-World Zero Trust Enforcement Across Any Edge

Zenarmor, Inc., the company delivering the industry’s only single-app, single-stack, single-pass SASE architecture, today announced it has been named a finalist in the prestigious 2026 SC Awards program. Zenarmor SASE was recognized in the Best SASE Solution category, highlighting the company’s innovation and leadership in modern network security. The SC Awards, now in its 29th year, recognize the solutions, organizations, and individuals that demonstrate outstanding achievement in advancing the security of information systems.

SC Media describes the Best SASE Solution category as: “Efforts by businesses to implement a zero-trust model require effective management of network visibility of user activity and access. Solutions for this category contribute to that effort, offering secure access service edge (SASE) to combine wide area networking, or WAN, and network security services into a single cloud offering. They enable secure, policy-based access to the appropriate application or data regardless of user or device location.”

“The SC Awards celebrate excellence and innovation in cybersecurity, recognizing the people and technologies driving real progress. Being named a finalist is a mark of credibility and trust – a powerful validation from peers and experts who understand what it takes to deliver real-world security impact.”

— Kelley Damore, Chief Content Officer, CyberRisk Alliance

Zenarmor delivers omnipresent security that enforces policy consistently across on-premises, cloud, edge, and endpoint environments. Built on a single-app, single-stack, single-pass SASE architecture, Zenarmor runs natively wherever users and applications operate. The platform is centrally managed through Zenconsole™ and deployed on customer-owned or partner-operated infrastructure, preserving data privacy, sovereignty, and full operational control.

“The SC Awards program is the premier recognition in the cybersecurity industry, and we are honored to be named as a finalist and recognized among the industry’s best SASE solutions. Our architecture enforces security at the point of access while maintaining full visibility and centralized policy control. Because our entire SASE stack runs as a single application, customers can deploy in minutes and achieve consistent Zero Trust enforcement across any edge without redesigning their networks. By eliminating forced backhaul and centralized inspection hops, Zenarmor delivers dramatically lower latency up to 100×–1500× faster than traditional PoP-centric SASE models, effectively transforming every edge into a fully enforced SASE edge.”

— Murat Balaban, Founder and CEO of Zenarmor

The 2026 SC Awards entries were evaluated across 33 specialty categories by a distinguished panel of judges, comprised of cybersecurity professionals, industry leaders, and members of the CyberRisk Alliance CISO community, representing sectors such as healthcare, financial services, education, and technology. A complete list of 2026 SC Awards finalists is available on SC Media.

Zenarmor delivers a complete SASE stack including Zero Trust Network Access (ZTNA), Secure Internet Access (SSE), and inline traffic inspection without relying on centralized inspection infrastructure. Built on a single-app, single-stack, single-pass architecture, Zenarmor runs natively wherever users and applications operate, including gateways, endpoints, on-premises environments, cloud environments, and edge deployments. Because inspection and enforcement occur directly in the traffic path, organizations achieve consistent security enforcement with significantly lower latency and improved user experience. The platform deploys in minutes as a single application, eliminating the need for complex service chaining, multi-vendor orchestration, or forklift infrastructure upgrades. By enabling inspection within customer-owned or partner-operated infrastructure, Zenarmor allows organizations to meet strict privacy, data residency, and regulatory compliance requirements. Sensitive traffic never leaves the country, region, or customer-controlled environment for inspection. This architecture effectively transforms every edge into a fully enforced SASE edge.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through its trusted information brands, network of experts, and more than 250 annual events, CRA delivers actionable insights and serves as a powerful extension of cybersecurity marketing teams. Its brands include SC World, the Official Cybersecurity Summits, Identiverse, InfoSec World, CyberRisk Collaborative, Security Weekly, ChannelPro, ChannelE2E, MSSP Alert, ExecWeb, LaunchTech Communications, and CyberRisk TV. Learn more at www.cyberriskalliance.com.

About Zenarmor

Zenarmor, Inc. delivers ONE.APP. SASE™, a Secure Access Service Edge (SASE) category built on a Single-App, Single-Stack, Single-Pass architecture. Unlike traditional cloud-centric SASE models, Zenarmor performs inline inspection and Zero Trust enforcement directly at the point of access, eliminating forced traffic backhaul, reducing latency, and simplifying security operations.

Built on the Zenarmor SASE Anywhere Architecture™, the platform enables security enforcement to run wherever users, devices, and workloads operate across branch, edge, endpoint, and cloud environments. This distributed approach allows organizations, MSPs, MSSPs, and ISPs to deploy high-performance security within their own infrastructure while preserving privacy, data sovereignty, and operational control. The company is venture backed and headquartered in Cupertino, Calif., with European headquarters in Germany supporting customers and partners globally. For more information, visit zenarmor.com.

_{^{Zenarmor is a registered trademark of Sunny Valley Cyber Security, Inc.}}

This release represents a fundamental expansion of Zenarmor’s “Plug.SASE.Everywhere” philosophy, extending comprehensive internet security and Zero Trust Network Access (ZTNA) capabilities to iOS and Android devices while introducing Docker container deployment options that dramatically reduce time-to-security for organizations of all sizes.

Introduction: Securing the Truly Distributed Enterprise

The modern enterprise perimeter has dissolved. Your workforce operates from coffee shops, home offices, airports, and client sites, often switching between networks multiple times per day. Mobile devices have become the primary computing platform for many roles, yet they remain one of the most challenging endpoints to secure effectively.

Traditional cloud-only SASE solutions have attempted to address this challenge, but they often introduce latency, complexity, and dependency on vendor-controlled infrastructure that can create single points of failure.

Zenarmor 2.4 takes a fundamentally different approach, extending our hybrid architecture to mobile platforms while maintaining the performance, flexibility, and control that distinguish our ONE.APP. SASE.™ approach.

What’s New: Seven Game-Changing Capabilities

1. Comprehensive Internet Security for iOS and Android Devices While Roaming

The Challenge:

Mobile workers accessing corporate resources and internet applications from untrusted networks face a perfect storm of security risks: man-in-the-middle attacks, malicious Wi-Fi hotspots, shadow IT applications, and zero visibility for security teams.

Traditional VPNs provide tunnel security but lack application-layer inspection and control. Cloud-only SASE solutions force all traffic through distant cloud POPs, introducing latency that degrades user experience and productivity.

The Zenarmor Solution:

Zenarmor gateways now function as both internet exit gateways and comprehensive inspection points for roaming iOS and Android devices. This means your mobile workforce receives the full suite of Zenarmor’s security capabilities regardless of their location or network:

• Application-aware security policies that follow users across networks
• Advanced threat protection, including malware detection, phishing prevention, and command-and-control blocking
• Content filtering and web categorization to prevent access to risky or inappropriate sites
• Complete visibility into application usage, bandwidth consumption, and security events
• Intelligent routing to the nearest Zenarmor gateway for optimal performance

Why This Matters:

Unlike cloud-only SASE providers that lock you into their infrastructure, Zenarmor allows you to deploy gateways where they make sense for your business — whether that’s in your own data centers, at branch locations, or in cloud regions of your choosing. Your mobile users connect to your infrastructure, maintaining the performance and control advantages that define Zenarmor’s approach.

For a sales executive traveling internationally, this means consistent security policies and optimal performance — whether they’re in a hotel in Singapore or a conference center in Frankfurt — all without the “VPN tax” of routing traffic halfway around the world to a vendor’s cloud POP or central VPN concentrator.

2. Docker Container Deployment for Zenarmor Gateways

The Challenge:

Speed to security is critical. Organizations need to deploy protection quickly across diverse environments — development clusters, edge computing locations, temporary sites, and cloud-native infrastructures. Traditional appliance-based or VM-only deployment models create friction, requiring procurement cycles, hardware provisioning, or heavyweight virtualization infrastructure.

The Zenarmor Solution:

Zenarmor gateways can now be deployed as Docker containers, enabling instant security deployment in containerized environments. This capability provides:

• Rapid deployment measured in minutes rather than days or weeks
• Infrastructure flexibility to run Zenarmor wherever Docker is supported
• Resource efficiency with containerized workloads that consume only the necessary resources
• DevOps integration enabling security to be deployed through the same CI/CD pipelines as applications

Why This Matters:

This addresses a critical gap in traditional SASE offerings. Cloud-only solutions can’t provide security for on-premises containerized workloads without forcing traffic to exit your network and traverse the internet to their cloud infrastructure.

Zenarmor’s Docker deployment option lets you secure Kubernetes clusters, edge computing nodes, and development environments with the same comprehensive SASE capabilities you deploy elsewhere — while keeping sensitive traffic within your control.

Consider a retail organization with edge computing infrastructure at store locations running inventory management and point-of-sale systems in containers. Zenarmor can now provide comprehensive security and secure connectivity to corporate resources without requiring separate physical or virtual appliances at each location.

3. Pool Licensing for Partners

The Challenge:

Managed Security Service Providers (MSSPs), Value-Added Resellers (VARs), and system integrators need licensing flexibility to efficiently serve multiple clients with varying and changing needs. Traditional per-organization licensing creates administrative overhead and can leave partners with stranded capacity or force clients to over-purchase to accommodate growth.

The Zenarmor Solution:

Partners can now purchase Zenarmor licenses in pools, providing unprecedented flexibility to:

• Allocate licenses dynamically across multiple client organizations
• Right-size deployments without over-purchasing for individual clients
• Respond quickly to client growth by reallocating pool resources
• Optimize license utilization across their entire client base
• Simplify procurement with consolidated purchasing

Why This Matters:

This licensing model aligns with how modern MSSPs and service providers operate. Rather than managing dozens or hundreds of individual license purchases and renewals, partners can maintain a pool that serves their entire practice, allocating capacity where it’s needed most. This reduces administrative burden, improves cash flow management, and enables partners to be more competitive in their pricing and proposals.

4. Partner License Assignment to Clients

The Challenge:

Partners need to maintain clear boundaries between their management role and their clients’ operational independence. Clients want visibility into their subscriptions and the ability to manage their own environments within parameters set by their service provider.

The Zenarmor Solution:

Building on pool licensing, partners can now assign licenses directly to client organizations, enabling clients to:

• View their subscription details independently through their own Zenconsole access
• Manage their deployments within the scope of their assigned licenses
• Track usage and capacity for their organization
• Maintain clear separation between their environment and other clients

Why This Matters:

This creates a true multi-tenant architecture that respects both partner control and client autonomy. Partners maintain oversight and can reallocate licenses as needed, while clients gain transparency and self-service capabilities. This reduces support burden on partners and improves client satisfaction by providing direct visibility into the services they’re paying for.

5. Mandatory Organization-Wide Reauthentication

The Challenge:

Security posture degrades over time. Credentials may be compromised, employment status may change, access requirements may evolve, and compliance frameworks may increasingly require periodic verification of user identity. Yet forcing reauthentication can disrupt operations if not managed carefully.

The Zenarmor Solution:

Administrators can now initiate mandatory reauthentication across their entire organization periodically. This capability:

• Validates user identity at administrator-defined intervals
• Detects compromised credentials before they can be exploited
• Enforces policy updates by requiring users to reconnect under current policies
• Supports compliance requirements for periodic identity verification
• Provides audit trails of authentication events organization-wide

Why This Matters:

This addresses a critical gap in Zero Trust implementation. True Zero Trust requires continuous verification, not just authentication at initial connection. By enabling administrators to force periodic reauthentication, Zenarmor ensures that access is based on current identity verification rather than potentially stale sessions. This is particularly important for organizations in regulated industries or those handling sensitive data where compliance frameworks mandate periodic identity verification.

6. Multiple Domain Servers and Search Domains for Secure Private Networks

The Challenge:

Enterprise networks are complex. Organizations frequently operate multiple Active Directory domains, maintain separate DNS infrastructure for different business units or geographic regions, and need to support varied search domain configurations. Single-domain limitations force workarounds that compromise functionality or security.

The Zenarmor Solution:

Zenarmor now supports multiple domain server instances and search domains, enabling organizations to:

• Integrate with complex directory structures, including multiple AD forests and domains
• Support geographically distributed DNS infrastructure with region-specific domain servers
• Maintain separate domains for different business units while providing unified security
• Configure appropriate search domains for different user populations or network segments

Why This Matters:

This reflects the reality of enterprise IT environments — particularly for organizations that have grown through acquisition or operate across multiple regions. Rather than forcing organizations to flatten their directory structure or implement complex workarounds, Zenarmor adapts to existing infrastructure. This reduces deployment complexity and ensures that secure private network access works seamlessly with existing identity and DNS infrastructure.

7. Automatic Endpoint Agent Updates

The Challenge:

Endpoint agent management is a persistent challenge for IT and security teams. Manual update processes are time-consuming, error-prone, and often result in version sprawl across the organization. Outdated agents may lack critical security updates or compatibility with new features, creating security gaps and support burdens.

The Zenarmor Solution:

Administrators can now automatically update all Zenarmor endpoint agents through Zenconsole, ensuring:

• Consistent version deployment across all endpoints
• Automatic security updates without manual intervention
• Reduced IT burden by eliminating manual update processes
• Immediate feature availability as new capabilities are released
• Centralized control over update timing and deployment

Why This Matters:

This transforms endpoint management from a reactive, labor-intensive process to a proactive, automated function. Security teams can ensure that every endpoint runs the latest version with current threat definitions and security patches, eliminating the window of vulnerability that exists when updates are deployed manually. For distributed organizations with remote workers, this is particularly critical — IT teams no longer need to rely on users to update their agents or schedule maintenance windows to push updates.

Improvements Worth Noting

While the focus of this release is on new capabilities, several improvements enhance the overall Zenarmor experience:

• Punycode decoding in Reports and Live Sessions now properly displays internationalized domain names and email addresses, improving visibility for global organizations.
• Enhanced Global Deployment dashboard provides clearer status information for offline endpoints.
• Extended licensing options in the one-time installation script simplify gateway deployment when multiple license types are available.
• Enhanced sign-up security through mandatory OTP verification when linking SSO accounts.
• Improved scheduled reporting now supports sending reports to all users, not just administrators.

Conclusion: Security That Moves at the Speed of Business

Zenarmor 2.4 represents a significant leap forward in our mission to provide comprehensive, flexible, and high-performance security for distributed enterprises. By extending our SASE capabilities to mobile platforms, simplifying deployment through containerization, and enhancing partner and licensing flexibility, we’re addressing the real-world challenges that organizations face today.

The modern workforce is mobile, distributed, and increasingly reliant on cloud applications and SaaS platforms. Security solutions must adapt to this reality without introducing the latency, complexity, and vendor lock-in that characterize traditional cloud-only SASE approaches.

Zenarmor 2.4 delivers on this promise — providing enterprise-grade security that follows your users wherever they work, deploys wherever you need it, and scales according to your business requirements.

Get Started Today

Zenarmor 2.4 is now available to all users. Existing customers can access these new capabilities immediately through Zenconsole. For partners interested in pool licensing and client management capabilities, contact your Zenarmor representative to discuss how these new features can enhance your service delivery and grow your practice.

Full release note available at: Release Notes

Zenarmor, Inc., the company delivering the industry’s only single-app, single-stack, single-pass SASE architecture, today announced it has won the 2025 TMCnet Zero Trust Security Excellence Award from TMC, a global integrated media company, with winners announced Feb. 26, 2026. The award honors leaders and innovators delivering effective, forward-thinking Zero Trust security solutions. This recognition underscores the market shift toward distributed Zero Trust enforcement over centralized cloud inspection models.

“It gives me great pleasure to honor the recipients of the TMCnet Zero Trust Security Excellence Award,” said Rich Tehrani, CEO of TMC. “The award recognizes solutions providers championing the ‘Trust nothing, verify everything’ mantra of Zero Trust at a time when businesses face increasingly complex and frequent threats. The TMCnet team congratulates this year’s distinguished winners.”

Zenarmor delivers omnipresent security that enforces policy consistently across on-premises, cloud, edge, and endpoint environments. Built on a single-app, single-stack, single-pass SASE architecture, Zenarmor runs natively wherever users and applications operate. It is centrally managed through Zenconsole™ and deployed on customer-owned or partner-managed infrastructure, preserving data privacy, sovereignty, and operational control.

“We are honored to be recognized as one of the industry’s top Zero Trust solutions,” said Murat Balaban, Founder and CEO of Zenarmor. “Our architecture enforces security at the point of access while maintaining full visibility and centralized policy control. Because our entire SASE stack runs as a single application, customers deploy in minutes and achieve consistent Zero Trust enforcement across any edge without redesigning their network. By eliminating forced backhaul and centralized inspection hops, Zenarmor delivers dramatically lower latency up to 100× – 1500× improvement compared to traditional PoP-centric SASE models.”

Zenarmor delivers a complete SASE stack including Zero Trust network access (ZTNA), secure internet access (SSE), and inline inspection without routing traffic through vendor-controlled PoPs. This architecture reduces latency, improves user experience, and ensures consistent enforcement wherever users and applications operate.

Zenarmor deploys in minutes as a single application across gateways, endpoints, on-premises, cloud, and edge environments. Organizations avoid forklift upgrades, complex service chaining, and multi-vendor orchestration, significantly reducing operational overhead.

Because inspection and enforcement occur locally, customers and partners can meet strict privacy, data residency, and compliance requirements. Sensitive traffic never leaves the country, region, or customer-controlled environment for inspection. Zenarmor transforms every edge into a fully enforced SASE edge.

About TMC

For over 25 years, TMC has honored technology companies with awards in various categories. These awards are regarded as some of the most prestigious and respected awards in the communications and technology sector worldwide. Winners represent prominent players in the market who consistently demonstrate the advancement of technologies. Each recipient is a verifiable leader in the marketplace.

TMC also provides global buyers with valuable insights to make informed tech decisions through editorial platforms, live events, webinars, and online advertising. Leading vendors trust TMC, thought leadership, and our events for branding, thought leadership, and lead generation. Our live events, like the ITEXPO #TECHSUPERSHOW, deliver unmatched visibility, while custom lead generation programs and webinars ensure a steady flow of sales opportunities. Display ads on trusted sites generate millions of impressions, boosting brand reputations. TMC offers a complete 360-degree marketing solution, from event management to content creation, driving SEO, branding, and marketing success. Learn more at www.tmcnet.com; follow @tmcnet on Facebook, LinkedIn, and X.

About Zenarmor

Zenarmor delivers ONE.APP. SASE™, a next-generation Secure Access Service Edge (SASE) platform built on a Single-App, Single-Stack, Single-Pass architecture. Unlike traditional cloud-centric SASE models, Zenarmor performs inline inspection and Zero Trust enforcement directly at the point of access, eliminating forced backhaul, reducing latency, and simplifying security operations. Designed for distributed, real-world networks, Zenarmor enables organizations, MSPs, MSSPs, and ISPs to deploy high-performance security wherever users, devices, and workloads operate across branch, edge, endpoint, and cloud environments, while preserving privacy, data sovereignty, and operational control. Plug.SASE.Everywhere™. The company is venture backed and headquartered in Cupertino, Calif., with European headquarters in Germany supporting customers and partners globally. For more information, visit Zenarmor.

_{^{Zenarmor is a registered trademark of Zenarmor, Inc.}}

Cloud-Free SASE Delivers Performance

Founded in 2017, Cupertino-based cybersecurity provider Zenarmor offers a unique secure access service edge (SASE) solution that maximizes performance and flexibility through an efficient network architecture.

Most SASE vendors combine a software-defined WAN (SD-WAN) overlay with security services that are delivered via a global network of cloud-based points of presence (PoPs). Traditional SASE architecture requires the installation of gateway devices to establish an SD-WAN overlay, and all traffic must be backhauled from SD-WAN gateways to SASE PoPs for security inspection. This backhaul requirement adds latency to network connections, which can degrade network performance and user experience.

Zenarmor eliminates the need for SASE PoPs and SD-WAN gateways. Via Zenarmor’s central controller, Zenconsole, administrators can deploy lightweight agents on any client device, edge gateway, cloud VPC gateway, or ISP customer premises equipment. These agents have inspection engines designed to run as an application on any operating system, and they offer an equivalent of the traditional SASE security stack, including cloud application security broker, intrusion prevention, next-generation firewall, zero trust network access, and secure web gateway functionality.

Zenarmor’s agents ensure secure internet access without involvement of a SASE PoP. Furthermore, Zenarmor enables a mesh-based secure private access capability in which any two agents can establish an on-demand, point-to-point tunnel with inline traffic inspection. These tunnels allow endpoints to connect to any resources directly without backhaul through a PoP.

Zenarmor can run its agents on Linux, Windows, MacOS, and other operating systems, thus offering increased flexibility. For instance, customers can secure Internet of Things (IoT) devices either by installing Zenarmor agents directly on where they are supported, or by deploying a Zenarmor-enabled gateway onsite. If the agent is running on a resource-constrained device that limits its ability to conduct full local security inspection, administrators can configure that agent to forward traffic to a self-deployed SASE PoP in the customer’s nearest data center or cloud VPC.

EMA Perspective

Enterprise Management Associates (EMA) research consistently finds that enterprises struggle with SASE architecture. From an engineering perspective, they often grapple with complex integration of the SD-WAN component and the cloud native security capabilities of SASE (often referred to as security service edge or SSE). Zenarmor eliminates this integration complexity by consolidating connectivity and security into a single agent that can run anywhere.

Enterprises also struggle with the operational complexity that SASE PoPs introduce. Our research shows that these PoPs add latency that is difficulty to manage. They also introduce blind spots, because network observability solutions lose visibility into traffic after it exits a SASE PoP. By eliminating PoPs from SASE architecture, Zenarmor removes these operational challenges.

Zenarmor’s next-generation approach to SASE architecture will appeal to enterprises that are seeking architectural alternatives that remove complexity and reduce network latency. For that reason, EMA has named Zenarmor a Vendor to Watch.

Zenarmor, Inc., redefining secure access and network security with the industry’s only single-app, single-stack, single-pass architecture, today launched its global Zenarmor SASE Channel Partner Program.

This partner-first initiative is the industry’s first channel partner program designed to enable MSPs, MSSPs, ISPs, and security-focused partners to deliver, operate, and monetize SASE services without centralized cloud PoPs, service chaining, or architectural lock-in.

The new program formalizes Zenarmor’s distributed SASE go-to-market model and enables partners to deliver omnipresent security that follows users, applications, and data across on-prem, cloud, edge, and remote environments using a single-app, single-stack, single-pass SASE platform that runs natively wherever users and applications operate.

It is centrally managed across customers through Zenconsole, and partners deploy Zenarmor SASE on customer-owned or partner-managed infrastructure, preserving privacy, sovereignty, and control.

“Zenarmor gives us the ability to deliver SASE as a distributed service without sacrificing performance or control,” said Bugra Gumus, CEO, Silvercloud Security and Technology Solutions, an MSP in Los Angeles. “Eliminating forced backhaul and accelerating deployment has reshaped how we deliver differentiated managed security services to our customers. Because it can be deployed across a wide variety of operating systems, we can establish a seamless security chain that begins at the user’s device and extends all the way to the cloud server. This flexibility, combined with the ability to manage VPN access through granular policies, offers our customers immense ease of use. Ultimately, the agility of the installation process provides a significant time-saving advantage for both our team and the end-users we serve.”

This announcement represents a fundamental shift in how SASE is delivered through the channel. Most SASE partner programs are built around centralized cloud inspection, vendor-owned PoPs, proxy-based architectures, and service chaining across multiple security services.

Zenarmor’s channel program introduces a distributed, partner-operated SASE delivery model where security enforcement happens at or near the traffic source, partners retain operational control, and customers avoid unnecessary latency, privacy risks, and vendor dependency.

This is especially significant for distributed and hybrid workforces, latency-sensitive applications, regulated industries and regions with strict data residency requirements, and MSPs and MSSPs building differentiated managed security services.

“Service providers and channel partners often face significant integration and operational challenges when delivering traditional SASE solutions built on SD-WAN overlays and cloud-based PoPs,” said Shamus McGillicuddy, Vice President of Research at Enterprise Management Associates (EMA). “Zenarmor simplifies that model by consolidating connectivity and security into a single-application, distributed architecture that can run across endpoints, gateways, cloud environments, and ISP customer premises equipment, eliminating reliance on centralized PoPs. This approach offers partners greater flexibility, performance, and control in delivering SASE services, which is why EMA recognized Zenarmor as a Vendor to Watch.”

“At Spectrum, we are seeing that the biggest risk today is not inside a traditional perimeter, it is in how people work,” said Mark Weinberger, Client Solutions Director, Spectrum Networks, a leading Australian ISP. “Users are remote, mobile, and constantly moving between networks. The old gateway-only model no longer reflects reality. Zenarmor enables us to shift enforcement closer to the endpoint while maintaining full visibility and control, allowing us to offer modern Zero Trust security that fits today’s distributed environments.”

Zenarmor’s channel program enables partners to deliver full SASE functionality, including Zero Trust access, secure internet access, and inline inspection without routing traffic through centralized PoPs. This results in dramatically lower latency, improved user experience, and consistent security enforcement wherever users and applications operate.

Zenarmor SASE deploys in minutes as a single application across on-prem, cloud, and edge including network edges, gateways, and endpoint devices. Partners can onboard customers rapidly without forklift upgrades, complex service chaining, or multi-vendor orchestration, accelerating time-to-revenue and reducing operational overhead.

Because traffic inspection and policy enforcement occur locally, Zenarmor enables customers and partners to meet strict privacy, data residency, and compliance requirements. Sensitive traffic does not need to leave the country, region, or customer-controlled environment to be secured.

“For too long, SASE has been synonymous with centralized cloud inspection and vendor-controlled infrastructure,” said Murat Balaban, Founder and CEO of Zenarmor. “We built Zenarmor differently. Our architecture was designed from day one to enforce security wherever users and applications operate, without forcing traffic through external PoPs or service chains. This new channel program aligns our go-to-market with that architectural reality. It empowers partners to deliver the entire SASE stack as a distributed, high-performance service they control. Partners are no longer reselling someone else’s cloud, they are operating their own modern, omnipresent SASE infrastructure.”

Partners benefit from:

• The ability to deliver differentiated managed SASE services
• Full operational control over service delivery
• Faster onboarding and deployment cycles
• Predictable recurring revenue models
• Higher margins by avoiding PoP resale economics
• The ability to extend existing NGFW, networking, and security practices into SASE
• The ability for ISPs to turn existing customer-premises equipment into SASE-enabled infrastructure using Zenarmor’s OpenWRT-based deployment model
• Centralized, multi-tenant management through Zenconsole, streamlining deployment, monitoring, and policy enforcement for MSPs, MSSPs, and ISPs across customers from a single control plane

For ISPs, existing CPE can be transformed into SASE enforcement points using Zenarmor’s native support for open networking platforms such as OpenWRT, eliminating the need for hardware refresh or cloud-based service insertion.

With Zenarmor, partners help their clients realize:

• Significantly lower latency (100x to 1500x improvement in many real-world scenarios)
• Better performance for SaaS, cloud, and real-time applications
• Consistent Zero Trust enforcement regardless of user location
• Faster deployment without network redesign
• Reduced dependency on third-party cloud infrastructure
• Greater control over where data is inspected and stored
• Improved compliance with data sovereignty mandates
• Reduced exposure to cross-border data transfer risks
• Greater transparency and auditability

Plug.SASE.Everywhere™

Unlike traditional SASE solutions, Zenarmor does not require traffic to traverse vendor-controlled infrastructure, does not rely on proxy-based inspection, and does not split networking, security, and access across multiple services.

What Zenarmor offers partners is unique because its complete SASE solution runs as one application, not stitched services; its enforcement happens locally and contextually, not after redirection; and its architecture was designed for distributed enforcement from inception, not retrofitted from legacy VPN, firewall, or proxy platforms.

For more information on the Zenarmor SASE Channel Partner Program, or to become a registered partner, visit Zenarmor Partners.

The Zenarmor SASE Channel Partner Program is now open for global partner enrollment.

About Zenarmor

Zenarmor is the first vendor in the industry to deliver ONE.APP. SASE™, a next-generation Secure Access Service Edge platform built on its proprietary Zenarmor SASE Anywhere Architecture™, based on a Single-App, Single-Stack, Single-Pass architecture.

Unlike traditional SASE models that rely on centralized inspection or service chaining, Zenarmor enforces Zero Trust access and inline security directly at the point of access, eliminating unnecessary latency and architectural complexity.

Built for real-world distributed networks, Zenarmor enables organizations, MSPs, MSSPs, and ISPs to deploy high-performance SASE services wherever users, devices, and workloads operate, across branch, edge, endpoint, and cloud environments.

With centralized, multi-tenant management and flexible deployment across existing infrastructure, Zenarmor empowers partners to operate modern SASE services quickly, efficiently, and at global scale.

The company is venture backed and headquartered in Cupertino, Calif., with European headquarters in Germany supporting customers and partners globally. For more information, visit Zenarmor.

_{^{Zenarmor is a registered trademark of Zenarmor, Inc.}}

Security strategies often fail to recognize that this environment both expands the attack surface and breaks many of the assumptions that network security was built on. Because of this, insurance networks are under constant risk from ransomware, phishing campaigns, and data extraction software that knows exactly how to attack the weakest points of insurance networks.

Uncovering the Hidden Exposure Inside Modern Insurance Operations

Many insurers still rely on legacy access models such as VPNs and PoP-based SASE architectures. In theory, these approaches secure traffic by routing it through centralized cloud gateways. In practice, however, performance sensitivity, unstable mobile connections, and the growing volume of direct-to-SaaS traffic mean that not all activity consistently follows this path. As a result, some connections bypass centralized inspection altogether.

This creates security blind spots where controls are applied inconsistently or only after traffic has already moved beyond the point of enforcement. These gaps are not caused by misuse, but by architectural limitations that were not designed for today’s highly distributed, mobile insurance workflows. Unfortunately, these blind spots are frequently where modern insurance breaches begin.

Attackers no longer need to penetrate a traditional network perimeter. Instead, they exploit moments when access paths fall outside centralized control, or leverage phishing and credential-based attacks against claims processors, adjusters, or partners. From there, they move laterally across SaaS platforms and cloud applications that legacy, perimeter-centric security models were never designed to continuously protect.

In some SASE architectures, this challenge is further amplified. When all traffic must traverse a single inspection point, even minor latency or connectivity fluctuations can impact user experience. Over time, this creates pressure on the architecture itself, where performance and security are placed in tension rather than working together. Any period during which traffic operates outside consistent enforcement increases exposure and compounds risk.

This growing gap between where work happens and where security is enforced has become a significant concern for regulated industries with highly distributed workforces, including insurance. As operations continue to expand across homes, branch offices, disaster sites, and partner environments, maintaining continuous, always-on security has become not just a technical requirement, but a business imperative.

How Compliance Increases Risk

Most industries only face financial loss when a breach happens. But the insurance industry also faces regulatory consequences.

GLBA and state-level NAIC model laws require insurers and other financial institutions to protect customer data through controls, monitoring, and reporting. If data theft occurs, regulators will ask if the organization was enforcing protection everywhere.

Legacy security struggles here. Policies may only be enforced sporadically. Audit trails break down the moment traffic leaves the expected path. Logs are fragmented across numerous tools. For mid-market insurance IT teams, this creates a compounding operational and compliance burden that quickly becomes unmanageable. Most teams only have a handful of people running security, compliance, and operations. Providing detailed, defensible compliance evidence becomes an impossible task.

Why VPNs No Longer Hold Up

VPNs were not designed for today’s highly distributed, always-on insurance workflows. When a field adjuster connects from a disaster zone, traffic is routed through a centralized access path, which can introduce latency and create additional points of failure.

Users under time constraints may work around this by disconnecting, moving sensitive data through browsers and APIs that never pass through the encrypted tunnel, putting the information at risk.

As a result, security teams lose continuous visibility, consistent policy enforcement, and ongoing verification of user and device trust. VPNs authenticate users only at the moment of connection, not continuously throughout the session. This loss of continuous verification and inspection often occurs at exactly the moment when risk is highest. That is how phishing leads to ransomware. That is how a single stolen credential becomes a multi-million-dollar incident.

What a Modern Insurance Security Model Looks Like

To protect insurance organizations today, three things must be in place.

First, Zero Trust must be enforced at the point of access, not just the network perimeter. A claims system, underwriting portal, or network must only be reachable after the user, device, and policy all pass continuous verification, instead of simply where the user is located.

Second, threat inspection must happen at the source. Cybersecurity attacks must be stopped before they ever reach a cloud gateway or PoP.

Third, compliance controls must be uniform. Logging, access control, and data protection can’t depend on whether a user remembered to connect to a VPN.

Why Architecture Matters Now

Zenarmor approaches this problem differently. Instead of relying on PoPs and tunnels, we run a single-app, single-stack SASE engine directly on the endpoint, at the edge, or in the cloud. All inspection, Zero Trust enforcement, and threat prevention happens where the traffic originates.

For insurance teams, this is a game changer.

If a field adjuster clicks a phishing link, Zenarmor inspects and blocks that traffic on their device before it even gets to the internet.

When a broker accesses Guidewire or Salesforce, Zenarmor applies ZTNA policies at the point of connection, ensuring least-privilege access without forcing traffic through a distant gateway.

When auditors visit, Zenarmor’s unified stack has consistent logs and policy records across every user, device, and location that is easy to access and provide.

Why this Matters for Insurance

Insurance is under some of the most demanding forces in any industry. Agents, adjusters, and internal staff all need access to sensitive systems. Insurance must also enforce data protection, audit rules, and least-privilege access to comply with GLBA and NAIC rules.

Zenarmor’s endpoint-first SASE model aligns with how insurance actually works.

• Agents can securely access claims and underwriting apps without relying on VPNs.
• Adjusters can be granted time-limited access through ZTNA.
• Salesforce and Guidewire data is protected by integrated CASB and secure web controls.
• Customer information is protected by built-in DLP and continuous inspection.
• Remote teams and disaster-response teams stay protected without the need for additional hardware.

Zenarmor’s solution is delivered through one unified stack, deployed in minutes, and managed through a single console. Which is exactly what insurance IT teams need.

Where Insurance Goes Next

Ransomware and regulatory pressures are not going away. Remote work is here to stay. Cloud and SaaS adoption is accelerating.

Insurance organizations that rely on authenticate-once access models, rather than continuous verification, will find themselves unknowingly increasing their risks for data exposure.

Those that move to an always-on, Zero Trust model will be able to protect agents, data, and systems wherever work happens, without the need to trade robust security for performance.

That shift is more than just following technology trends, but ensuring survival and thriving in a world where one click can trigger a regulatory, financial, and reputational crisis.

Across the industry, there is growing consensus on one point: traditional security models are not sufficient for the AI era. AI traffic behaves differently. It is faster, API-driven, non-human, and deeply contextual. Security teams are struggling to understand where AI is running, how data moves between systems, and which identities, human or machine should be trusted.

This is why Zero Trust has re-emerged as a foundational principle. But as AI becomes more decentralized, not all Zero Trust architectures are created equal.

AI Is Decentralizing Security, Not Centralizing It

For years, enterprise security strategies assumed that traffic could be routed through centralized inspection points from cloud gateways, PoPs, or perimeter controls where policies could be applied. That model is increasingly misaligned with reality.

AI workloads are no longer confined to centralized cloud environments. They are being pushed:

• Closer to users
• Into branch locations
• Across private data centers
• Onto edge infrastructure
• Into hybrid and multi-cloud environments

As Zenarmor Founder and CEO Murat Balaban recently told CRN, in the context of analyzing AI vendor trends:

“As enterprises push compute, data and AI workloads closer to the edge, Zenarmor is investing in architectures that securely connect and protect these distributed environments. Enabling low-latency, secure connectivity and inspection across on-prem, cloud and edge infrastructure will be critical as AI workloads become more decentralized.”

— Murat Balaban, CRN CEO Outlook 2026

This shift has profound implications for Zero Trust.

Visibility Alone Is Not Zero Trust

Much of today’s AI security discussion focuses on visibility, discovering AI assets, mapping dependencies, and monitoring usage. While visibility is essential, it is not sufficient.

True Zero Trust requires more than knowing that AI traffic exists. It requires:

• Continuous verification
• Context-aware policy enforcement
• Least-privilege access decisions
• Immediate inspection and control

When enforcement depends on redirecting traffic to centralized inspection layers, organizations introduce latency, architectural complexity, and operational risk. In the AI era where performance, user experience, and real-time decisions matter, these tradeoffs become unacceptable.

Zero Trust cannot be an overlay. It must be embedded.

The Limits of Centralized Zero Trust Models

Centralized, PoP-based Zero Trust architectures were designed for a world where:

• Applications live in clouds
• Users connect from predictable locations
• Traffic patterns are human-driven and web-centric

AI breaks these assumptions.

AI traffic often:

• Originates inside private networks
• Flows laterally between services
• Uses non-standard protocols
• Involves machine-to-machine communication
• Requires sub-millisecond decisions

Routing this traffic through distant enforcement points increases latency, complicates troubleshooting, and creates new failure domains. More importantly, it delays enforcement, undermining the very principle of Zero Trust.

Zero Trust Must Execute Where Traffic Is Created

As AI decentralizes compute, Zero Trust enforcement must follow.

This is where architectural choices matter. Zero Trust enforcement must occur at the point where traffic is generated including branch, edge, device, and private environments, not after traffic is redirected elsewhere.

True Zero Trust for AI requires both context awareness and immediate enforcement in a single pass without introducing latency, routing changes, or architectural dependency.

Zenarmor approaches Zero Trust differently by delivering enforcement at the point where traffic is created, not after it is redirected. Through the Zenarmor SASE Anywhere Architecture™, Zero Trust controls operate consistently across:

• On-prem environments
• Branch locations
• Cloud workloads
• Edge infrastructure
• Remote users/devices

All inspection and policy enforcement occur in a single app, single stack, single pass, without dependency on centralized PoPs or traffic backhauling.

This approach enables:

• Sub-millisecond local inspection
• Consistent Zero Trust enforcement for AI and non-AI traffic
• Elimination of policy drift
• Lower operational complexity
• Faster adoption in brownfield environments

AI Security Must Work in the Real World

Most enterprises are not greenfield AI labs. They operate in complex, regulated, brownfield environments with:

• Existing networks
• Limited security teams
• Performance-sensitive applications
• Regulatory obligations

AI security that requires network redesign, traffic re-architecture, or additional layers of tooling creates friction and slows adoption.

Zero Trust for the AI era must adapt to existing environments, not demand that enterprises adapt to it.

This is especially critical as organizations balance innovation with compliance frameworks such as the NIST AI Risk Management Framework and the EU AI Act. Governance, reporting, and visibility matter but only when paired with enforcement that is immediate, local, and architecturally simple.

The Future of Zero Trust Is Decentralized

AI is forcing a rethinking of security fundamentals. The industry is moving away from perimeter-centric thinking and toward architectures that assume:

• Distributed compute
• Continuous verification
• Context-aware enforcement
• Performance without compromise

Zero Trust is no longer just about access, it is about execution.

As AI workloads continue to decentralize, security architectures must do the same. Those that rely on centralized inspection will struggle to keep pace. Those built to enforce Zero Trust everywhere traffic originates will be positioned to enable AI innovation without sacrificing security, performance, or control.

The AI era doesn’t need more layers. It needs better architecture.

We’ve updated our list of third-party service providers in accordance with our Privacy Policy and Data Processing Addendum (DPA).

What’s New?:

We’ve added G-core to support infrastructure and network services.

Key details:

• G-core is contractually bound to meet Zenarmor’s data protection and security requirements.
• This update does not change how your data is collected, processed or protected, and does not affect service availability or functionality.

You can view the updated list of third-party service providers here.

Contact us at privacy [at] zenarmor.com if you have any questions or concerns.

Most mid-market teams are small. Most of their security stacks are fragmented. And because of latency issues, some of their workers may not stay on secure VPN connections for the entire day. All of this has created a dangerous new reality: security is only as strong as your weakest link.

For mid-market companies, the old way no longer works.

What Mid-Market Teams Really Need

Mid-market teams don’t want bells and whistles when it comes to security; they want outcomes.

They want a VPN-free way to secure hybrid employees, a cloud-ready platform that does not slow anyone down, and protection that stays active no matter where or how work happens.

Most mid-market companies have multiple work locations, remote workers, and a mix of cloud and on-premise systems. Often, they have a small IT team, usually two to twenty-five people who have to manage IT and security for the entire company. Not only that, but they have to protect company data against ransomware, phishing attacks, compliance failures, and more.

Why VPNs Are No Longer the Answer

Not too long ago, VPNs helped users stay secure when they were outside of the office, which was usually an exception more than the norm. That world no longer exists.

Sales teams now work from home, developers access information from the cloud, and finance teams use SaaS applications. None of this behaves like traffic inside a closed network. VPNs create secure tunnels, but SASE models often force that traffic through centralized cloud gateways, which can hurt performance. When users face latency, they disconnect, and security immediately loses visibility.

When VPNs are turned off, all traditional security stacks are blind. Web traffic goes direct. SaaS sessions bypass inspections. Malicious links slip through into your network before any gateway can stop them.

PoP-based SASE models suffer from the same thing. They depend on traffic being routed to a specific point for inspection. This can lead to a slowdown, and users turning off protection. Every moment spent off-path becomes a possible exposure window.

Why Mid-Market Teams Feel Stuck

Large companies can usually absorb this complexity as they have dedicated SecOps teams, big budgets, and layered defenses.

But most mid-market teams don’t have these luxuries.

Mid-market IT and security teams are juggling multiple systems: VPNs, web gateways, CASB tools, and endpoint agents, none of which were made to work with each other. Each application has its own logs, policies, and potential blind spots. Each new user adds to this burden.

These teams are facing more security risks, more compliance pressure, and more customer expectations than ever before. They don’t need more tools, they need faster deployment, and security that works perfectly 100% of the time, even when people do not.

What Modern Security Looks Like

To adequately protect mid-market enterprises, security has to do one thing: move closer to the user and the data.

This means that access must be identity-driven. Users must only be given access to the apps and data that they are specifically authorized to use at that given time.

Data inspection must happen at the source and it must be continuous. Threats need to be blocked where they originate, not sent off to a distant tunnel or gateway, and trust cannot stop once a user is initially authenticated. It has to be re-evaluated as context, behavior, and risk change.

Finally, protection must be always on. Security cannot depend on a user’s whim to turn a VPN on or off, or on a PoP being reachable.

Security Depends on Architecture

Zenarmor believes something different: security should run where the traffic originates from, not where it is routed.

Instead of stitching together multiple security applications, Zenarmor has a single-app, single-stack architecture that runs directly on the endpoint, at the edge, or in the cloud. All Zero Trust enforcement, threat inspection, and policy controls happens inside one solution.

Inspection happens at the source, so there is no security gap. If a user clicks a phishing link, it is blocked before it leaves their device. When logging into a SaaS session, it is immediately governed by user identity and policy.

This solves the exposure holes that plague legacy security models. Users no longer have to choose between network speed and secure protection.

A Game-Changer for Mid-Market Teams

For mid-market teams, a security solution that combines Zero Trust enforcement, threat inspection, and policy controls changes everything.

Remote employees can work from anywhere, and are fully protected at all times. SaaS platforms like Salesforce, Jira, and Microsoft 365 have seamless access and data protection rules.

Developers and contractors get access to only what they need, when they need it, without needing to access the internal network.

Branch offices are now fully secure, without the need for expensive hardware. New team members can be onboarded effortlessly, without needing to rebuild or revamp the network.

And all of this from one lightweight platform that can be deployed in minutes, not months.

Making Zero Trust Practical

Zero Trust is the new reality. Most organizations now recognize that it is a critical piece of their security strategy.

But Zero Trust must be enforced everywhere continuously. If it depends on users exhibiting perfect behavior, it will not live up to its promise.

Zenarmor enforces Zero Trust at the endpoint and point of access. Our security checks identity, device, and policy every time, regardless of where the user is or how they are connecting.

The result? Completely secure hybrid work, without any slowdowns.

Why Traditional SASE Security No Longer Cuts It

SASE was originally created to bring network security to cloud-first, distributed organizations. The idea was right, but the implementation was based on an outdated model.

PoP-heavy network architectures introduce latency, rising costs, and new security risks. Multi-vendor stacks add complexity.

A single-stack, built for distributed architecture like Zenarmor brings SASE back to its original promise of secure access everywhere work actually happens, with consistent policy enforcement and real-time protection.

Questions to Ask Vendors

Mid-market enterprises have unique issues that demand unique answers from network security vendors.

How are your networks protected if users turn off their VPNs? What happens when a user clicks a malicious link? How do you ensure compliance while reducing the need to manage multiple tracking tools? How quickly can your users get access to applications they need to do their jobs?

These questions will allow you to see whether a security platform was designed for how work actually happens, or for a diagram.

The Future of Mid-Market Security

Hybrid work, cloud adoption, and distributed workforces are not going away. And attackers are not going away either.

Mid-market companies need network security that aligns with how work actually happens now. This means always-on protection, identity-driven access, and inspection where the data actually lives.

Zenarmor’s single-app, single-stack solution was built for this moment. It removes any VPN gaps, eliminates PoP dependency, and gives small IT teams a robust way to protect their company while reducing the workload.

Zenarmor allows mid-market companies to secure remote work, cloud apps, and their growing workforce without slowing them down or forcing them to become security experts.

The companies that do network security right will be safer, faster, more resilient, and better positioned for whatever the future brings.

Remote employees face the same architectural challenges that branch offices once did. They connect from open networks, access multiple cloud and SaaS platforms, and pull critical resources from many places. Each endpoint they access has its own traffic patterns, trust decisions, and risk profile.

The new distributed reality has turned every endpoint into its own network, and security models designed for centralized control can fracture, revealing gaps that attackers can exploit.

The Myth of the Centralized Network

Traditionally, network security was built around the concept of control through concentration. Users, applications, and data could be put in a small number of trusted locations, and IT and security teams could inspect traffic and enforce policies from the perimeter. Firewalls, VPNs, and other security software all emerged from this concept.

In this world, a network had an inside and an outside. Users worked from inside offices. Applications lived inside data centers. Security tools protected data from attackers on the outside.

But as cloud services, SaaS platforms, and remote work have become a necessary part of our distributed world, traffic no longer flows through a single chokepoint. Applications moved to the outside of this perimeter, and “inside” lost all meaning.

Many security solutions still cling to this idea of a single chokepoint, forcing distributed activity through a central control that can’t adequately handle a network that no longer has a center.

From Branch Offices to Infinite Edges

In our new distributed reality, applications no longer reside in data centers. SaaS platforms are now the default way for collaboration, finance, and operations. Business infrastructure now resides on the cloud. Users, contractors, and third parties access critical systems without ever setting foot inside an office.

What has replaced the traditional branch office is infinite edges, when networks stop having a fixed boundary. Every user, device, and workload is now its own access point, generating traffic that moves in multifaceted, unpredictable paths to the internet, cloud services, and APIs.

Traditional network boundaries have simply dissolved.

Traditional SASE Was Designed for a Different World

Secure Access Service Edge (SASE) was developed to modernize security for distributed networks. Instead of scattered endpoints, it promised a unified, cloud-delivered security model. But many assumptions from early SASE architectures came from old, outdated models they were meant to replace.

These models depend on redirected traffic to a centralized, limited number of cloud inspection points, sometimes very far from where these connections originate. Similar to the old hub-and-spoke model, this has simply moved the data center to the cloud.

This made sense when remote access was the exception and traffic volume was predictable. But today’s distributed-first environments are anything but predictable. With an outdated SASE model, traffic is forced onto indirect paths, where latency and performance issues become a problem.

The other assumption with traditional SASE is that security improved with everything funneled through one location. In distributed networks, this assumption is no longer valid.

Understanding Latency as a Security Risk

It is easy to see latency as strictly a performance issue, something separate from security. But in distributed environments, the line separating the two has blurred. If security controls cause traffic to slow down, that changes how users behave.

Users see friction as a problem, and inevitably seek workarounds. When deadlines loom, they may bypass security tools and move files through unsanctioned tools, or disable protection when possible. What began as a performance issue turns into a policy failure.

Forcing traffic through a centralized inspection point amplifies this risk. This can add delay, especially for SaaS applications and real-time services that demand low-latency connections.

In the new distributed model, security that slows down work gets avoided.

The Hidden Cost of Forcing All Traffic Through the Cloud

Routing all traffic through a single centralized cloud inspection point for simplification purposes may indirectly introduce complexity, albeit one that is harder to see until performance and reliability begin to suffer.

Backhauling traffic through a distant inspection point can result in data traveling through indirect paths to reach its destination. Inspection points can turn into bottlenecks, especially during peak usage times, and can cause inconsistent performance for users and applications.

Instead of following the most direct path to a SaaS service or cloud workload, data is forced through one hub that can fail or slow down.

What might appear as centralized and clean on paper often turns into a network quagmire that undermines both performance and security resilience.

Highly Distributed Environments Change the Threat Model

When networks were static and centralized, location was used to verify trust. Users inside the office or behind the firewall were inherently trusted. But in distributed environments, location has no meaning. Users connect from anywhere, applications are accessed from the cloud, and traffic is routed through many different locations.

This has scrambled the threat model. Instead of relying on where a connection comes from, security models now must look at who is making it, under what conditions, and for what purpose.

The distributed model means continuous verification must be enforced. Trust is not established just once; connections must be evaluated dynamically as conditions change and new resources are accessed.

Why One Remote User is a Network

Remote access used to be seen as a temporary tunnel to a corporate network. A user logged in, accessed what they needed, and then returned to the in-office topology.

In today’s world where work is distributed, this no longer holds. Modern architectures understand that networks are no longer fixed locations, but wherever users, devices, and workloads operate from.

Every user engages with multiple devices, multiple apps, cloud services, identity providers, and resources remotely over the internet. Each interaction generates an independent connection point with trust decisions and contextual signals that must be evaluated continuously.

Security That Assumes Distribution from the Start

Modern network security understands that work, data, and users are dispersed across multiple regions instead of concentrated behind a single perimeter. Inspection of traffic and policy enforcement must happen where traffic actually flows, at the edge, in the cloud, or right at the endpoint, rather than funneled through a single centralized point.

Locating security controls closer to users and workloads reduces latency and eliminates inefficiencies. This approach makes it easier for security teams to enforce consistent policies without sacrificing performance.

Adopting a distributed-first mindset paired with identity-centric security means that access decisions are based on who or what is connected, not where they are located.

The Mid-Market Reality: Small Teams and Limited Budgets

Most mid-market organizations do not have large, dedicated security teams or unlimited budgets. Network and security issues usually reside with a small group of generalists who already manage many other things for day-to-day operations. Complexity in such an environment is unsustainable.

Network architecture that needs constant tuning and specialized expertise only adds to risk. When tools are hard to deploy and operate, this can lead to partial implementation and enforcement inconsistency.

Security must align with the available resources necessary to run it.

What to Look For When Evaluating Distributed Security Models

When evaluating distributed security models, be sure to consider architectural assumptions more than features. Always ask where enforcement actually happens. Models that rely on centralized choke points often cause the same problems they claim to fix.

Find out how identity and context are treated. More effective distributed models evaluate identity and context continuously, rather than relying on network location.

Be sure to consider performance as well. If the architecture introduces latency, it will encourage workarounds that undermines security policy.

Designing Security for the Network You Actually Have

You can design security for a centralized network but that doesn’t make your network centralized. Users, applications, and data are already distributed, and architectures that ignore this reality don’t fail loudly. They fail quietly, through latency, blind spots, and inconsistent enforcement.

This is where traditional SASE starts to break down. When security is built around assumptions instead of reality, complexity increases and protection weakens.

When network architecture aligns with how work actually happens, security becomes simpler to use, more consistent to enforce, and stronger where it matters most.

The Hidden Cost of Complexity

As environments expand, maintaining a clear picture of who is accessing what, from where, and under which conditions becomes increasingly difficult. Complexity increases risk, and layers of network tools create blind spots and inconsistent policy enforcement across environments. IT spends too much time fine tuning rules and troubleshooting access instead of responding to real threats.

This complexity overwhelms lean IT and security teams, slowing response times and increasing the likelihood of human error. Many moving parts inevitably lead to problems falling through the cracks, increasing exposure and reducing resilience. Over time, even well-designed controls lose effectiveness as they become harder to operate and validate.

From Centralized Perimeters to Distributed Reality

For many years, network security followed simple principles: users worked inside a closed network, applications lived in centralized data centers, and data flowed in predictable paths. Security controls were placed on the edges and enforced uniformly, making both monitoring and enforcement relatively straightforward.

That model no longer exists. Networks are now distributed, allowing users to work from home, branch offices, and mobile locations. Applications are accessed from cloud providers and SaaS platforms. Data often flows directly between users and services without touching a corporate network.

This shift fundamentally changes how trust, access, and inspection must work. Many security architectures still assume a central choke point. They backhaul traffic to data centers, force data through a small number of gateways, or apply controls designed for outdated work environments.

As a result, security models struggle to adapt. Architecture lags behind reality, complexity increases, and risks spread unnoticed until something fails or an incident exposes the gap.

More Tools Mean More Risk

Many organizations respond to rising threats by adding more tools. Each challenge, whether remote access, SaaS usage, or cloud adoption, introduces another platform to manage. While this may appear to strengthen protection, it often creates tool sprawl.

Firewalls, secure web gateways, and cloud security platforms enforce different policies using different assumptions. Traffic may be inspected multiple times in some paths and not at all in others. Visibility becomes fragmented, making it difficult to know what should be allowed or blocked at any given point.

Policy fragmentation increases as configurations change across tools. Small adjustments can lead to drift that no one fully understands. Over time, teams lose confidence in how policies interact, and security decisions become reactive rather than deliberate.

Every tool adds operational load: more consoles, more alerts, and more integrations to troubleshoot. For mid-market teams with limited staff, this creates dependence on individual knowledge and manual workarounds. Attackers exploit the gaps between tools, not the tools themselves.

The Human Impact of Overengineered Security

Overly complex environments place a heavy burden on IT and security teams. Complex systems require constant attention, deep institutional knowledge, and manual workarounds just to function as intended.

This leads to fatigue, inefficient workflows, and a reactive posture. Teams manage alerts from multiple tools, each with its own priorities and blind spots. Important warnings can be lost among low-value alerts. Response slows as IT determines where issues originated and which control applies.

In fast-moving environments, delays and confusion increase the likelihood of mistakes. Over time, this strain becomes cumulative. Documentation falls out of date. Individuals with deep system knowledge leave, creating internal points of failure that are difficult to replace.

When security is dominated by complexity, teams manage systems instead of risk. Burnout increases, turnover rises, and organizational resilience erodes gradually rather than through a single visible failure.

Performance vs Security: A False Trade-Off

Performance and security are often framed as opposing forces. Stronger security is assumed to slow traffic by adding inspection points and forcing centralized routing. In distributed environments, this introduces latency, sluggish applications, and inefficient network paths.

These performance impacts affect security outcomes. When controls introduce friction, teams look for workarounds. Inspection may be disabled, and exceptions granted to meet deadlines or preserve user experience. Over time, security weakens to keep operations moving.

Backhauling traffic creates single points of failure and overload targets. Performance degrades during peak usage, forcing teams to choose between availability and protection. These trade-offs are not sustainable at scale.

Security that degrades performance is difficult to maintain. Users lose trust, administrators loosen controls, and risk increases incrementally. Effective security protects traffic without forcing it through distant or fragile inspection points.

The Mid-Market Reality Few Design For

Much of today’s security architecture is designed for large enterprises. It assumes dedicated teams and budgets that can absorb complexity and long deployment cycles. Mid-market organizations operate differently. Lean teams and overlapping responsibilities leave little time for constant oversight.

Staffing limits how many tools can realistically be managed. Budget pressure means security must work within existing networks, yet many solutions assume extensive redesigns, prolonged migrations, or specialized expertise.

When models do not fit operational reality, teams disable features, delay upgrades, or rely on manual workarounds. Over time, this creates fragile and inconsistent environments that are difficult to secure or scale.

Mid-market organizations need enterprise-grade protection delivered in forms that respect limited staff, distributed users, and the need to keep systems running without disruption.

Deployment Without Disruption

Deployment introduces risk. Large migrations and architecture overhauls reduce visibility while controls are in flux. During transitions, operational strain degrades security even when intentions are sound.

IT teams must support old and new systems in parallel while maintaining uptime. The longer transitions last, the more likely gaps become normalized and overlooked.

Incremental changes without forced redesigns or downtime are easier to manage and validate. They maintain consistent enforcement while adapting to new requirements and reduce exposure during transition periods.

Deployment is part of the security model. Approaches that minimize disruption reduce risk during one of the most vulnerable phases of any environment.

Rethinking Unified Security

“Unified security” often means buying more solutions from fewer vendors. Consolidation alone does not create coherence. Packaging tools together does not ensure consistent enforcement or operational clarity.

Real unification is architectural. Policies are defined once and enforced consistently across environments. Systems behave predictably, allowing teams to understand impact, validate outcomes, and trust decisions.

Vendor consolidation can hide complexity beneath a single interface. Different enforcement points may still operate independently, creating gaps beneath the surface.

Without architectural alignment, unification becomes a marketing label rather than a meaningful improvement.

Making Simplicity a Security Principle

Simplicity is a security principle. Systems that are easier to monitor and defend allow teams to act quickly and confidently.

Uniform policies reduce ambiguity. Centralized visibility replaces scattered dashboards. When incidents occur, teams focus on response instead of investigation and correlation.

Fewer moving parts increase resilience. Changes are easier to test, and knowledge is shared across teams instead of concentrated in specialists.

Simplicity does not reduce protection. It produces architectures that remain enforceable and reliable as networks evolve.

Complexity Is the Real Attack Surface

Modern attacks succeed because complexity creates gaps, delays, and uncertainty. As networks distribute, the real attack surface becomes architectural complexity itself.

Tool sprawl, fragmented enforcement, and operational strain all stem from excessive complexity. Over time, visibility erodes, response slows, and risk increases unnoticed.

For security leaders, the answer is not more controls, but ensuring existing ones work coherently. Reducing complexity means building systems teams can understand, operate, and defend effectively.

With the Zenarmor 2.2 release, we’re taking this one step further.

Administrators can now add their own DNS servers and search domains, in addition to using Zenarmor’s built-in DNS services. This new flexibility gives organizations greater control, enhances integration with existing network topologies, and supports advanced use cases, such as hybrid cloud and multi-domain environments.

Background: DNS Integration for Secure Network Visibility

Every peer in a Zenarmor secure network is automatically registered with our public DNS service using a standardized record format:

${PEER_SLUG}-${NETWORK_SLUG}.{ORG_NAME}.zpeer.net

This automatic DNS registration is what makes Zenarmor’s secure private networks so powerful. It provides:

• Instant peer identification – every endpoint and gateway can be uniquely identified within the organization.
• Seamless visibility – real-time DNS-based visibility across distributed and remote networks.
• Zero-touch configuration – automatic DNS registration and resolution without manual setup.

What’s New in Zenarmor 2.2

As of version 2.2, administrators can now define custom DNS servers and search domains for their secure networks. This new capability complements the built-in Zenarmor DNS service, allowing greater flexibility and control.

Key enhancements include:

• Custom DNS Servers: Integrate with internal DNS resolvers or Active Directory-integrated namespaces for seamless name resolution between Zenarmor networks and existing infrastructure.
• Custom Search Domains: Add your own search domains alongside Zenarmor’s default *.zpeer.net, enabling consistent naming conventions across your enterprise.
• Hybrid Environment Support: Perfect for organizations running split environments (e.g., part on-premises, part cloud) that need consistent DNS behavior across both.

Benefits of Custom DNS Support

This enhancement delivers a range of operational and security benefits:

1. Improved Interoperability

Integrate Zenarmor’s private overlay networks with existing enterprise DNS systems, Active Directory, or multi-cloud environments. This ensures seamless communication between Zenarmor-managed peers and legacy systems.

2. Greater Administrative Control

Organizations can now enforce custom DNS routing policies, align with internal naming conventions, and control where DNS queries are resolved, supporting privacy, compliance, and operational efficiency.

3. Reduced Operational Overhead

By allowing administrators to set DNS preferences once within Zenconsole, configurations are automatically propagated across all peers in the secure network, reducing manual configuration effort and preventing misalignment.

4. Enhanced Security and Privacy

Custom DNS settings can ensure that sensitive internal queries are resolved only within trusted internal DNS resolvers, preventing potential data leakage through external DNS lookups.

How It Fits into our mission to deliver ONE.APP.SASE

Zenarmor continues to redefine how enterprises approach network visibility, control, and zero-trust connectivity. By integrating DNS visibility into every peer and enabling administrators to merge it with existing DNS infrastructure, Zenarmor bridges the gap between network-level awareness and zero-trust simplicity.

This capability reinforces Zenarmor’s commitment to giving enterprises control without compromise, secure, private, and visible networking that can adapt to any environment, whether at the endpoint, edge, or cloud.

With the new DNS customization capability in Zenarmor 2.2, administrators gain the best of both worlds: Zenarmor’s built-in, zero-touch DNS visibility, combined with the flexibility to integrate with internal or hybrid DNS infrastructures.

It’s another step in Zenarmor’s mission to make secure, private networking simple, flexible, and fully visible, anywhere.

DNS Support for Private Networks

For full details on custom DNS servers and search domains, along with all other enhancements in this release, see the Zenarmor 2.2 Release Notes.

Zenconsole became the central place where teams monitored security, policies, and insights. In parallel, account and subscription tools lived in a separate interface built on the same backend platform.

As we listened to customers, one theme became clear: People loved the power of Zenconsole and wanted everything in one seamless flow.

This is the story of why we redesigned Zenconsole to bring everything together in one place, creating a unified experience that feels simpler, faster, and more connected.

Why We Unified the Experience

Rather than juggling separate views for operational tasks and account settings, users asked for a single, cohesive home where everything related to their Zenarmor experience lived together.

Our goals became clear:

• Bring all essential settings directly into Zenconsole
• Ensure visual and functional consistency across every interaction
• Create a smoother sense of continuity for daily workflows

This wasn’t about correcting a flaw, it was about elevating convenience and strengthening the single-dashboard philosophy Zenconsole is known for.

Our Approach

We started by mapping the existing user flow for both environments. This helped us visualize the effort required for users to perform simple actions, such as updating their email or checking their subscription.

Once we had this baseline, we designed a new integrated “Profile & Subscription” section inside Zenconsole. Our main design principles were:

• Consistency: Reuse Zenconsole’s design system components.
• Clarity: Group profile, security, and subscription details logically.
• Continuity: Keep users in the same visual and functional environment.

We also collaborated closely with the product and engineering teams to ensure that the new integration didn’t disrupt existing functionality.

The Design Outcome

The result is a unified and more intuitive experience. Now, users can:

• Update their profile, credentials, and contact information directly inside Zenconsole.
• Manage their subscription plans directly within the same environment.
• Use the consistent UI patterns, typography, and colors across all touchpoints.

What previously operated as two separate windows into the same platform now feels like one seamless, cohesive experience.

Reflections from the Design Process

This project created a high-impact improvement that simplifies the daily experience. By bringing these settings into Zenconsole, we reduced friction, improved clarity, and strengthened the overall usability of the product.

Closing

We continuously improve Zenconsole based on user feedback and our mission to deliver a smooth, secure, and consistent experience. This is part of our ongoing commitment to making Zenarmor the simplest, most cohesive SASE experience for our users.

Why Network Resilience is Essential in the Distributed Workplace

In distributed and hybrid environments, continuous access to private resources is essential. Whether traffic moves between branch offices, cloud workloads, or remote users, a single point of failure can stop productivity, often caused by PoP outages or VPN concentrator problems in traditional cloud-only SASE and VPN solutions, respectively.

Furthermore, without automated redundancy, you rely on manual reconfiguration or failover scripts when a gateway becomes unavailable, adding complexity and delay when uptime matters most.

Zenarmor SASE Anywhere Architecture™ already removes dependency on centralized cloud points of presence or traditional VPN concentrators, allowing direct P2P connectivity amongst peers. The new automatic failover priority feature builds upon this advantage, introducing intelligent route prioritization and dynamic resiliency across your secure private network.

How It Works

Within the Secure Networks UI, administrators can now:

• Advertise networks behind each peer gateway.
• Assign failover priorities to those gateways.
• Automatically reroute traffic if a higher-priority peer becomes unreachable.

If one peer gateway experiences an outage or network disruption, Zenarmor automatically detects the outage and reroutes traffic to the next available peer, without user intervention.

This is achieved through Zenarmor’s lightweight Single-App, Single-Pass SASE engine, which continuously monitors peer health and dynamically adjusts routing paths in real time.

Benefits of Automatic Failover

1. Enhanced Reliability

Your secure overlay networks now remain resilient against outages. Connections stay alive, ensuring business continuity and a consistent user experience.

2. Zero Manual Intervention

Administrators no longer need to modify configurations or execute scripts to restore traffic flow. Zenarmor’s engine handles the transition automatically.

3. Optimized Performance

Traffic always follows the most reliable route available, minimizing latency and downtime.

4. Seamless Multi-Cloud and Hybrid Support

Whether your gateways reside on-premises, in private clouds, or across multiple providers, Zenarmor maintains a unified routing experience ideal for distributed and multi-cloud enterprises.

5. Simplified Management

From within Zenconsole’s single pane of glass, you can visualize peer status, failover order, and real-time network activity, all in one place.

Automatic failover priority in Zenarmor delivers smarter, self-healing connectivity for your secure private networks. It extends the Zenarmor vision of giving organizations complete control and visibility, without reliance on cloud backhauling or complex configurations.

Your secure private network just got more resilient, adaptive, and autonomous, because protection and connectivity shouldn’t stop when a gateway does.

For details of the release please check the documentation: Zenarmor SASE 2.2 Release

This enhancement delivers greater flexibility and precision in securing encrypted traffic while maintaining optimal performance and privacy compliance.

Background: The Growing Importance of TLS Inspection

Today, over 95% of web traffic is encrypted. While encryption is vital for protecting data privacy, it also provides a convenient hiding place for cyber threats such as:

• Malware hidden within encrypted payloads.
• Phishing sites use HTTPS to appear legitimate.
• Data exfiltration via encrypted channels.

Without TLS inspection, these threats remain invisible. TLS inspection allows Zenarmor to securely decrypt, analyze, and re-encrypt traffic in real time, uncovering malicious or policy-violating content before it reaches your users or systems.

Zenarmor’s integrated Secure Web Gateway (SWG) and Content Inspection engine, part of our Single-App, Single-Pass, Single-Stack approach, enable organizations to detect and block threats concealed within encrypted sessions, preserving visibility and control across distributed networks.

What’s New in Version 2.2

Previously, TLS inspection in Zenarmor could be applied based on web categories, such as “Social Media,” “Cloud Storage,” or “Finance.”

In version 2.2, administrators gain domain-level precision. You can now:

• Specify exact websites (e.g., example.com, crm.company.net) for TLS inspection
• Exclude trusted domains to maintain privacy or comply with regulations.
• Create mixed policies that combine both category and site-based rules.

This fine-tuned control helps maintain the perfect balance between security, performance, and privacy. For example, you might enable TLS inspection on file-sharing or unknown sites but skip it for banking or healthcare portals where sensitive data should remain untouched.

Benefits of Granular TLS Inspection

1. Deep Threat Visibility

Reveal malware, phishing, and data leaks hiding within encrypted traffic, the primary attack vector in modern cyber threats.

2. Privacy-Aware Control

Respect regulatory requirements and user privacy by excluding specific domains or services from inspection.

3. Performance Optimization

Avoid unnecessary decryption on high-volume, low-risk traffic, keeping inspection focused where it matters most.

4. Unified Policy Management

All inspection rules, whether site-based or category-based, are configured and monitored within the Zenconsole dashboard, providing a centralized view and effortless management across all enforcement points.

5. Seamless Integration within Zenarmor SASE Anywhere Architecture™

Because Zenarmor performs inspection locally, on the device, edge, or private gateway, there’s no need to backhaul traffic to a cloud POP. This ensures low latency, data sovereignty, and consistent protection everywhere.

Zenarmor’s enhanced TLS inspection capability represents another step in our mission to deliver enterprise-grade security and visibility, on your terms. By empowering administrators to apply inspection at both the category and domain level selectively, Zenarmor ensures you maintain the ideal balance of security, compliance, and user experience.

For details of the release please check the documentation: Zenarmor SASE 2.2 Release

Why Real-Time File Scanning is Important

As organizations continue to enable distributed work and cloud collaboration, file sharing has become one of the most common infection vectors for ransomware, trojans, and zero-day malware. Traditional security solutions often rely on delayed or periodic scanning, leaving small but critical exposure windows.

Zenarmor’s real-time file scanning closes that gap by analyzing files at the moment of transfer, before the user can open them.

Zenarmor supports the real-time inspection of common file types often used by bad actors to hide malicious payloads, including:

• PDF
• Windows EXE (executable)
• Linux ELF (executable)
• MacOS Mach-O (executable)
• Android Dex (executable)
• ZIP
• Web Assembly
• Shell Script

How It Works

By selecting the new Content Inspection tab in the policy creation interface in Zenconsole, administrators can easily enable or refine file-scanning policies as part of their broader Secure Web Gateway (SWG) or CASB rules.

1. When a user initiates a file download, Zenarmor intercepts the transfer at the enforcement point, whether on the endpoint, edge, or cloud workload.

2. The file is scanned against multiple signature and heuristic engines in real time.

3. Suspicious or malicious files are blocked immediately, with the event logged and visible within your Zenconsole dashboard for instant review.

Figure 1: Real-time File Scanning configuration tab.

Key Benefits

• Instant Threat Detection Block malware, ransomware, and zero-day payloads the moment they appear in transit.

• Unified Policy Control Manage file scanning, content filtering, and threat inspection all within a single, centralized policy UI.

• Applies Everywhere Protection follows the user, whether traffic flows through an endpoint, a gateway, or a cloud workload.

• No Latency Trade-Off Leveraging Zenarmor’s decentralized Single-App, Single-Pass, Single-Stack inspection model, files are scanned locally or as close to the data source as possible, avoiding cloud backhaul delays common with traditional cloud-only SASE providers.

• Complete Visibility Security events, user actions, and file scan results are displayed in real time on the Zenconsole dashboard.

With Real-Time File Scanning, Zenarmor continues to push the boundaries of what’s possible in distributed network security. By integrating advanced content inspection directly into your policy framework, we’re helping security teams detect and stop threats instantly, before they become incidents.

Experience how Zenarmor SASE Anywhere Architecture™ delivers next-generation SASE protection without compromise.

For full details, see the SASE 2.1 Release Notes.

Zenarmor SASE 2.2 release strengthens our SASE Anywhere Architecture" with new capabilities that deliver stronger enforcement, better visibility, and simpler operations especially for MSPs, MSSPs, and ISPs/Telcos.

1. OpenWRT Support: Turn Routers Into Full SASE Edges

The headline feature in Zenarmor 2.2 release is native OpenWRT support.

Most ISP-provided routers and CPEs already run OpenWRT or a variant. Zenarmor can now be installed directly on those devices with no new hardware, no PoP dependency, and no traffic rerouting.

For ISPs & Telcos, this unlocks:

• Offer SASE / cybersecurity as a value-added service on top of existing connectivity
• Extend advanced security and reporting to SMB and mid-market customers without shipping a second box
• Protect IoT and “unmanaged” devices that sit behind the router and can’t run an agent
• Avoid backhauling traffic to a centralized PoP just to inspect it, keeping latency low and UX strong

For MSPs/MSSPs:

Easier rollout of managed SASE, secure SD-WAN overlays, and IoT/OT protection on customer sites

Bottom line: With the Zenarmor SASE Anywhere Architecture", OpenWRT support turns the already-deployed, widely used, low-cost router platform into a fully capable SASE edge at scale.

2. Device Posture Check: Real Zero Trust Enforcement

Traditional ZTNA policies look at who you are and where you are connecting from. Zenarmor 2.2 adds a crucial third dimension: what state your device is in right now.

Zenarmor 2.2 adds device posture verification into access decisions ensuring Zero Trust overlays only establish when the device is healthy and Zenarmor SSE protection is running.

This prevents “trusted but unprotected” endpoints from accessing sensitive environments and gives MSPs and ISPs a differentiated, posture-aware access service something traditional VPN/overlay tools cannot offer.

3. GEO-Aware Reporting & Data Residency

Data residency is built-in by design.

When an organization is created, Zenarmor automatically keeps telemetry in-region (EU stays in EU, US stays in US).

This helps enterprises meet sovereignty expectations, and MSPs/ISPs avoid compliance risks across their multi-region customer base.

4. Scheduled Reporting: One Report, Many Audiences

Central teams can now generate organization-wide reports and schedule them for the right recipients:

• Daily or hourly: Security operations
• Daily summaries: Executives
• Weekly/monthly: Compliance teams

Perfect for MSPs/MSSPs managing multiple tenants and ISPs offering bundled security services.

5. Precision Traffic Control: Site-Specific TLS & Split DNS

Not every customer wants “decrypt everything” TLS inspection. Many mid-market organizations and service providers want a more surgical approach and this capability was a direct customer request.

Site-Specific TLS Inspection:

Enable deep inspection only for selected domains ideal for high-risk targets or sensitive services without forcing decrypt-everything policies.

Split DNS for ZTPA:

Define internal domains and use internal DNS servers only for those, simplifying ZTNA/ZTPA app access and reducing manual DNS workarounds.

6. Administrative Lock-Down on Endpoints

Admins can now control:

• Whether users can uninstall the agent
• Whether inspection can be disabled
• Whether temporary bypass is allowed

This is critical for MSPs and ISPs delivering managed security, and for mid-market enterprises preventing “shadow exceptions.”

What Zenarmor 2.2 Means for You

For Mid-Market & Enterprise:

Stronger Zero Trust access, automatic data residency, role-appropriate reporting, and tamper-resistant endpoints.

For MSPs/MSSPs:

Differentiated SASE/SSE services, centralized reporting, posture-aware access, and controlled agent behavior at scale.

For ISPs/Telcos:

Instant SASE on existing OpenWRT-based CPEs, new revenue opportunities, and SASE benefits without traditional PoP architectures.

Next Steps

Existing customers and partners can now enable device posture checks, GEO-aware reporting, and OpenWRT deployments.

MSPs, MSSPs, and ISPs: Contact our team for lighthouse implementations and packaging options for your customers.

Zenarmor’s ONE.APP. SASE" already runs across every edge whether in the cloud, at the edge, or on endpoints and with the 2.2 release, that reach now extends to the edge gateways and routers already deployed in branches, customer sites, and home or home-office networks, delivering meaningful new value for ISPs, MSPs/MSSPs, and distributed enterprises worldwide.

For details of the release please check the documentation: Zenarmor SASE 2.2 Release

Teams are distributed, developers are remote, and customers expect instant, friction-free access. Digital payments, embedded finance, and open APIs now connect users, partners, and codebases across every cloud.

This new reality expands the threat surface dramatically when employees work from home networks or developers disable VPNs to avoid latency, multiplying risk.

In 2024, the financial sector saw the highest average breach cost of any industry, $6.08 million per incident (IBM Cost of a Data Breach Report).

Performance isn’t just a user-experience issue anymore, it is a compliance and exposure issue.

⚠️ Frustrated Users. Exposed Networks.

Even the most compliant architecture can fail when users lose patience with slow or unstable connections.

When VPNs or PoP-routed SASE paths lag, remote developers and employees often disconnect “just for a few minutes.” That brief gap is enough to:

• Expose unencrypted sessions
• Leave regulated workloads unmonitored
• Create blind spots in SOC 2 / PCI-DSS controls

Each disconnect = an exponential jump in risk.

The Modern FinTech Challenge

• Multi-Cloud Sprawl: AWS, Azure, and GCP environments multiply security complexity.
• Remote & Hybrid Teams: Developers, partners, and contractors connect from anywhere.
• Cloud Reliability Gaps: Outages like the recent AWS failure break relay-based security models.
• Regulatory Pressure: Financial data must remain sovereign and verifiable at all times.

FinTech firms need protection that travels with the user, not one that collapses when the cloud does.

Where Zenarmor Redefines FinTech Security

Zenarmor’s Single-App, Single-Stack SASE delivers Zero Trust enforcement exactly where work happens at the endpoint, at the edge, and across any cloud. No PoPs. No traffic leaving your control.

Why it matters for FinTech:

• Performance without Risk: Local traffic inspection means users stay protected even during AWS or regional outages.
• Privacy by Design: No third-party routing or mirrored data, full sovereignty across jurisdictions.
• Zero Trust that Moves with Developers: Fine-grained, session-based access keeps APIs and transactions isolated and verified.
• Instant Deployment: Lightweight agents on Windows/macOS or cloud workloads enforce policy in minutes, not months.

🚀 Security That Keeps Up with FinTech Velocity

Zenarmor matches FinTech velocity with protection that never blinks.

By unifying ZTNA, FWaaS, CASB, and SWG into one inspection pass, Zenarmor cuts latency by up to 50× versus PoP-routed architectures.

Whether it is real-time fraud detection or trading apps where milliseconds matter, Zenarmor delivers line-rate security without friction.

Zenconsole provides FinTech IT and compliance teams with:

• Centralized visibility across AWS, Azure, GCP, on-prem, branch, and remote environments
• Pre-mapped policies for PCI DSS, SOC 2, and GLBA
• Continuous posture and policy compliance monitoring even when disconnected

Why FinTechs Choose Zenarmor

The Bottom Line

Remote and hybrid FinTech teams cannot afford to choose between speed and security. Zenarmor delivers Zero Trust at full speed keeping users, data, and code secure wherever they run.

Experience Zenarmor SASE Built for FinTech. Designed for performance. Trusted everywhere.

Today’s healthcare environment looks very different. Large medical campuses are connected to regional clinics, local doctors’ offices, imaging centers, and remote staff, many of which have limited or no dedicated IT teams. Add in stringent requirements for HIPAA compliance, and it is clear: VPNs can no longer keep up.

Why Legacy VPNs Put Healthcare at Risk

Traditional VPNs reinforce the outdated “castle-and-moat” model: protect the perimeter, trust what is inside. Once a user or vendor connects via VPN, they often gain broad network access, far beyond what they need.

This creates dangerous vulnerabilities:

• Credential compromise = full network exposure If VPN credentials are stolen, attackers can move laterally into sensitive systems, from operating rooms to HR databases.

• Limited visibility VPNs provide little to no insight into application-level activities, making threat detection and policy enforcement nearly impossible.

• Prime ransomware targets VPN vulnerabilities accounted for 32.2% of healthcare data breaches involving third-party compromises.

• Operational overhead Managing hardware, licenses, and multiple VPN instances is costly and complex, especially for smaller clinics with lean IT staff.

In short: VPNs increase compliance risk while draining resources.

Why Zenarmor’s ZTNA Is the Better Path

Zenarmor replaces fragile VPNs with Zero Trust Network Access (ZTNA), a modern, integrated approach within our Secure Access Service Edge (SASE) solution. Based on the principle of “never trust, always verify”, ZTNA continuously authenticates and authorizes every user, device, and session before granting access.

This ensures HIPAA compliance is baked into every connection, across every site.

How Zenarmor Strengthens Healthcare Compliance

Zenarmor’s single-app, single-stack SASE architecture with shift-left security and zero PoP dependence delivers security where it matters most: close to users, devices, and applications, without forcing traffic through third-party data centers.

Here’s what sets it apart:

• Zenarmor Deploy-Anywhere SASE™ Platform Deploy Zenarmor at hospitals, clinics, or directly on Windows/Mac endpoints. Smaller sites get enterprise-grade security instantly, no costly appliances or PoP backhauling.

• Granular, application-specific access Users only connect to the specific apps and data they need, aligning with HIPAA’s least-privilege requirements.

• Micro-segmentation Breaks networks into secure zones, limiting lateral movement and shrinking the “blast radius” of any breach, directly supporting new HIPAA security recommendations.

• End-to-end encryption Protects ePHI as it travels between users, devices, and applications, ensuring compliance with HIPAA safeguards for data in transit.

• Visibility and auditability Unlike VPNs, Zenarmor logs and inspects every session. Compliance officers gain real-time visibility, continuous monitoring, and enforceable audit controls.

The Result: Secure, Compliant, Cost-Effective

By adopting Zenarmor’s ZTNA as part of a modern SASE strategy, healthcare providers can:

• Retire outdated VPNs and their operational overhead
• Apply consistent security across dispersed facilities
• Reduce capital costs while improving compliance posture
• Empower even the smallest clinic to be protected in minutes

Zenarmor gives healthcare organizations the confidence to scale, connect, and innovate, without compromising compliance or patient safety.

Let Zenarmor power your migration off legacy VPNs.

What’s New in the Zenarmor SASE 2.1 Release

🌐 Android Support for ZTPA

Zero Trust Private Access now extends to mobile users for secure, seamless connectivity anywhere.

📦 New ZTPA Subscription Tier

SD-WAN and ZTNA bundled into one streamlined package—simplifying deployment and licensing.

🛠 Unified Organization Subscription

Run multiple services (SSE, ZTPA, SASE) under a single subscription for easier scaling and centralized control.

🛡 Inline File Scanning

Real-time malware inspection of downloaded files (SSE and SASE tiers) for stronger protection.

📲 MDM Deployment Support

Seamless rollout via Microsoft Intune, JAMF, and Chocolatey (SSE and SASE tiers).

🔑 Enhanced Authentication

“Built-in Authentication” is now Zenconsole Authentication, with:

• Google and Microsoft login options
• Two-Factor Authentication (2FA)
• Support for multiple org admins and users

A New Zenconsole Experience

Zenconsole is now management-first:

• Before: Users landed on account settings, then clicked into “My Firewalls.”
• Now: Users land directly on the dashboard for firewalls, nodes, and organizations.

Account & subscriptions remain accessible under “Account” in the top right. This change streamlines workflows, making administration faster and more intuitive.

Backend Update

With the Zenarmor SASE 2.1 release, support for Elasticsearch 5 and MongoDB backends is discontinued. Customers using these legacy systems must migrate to the supported stack before upgrading.

👉 Partners: Please check customer environments and plan migrations early.

Next Steps for Partners

To ensure a smooth rollout:

• Get familiar with the new Zenconsole flow
• Highlight Android ZTPA and MDM deployment as key benefits for remote workforces
• Emphasize the new authentication options as a major security upgrade
• Audit deployments for Elasticsearch 5 or MongoDB and prepare transition paths

Release Availability

The Zenarmor SASE 2.1 release went live yesterday, Monday, October 6th, 2025.

Thank you for partnering with us to deliver the Zenarmor Deploy-Anywhere SASE™ Platform experience. For questions, please reach out to your Account Executive or Zenarmor Support.

For details of the release please check the documentation: https://www.zenarmor.com/docs/support/release-notes

The #SINET16 Innovator Award is one of the most prestigious recognitions in cybersecurity, celebrating emerging companies that are driving true innovation in the field. Among hundreds of applicants, Zenarmor was selected to advance to the final round, a powerful testament to the dedication and vision of our team in building something truly unique in the SASE space.

Each year, the SINET16 Innovators are evaluated and selected by an esteemed SINET Judging Committee, which consists of over 100 industry experts. Companies are chosen based on cumulative scoring associated with:

• The urgency in the marketplace for their products and solutions
• The innovation and uniqueness of their technologies
• How well their solutions solve real and significant cybersecurity problems
• Competitive advantages over other offerings
• Ability to succeed based on product readiness, capital, and leadership strength

The winners will be revealed live on stage at #SINET New York on October 7, 2025. This honor not only validates our approach but also gives us an incredible opportunity to share our mission and story on a global stage.

This milestone is both recognition and inspiration. It shows that our single-app, single-stack, zero-PoP SASE architecture is resonating with the industry and we are only getting started. 🚀

👉 Learn more about the #SINET16 Innovator Award and its distinguished judging committee here

Join us on this journey and see why Zenarmor is redefining the future of SASE.

#SASE #Cybersecurity #ZeroTrust #Innovation #SINET16

This distributed reality brings lifesaving care closer to patients, but it also creates a compliance and security nightmare.

The Compliance Burden in a Dispersed Environment

Healthcare is one of the most heavily regulated industries. Standards like HIPAA, HITECH, and SOC 2 are designed to safeguard protected health information (PHI), but compliance assumes consistent, airtight security controls across the entire system. That is nearly impossible when your environment is fractured.

Here is why:

• Every new endpoint is a risk Each clinic, laptop, or mobile device connecting into your network must handle PHI securely. One weak link, an unpatched device, a misconfigured VPN, or unsecured Wi-Fi, can put the entire system out of compliance.

• Legacy VPNs widen the attack surface VPNs were built for perimeter security, not for today’s cloud-first, dispersed environments. Once inside, a user (or attacker with stolen credentials) often has broad access across systems, violating the principle of least privilege.

• Inconsistent security postures A major hospital might have advanced intrusion detection, while a small rural clinic relies on consumer-grade firewalls. Regulators don’t care about those differences: if PHI is exposed anywhere, the entire healthcare system is liable.

• High-value target for attackers Patient records fetch up to 10x more on the black market than credit card data. Healthcare systems, especially those with dispersed environments, are irresistible targets.

The Stakes for Healthcare Organizations

When compliance fails, the consequences are severe:

• Financial penalties: HIPAA fines can exceed $50,000 per violation.
• Operational disruption: Ransomware shutting down access to EMRs or imaging systems can halt patient care.
• Reputational damage: Patients expect their most sensitive data to remain private—any breach erodes trust.

For IT and compliance leaders, the dispersed environment is no longer just a logistical challenge. It is the frontline of patient safety and regulatory survival.

The Zenarmor Difference

This is where Zenarmor comes in. Healthcare IT no longer has to choose between security, compliance, and care delivery speed.

Zenarmor delivers the industry’s first single-app, single-stack SASE architecture, designed to shift-left network security with zero dependence on PoPs. Instead of routing sensitive healthcare traffic through third-party data centers, Zenarmor enforces security and compliance controls as close to the user and device as possible.

What this means for healthcare systems:

• Consistent compliance across dispersed sites: From flagship hospitals to rural clinics, Zenarmor applies uniform policies everywhere, removing the compliance blind spots legacy VPNs leave behind.

• Granular Zero Trust access: Clinicians, administrators, and third-party providers get only the access they need, reducing lateral movement risk.

• Simplified IT operations: Lean IT teams gain centralized visibility and control without standing up complex infrastructure.

• No PoP reliance: Healthcare traffic stays under your governance, reducing latency for critical applications like EMR, PACS, and telehealth.

The Path Forward

Dispersed environments aren’t going away in healthcare, they are only expanding. To stay compliant and protect patient trust, organizations need a security model that is as distributed and flexible as their care delivery networks.

Zenarmor’s single-app, single-stack SASE architecture while uniquely supporting shift-left network security with absolutely zero dependence on PoPs gives healthcare providers the confidence to scale, connect, and innovate without compromising compliance or patient safety.

SASE has gained popularity quickly in recent times, and for good reason. It offers centralized control, cloud delivered security, and seamless security, and. All sounds too good to be true?

Perhaps.

For many businesses, SASE does provide the security they are looking for, at least initially. But the common misconception is that SASE must be cloud-native. The truth - SASE is a framework. And it does not have to be tied to the cloud. Additionally, like with everything else, there is a downside to cloud-only SASE as well.

Single Point of Failure on the Cloud

Most mainstream SASE vendors run on shared cloud infrastructure. The downside? When something goes wrong in that shared environment, an outage, misconfiguration, or attack, not just one tenant is affected but potentially thousands. You’re entrusting your data’s safety to systems that others depend upon as well.

This kind of dependency on centralized, multi-tenant infrastructure doesn’t just increase exposure it amplifies the blast radius when things go wrong.

A telling example is the Azure Active Directory outage in 2020. A misconfiguration in Azure AD triggered a system-wide failure that prevented users from accessing key Microsoft services including Azure Portal, Microsoft Teams, Microsoft 365 for nearly three hours. This was not the result of a cyberattack, but a simple technical error within the cloud provider’s shared infrastructure. Yet the consequences were global. Millions of organizations were simultaneously locked out of critical services, demonstrating how a single vendor-side issue can cascade across all tenants.

Zenarmor Plug. SASE. Everywhere. Model: Resilience without the Risks

Zenarmor has a different approach. Each instance runs independently. That way, risk is contained to one tenet/instance and doesn’t travel across the network.

Shared IPs mean Shared Risks

Many SASE solutions used shared PoPs with shared public IP addresses. If one customer or system gets flagged for abuse, it results in all customers on the same IP getting affected. This can quickly snowball into something bigger - the entire IP can get blacklisted, you lose access to critical services, web traffic gets throttled, emails bounce - the works. When external services get blocked, you risk reputational harm, and your business loses credibility.

Issues like this disrupts continuity and increase user friction. You end up paying the price for someone else’s mistake, and your business suffers.

Zenarmor gives you control over your network and IP addresses

No matter where you are deployed - cloud, on-premise, or directly on the tenants, you will never have to share public IPs with other tenants. No more risk of your IP getting blocked due to someone else’s actions, and no more business disruptions.

Centralized inspection creates bottlenecks

Cloud SASE providers often route all traffic through centralized Points of Presence (PoP). While that sounds efficient, it creates new problems:

• Latency, because traffic detours through a distant PoP
• Dependency, because if the PoP goes down, your security does too
• Congestion, as inspection queues get overloaded

Zenarmor makes every device its own mini security hub

Routing all traffic through shared infrastructure and centralized Points of Presence (PoP), creating bottlenecks, increasing latency, and introducing potential single points of failure. Zenarmor takes a different path. With its Plug and Secure approach, Zenarmor delivers full security enforcement at the edge, on-premises, or directly on the endpoint without relying on a centralized cloud architecture. With Zenarmor, each device or site becomes its own inspection point. Whether it’s a remote branch or a single endpoint, security happens right there.

This gives you faster performance, stronger isolation, and better resilience.

Legal and Compliance Issues

No one wants to be slapped with a regulatory fine. In the current time, regulations like GDPR, HIPAA, CCPA, are coming down hard on non-compliant organisations. In recent times, many global enterprises have faced regulatory fines, to the tune of many millions - for instance, TD Bank ($3.09B) in US, Meta (€1.2B) and Amazon (€746M) in Europe - these were GDPR fines levied on companies globally, in 2024 for non-compliance.

With traditional SASE, you do not have enough visibility or control over your traffic, leaving you more vulnerable to risks.

Zenarmor processes traffic locally - within your own infrastructure

With Zenarmor, you have full control and visibility over where your traffic is inspected and stored. This makes audits and checks easier and also mitigates risks - related to data security or compliance.

Because Zenarmor is compliant by design, it gives you the following benefits:

• Data localization: you decide exactly which region or jurisdiction processes your traffic.
• Configurable data retention: customizable logs and metadata policies to meet specific regulatory or internal compliance needs.
• Zero shared infrastructure: no shared PoPs or IP pools means no unexpected data exposure.

Vendor Lock-ins Limit your Flexibility; Increase Costs

Choosing a vendor is often a time-consuming and expensive process. Once you have committed to a cloud-SASE solution, it is hard to back out - you have limited flexibility, are tied to their processes, limitations and roadmaps. As a result, it becomes hard to scale, integrate their solutions to your infrastructure and get it running.

Zenarmor is Modular, Flexible and Vendor Agnostic

You can run Zenarmor on any device or any environment, be it your private data center or public cloud. You get full API access and it integrates well with the tools you are already using.

No Single-Point-of-Failure

With cloud-only SASE, all networks go through the vendor’s infrastructure, which of course, is risky. Because no matter what ‘uptime’ your vendor guarantees, there is still a possibility of something going wrong - and if something does go wrong with the vendor’s network, your network goes down too. This creates bottlenecks, affects the overall experience, and adds to your ‘hidden cost’ of doing business.

Zenarmor is Distributed by Design

Zenarmor ensures each site or device is handled locally. The security policies and real-time inspection you need, is all built-in, giving you peace of mind. No more relying on external factors for your security and efficiency.

Cloud-Only SASE is Risky - Zenarmor Gives you the Control you Need

For all the benefits of centralization that SASE provides, it does expose your organisation to significant risks. Zenarmor flips that model on its head - it helps you achieve all the benefits of SASE - visibility, inspection, policies, without giving up control or reliability.

If you are considering adopting a SASE solution, check out how Zenarmor may do all that, and more. Speak to us today, or try it out for free, for a limited time.

Zenarmor Deploy-Anywhere SASE™ Platform, now with support for Microsoft Intune, and Jamf, makes flexible, at-scale deployment a reality. It integrates seamlessly into your existing device management workflows, allowing IT teams to push and manage Zenarmor to endpoint devices using the tools they already trust.

An MDM platform does more than simplify device management. It enables security to scale with your organization. As your workforce grows and becomes more distributed, Zenarmor’s integration with MDM tools allows you to deploy advanced network protection across thousands of macOS and Windows devices with ease.

For Windows environments, Zenarmor also supports deployment via Chocolatey, a popular package manager used by many system administrators to automate software installation at scale.

To help you get started quickly, we’ve created short step-by-step videos showing exactly how to deploy Zenarmor using Microsoft Intune and Jamf:

Deploy Zenarmor application to macOS devices using Microsoft Intune MDM{target=“_blank”}

Deploy Zenarmor application to Windows devices using Microsoft Intune MDM{target=“_blank”}

How to Deploy Zenarmor on macOS Devices via Jamf MDM{target=“_blank”}

It’s dispersed, encrypted, and routed through a complex chain of SaaS platforms, third-party APIs, and devices. But here’s the challenge: security teams haven’t been given the visibility to match this new world.

Visibility Gap is a Growing Risk

Traditional security tools were designed for perimeter-based systems. They function well when traffic goes through a few key points, like firewalls, proxies, and gateways. However, in today’s hybrid environments, much of that traffic bypasses IT-controlled infrastructure.

As a result:

• East-west traffic in distributed environments often goes unnoticed.
• Shadow IT, which includes unauthorized apps and services, operates without detection.
• Encrypted traffic prevents inspection tools from working effectively.
• SaaS usage is increasing rapidly, but there is little clarity on data access and movement.

Effectively, you cannot protect what you cannot see.

How Zenarmor Closes the Gap

Zenarmor is designed to restore visibility in today’s modern, distributed environments. It doesn’t depend on network chokepoints or outdated taps. Instead, it provides inline inspection directly at the endpoint; this way, it captures traffic from its source.

Here are some key technical features that help security teams regain control:

North-South and East-West Visibility

Whether traffic is coming in and out of your network (north-south) or moving between hosts and workloads within your environment (east-west), Zenarmor captures and analyzes it in real time. This is especially important in cloud-first environments where lateral movement is harder to detect.

Application-Aware Traffic Inspection

Zenarmor applies Layer 7 deep packet inspection (DPI) to recognize applications irrespective of port or protocol. This allows you to distinguish approved apps (like Google Drive) from unapproved ones (like personal Dropbox or Telegram sessions), even in encrypted flows.

Shadow IT Discovery

By analyzing app usage at the packet level, Zenarmor finds tools and services that are used outside your approved stack; this includes unauthorized CRM tools, personal cloud storage, or collaboration apps. This gives IT teams the power to enforce policies without limiting productivity.

Granular Policy Enforcement

Visibility is only valuable if you can act on it. Zenarmor allows teams to enforce policies based on app category, location, or protocol; for example, it can block high-risk file-sharing apps, restrict access to known malware domains.

Why This Matters

In today’s fragmented security landscape, visibility is not optional, it is essential. Without it, even the best detection and response tools work with blind spots.

Zenarmor helps security teams regain that critical control, regardless of where users are and how they operate.

If you can’t see it, you can’t secure it.

Reach out to us today to know more about Zenarmor, or try it out for yourself.

Secure Access Service Edge, or SASE (pronounced “sassy”) was coined by the research firm Gartner in 2019 to describe a set of solutions to better protect the modern workforce. User traffic patterns shifted from occasional internet usage to being reliant on it for connectivity to the cloud and Software as a Service (SaaS) applications like Microsoft Office 365, Salesforce, Slack, and more.

SASE is a combination of previously separate solutions to provide efficiency and security for modern users, like Software Defined WAN (SD-WAN) to intelligently route traffic and multiple security solutions like Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and more.

Although initial adoption was slow, the onset of the global pandemic in early 2020 dramatically accelerated the need for SASE. Organizations were forced to rapidly adapt to distributed workforces, making flexible, scalable security frameworks like SASE essential.

In this blog post, we’ll walk you through Zenarmor SASE 2.0, a next-generation implementation of SASE that takes the concept further by eliminating cloud backhauling, supporting distributed inspection, and offering a true plug-and-secure experience anywhere, anytime.

Early SASE Solution Providers

As security and connectivity challenges arose in this “new normal”, SASE solution providers helped address the issues that companies and users faced.

As user traffic shifted to the cloud and SaaS, SASE providers provided cloud-based Points of Presence (POPs) to steer user traffic, inspect it, and connect users to their cloud applications.

This allowed SASE providers to provide additional security for remote users and replace older VPN-based solutions, but they also introduced some new challenges and brought new limitations.

With many of the leading SASE solution providers focused on cloud-based connectivity through their own Points of Presence, customers had to send all of their traffic through their SASE provider’s cloud for inspection and routing. This introduced additional latency, added asynchronous (suboptimal) routing paths, and left organizations with limited visibility and control over where their data was being routed.

Redefining SASE with Zenarmor Deploy-Anywhere SASE™ Platform: Zenarmor SASE 2.0

Zenarmor SASE 2.0 represents the next evolution of Secure Access Service Edge, reimagined for a hyper-distributed world. With our Zenarmor Deploy-Anywhere SASE™ Platform, Zenarmor brings security and control directly to where your users and devices are, eliminating the need for backhauling traffic through centralized cloud infrastructure. This architecture delivers ultra-low latency, effortless deployment, and complete visibility into your traffic.

Protecting your environment has never been simpler or more effective. Let’s take a closer look at each of the core components of Zenarmor SASE 2.0:

ZTNA

Zero Trust Network Access (ZTNA) means that we trust nothing by default. Users and their application access requests must be authenticated and connections are encrypted. With granular access control, your users access only what they need and nothing more. Additionally, potential attackers can’t perform any lateral movement on the network since they won’t be authenticated nor authorized.

Zero Trust Network Access (ZTNA) means that we trust nothing by default. Users and their application access requests must be authenticated and connections are encrypted. With granular access control, your users access only what they need and nothing more. Additionally, potential attackers can’t perform any lateral movement on the network since they won’t be authenticated nor authorized.

Upgrade your security posture from legacy VPNs to a true Zero Trust based architecture in just a few clicks.

• Encrypt traffic from your users to the applications they need
• Protect all devices, including IOT and OT
• No lateral movement
• Context-aware access

TLS inspection

The majority of traffic is encrypted today which can allow a potential attacker to hide malware or phishing attempts. With real-time TLS inspection, Zenarmor SASE 2.0 can look inside encrypted traffic and find potential threats before they get to your users. Zenarmor’s innovative approach allows this TLS inspection to happen on nearly any device instead of just a centralized firewall.

• Ensure all threats can be found, regardless of encryption
• Protect against malware, phishing, and other attacks

CASB and DLP

As modern work shifted to cloud-based SaaS applications like Microsoft Office 365 and Google Workspace, many security organizations were unable to secure user traffic that was no longer going back to their data centers. Cloud Access Security Broker functionality that’s built into Zenarmor SASE 2.0 lets you secure your users, regardless of how they’re accessing applications. Data Loss Prevention, or DLP, features can block users attempting to upload company data to unsanctioned cloud storage providers.

• Protect your SaaS and cloud traffic
• Prevent unauthorized uploads of company data

SWG

Secure Web Gateways are an important line of defense for your network and Zenarmor SASE 2.0 allows you to deploy wherever you need protection: Near your users or in the cloud. With real-time TLS inspection, we can shed a light on malware and other threats that could pass through other devices since they’re hiding behind encryption. We can also filter and block zero-day threats, keeping you protected before waiting for signature updates from competing vendors.

• Filter and block malicious traffic before it gets to your network and users, even zero-day attacks
• TLS inspection for real-time detection of threats attempting to hide in encrypted traffic

Policy-based controls (web filtering, applications)

Powerful security features can often be difficult to configure. Not with Zenarmor SASE 2.0. Now you can quickly and intuitively create, configure, modify, and apply policies for your sites, departments, networks, and users in a simple, unified interface.

• Fine, granular control of allowed URLs
• Different levels of control for sites, departments, locations, and more
• Control exactly who can access what, enforce least privilege by default

Unified Management for control and visibility

Power is nothing without control. Zenarmor SASE 2.0 has powerful security features combined with a user-friendly, intuitive interface that lets you quickly configure the security policies and features you need.

Additionally, reports and visualizations provide at-a-glance insights into what’s going on within your network, giving you more visibility than ever.

SD-WAN

Software Defined WAN provides flexible, self-healing network capabilities for all of your underlying circuits. Simply define your locations and let Zenarmor provide secure, reliable routing between your global locations.

• Intelligent routing and usage of links
• Centralized management and visibility

Zenarmor SASE 2.0 - Deploy-Anywhere SASE™ Platform

The rise of SASE solution providers helped many organizations solve their security challenges, but unfortunately they also introduced some new problems.

Take back control of your network, your traffic, and your data while eliminating the additional latency that’s introduced by forcing your traffic to the cloud by some SASE vendors.

Quickly and easily deploy close to your users whether that’s near the edge or in the cloud. Secure all your devices, including IOT, OT, medical, and end user devices.

By protecting your users wherever they are, you’ll improve their user experience while simultaneously providing a fully-featured network security solution.

Zenarmor SASE 2.0 is here and it marks a turning point in how we protect networks across the globe.

As we introduce Zenarmor Deploy-Anywhere SASE™ Platform, an innovative architecture that enables flexible deployment, to the network security industry, our goal is to meet the evolving needs of businesses, remote teams, and hybrid workforces.

But the impact of this launch goes beyond the enterprise space.

Plug and Secure Home. is evolving too.

From day one, our mission has been to make advanced network security accessible to everyone. And that includes the passionate home users, lab builders, and privacy-conscious individuals who’ve been with us from the start. As we continue to scale, we’re making sure the Home subscription grows with us.

Over the past few months, we’ve received a lot of feedback, especially about the limitations in the Plug and Secure Home. subscription regarding the number of devices and policies. Many of you told us that while you love the power and flexibility Zenarmor offers, the existing limits made it hard to fully secure your increasingly complex home networks, particularly in a time when the number of IoT devices is increasing significantly.

We’ve heard you loud and clear.

Now, we’re making meaningful changes, directly shaped by your feedback, to the Home subscription, starting with two of your most requested improvements:

Up to 200 Devices Now Supported

You can now connect up to 200 devices with your Plug and Secure Home. subscription—double the previous limit. Whether you’re running a smart home setup, a home lab, or managing a tech-savvy household, we’ve got you covered.

Five Policies: One Default, Four Customizable

We’re also expanding the number of customizable policies from 2 to 4.

New 5 policies include:

• 1 Default Policy
• 4 Fully Customizable Policies

This means you can now create tailored security policies for different groups of devices or users, giving you more control and flexibility to secure your home environment the way you want. To activate these new limits, please make sure to have the latest version of Zenarmor and reinstall your activation key.

At Zenarmor, we’re fortunate to serve a community of highly skilled, tech-savvy users who hold us to high standards. Your feedback continues to shape the product in meaningful ways, and as we grow, we remain committed to evolving Zenarmor in step with your needs.

Thank you for being part of the journey.

As businesses strive to keep up with hybrid work, legacy technologies and remote teams, the traditional boundaries of the network have almost disappeared.

That’s where Zenarmor Deploy-Anywhere SASE™ Platform stands out.

While the SASE has become popular with companies, many of those solutions still fall short in flexibility, performance, and real-world conditions. Zenarmor Deploy-Anywhere SASE™ Platform reimagines network security by meeting you wherever you are - on-prem, on cloud, or anywhere in between.

Let’s explore what makes this approach unique.

1 - Instant Deployment Across Any Environment

Security should not be a complex affair.
With Zenarmor, it isn’t.

You don’t need special hardware, or to redesign your entire network. Zenarmor is a software-first product, built to run on almost any platform - Windows, Linux, macOS and others. It just works.

Some vendors claim “lunch break” deployments. With Zenarmor, it is much quicker - quicker than a ‘lunch break’. You can get it up and running within a few minutes - saving your team precious time, and reducing risk in the process.

This kind of speed becomes a strategic edge for your company. For fast-moving IT teams or MSPs dealing with multiple clients, setting up security in minutes can make the difference between proactive security and reactive controls.

2 - No Cloud Backhauling: Performance Without the Pain

Many cloud-based SASE solutions have a secret: backhauling.

When all traffic has to go through a vendor’s cloud PoP for inspection, there are chances of latency. Performance drops. As a result, user experience takes a hit. Users start finding ways around the system - turning off their VPNs, disabling security agents, or even complaining to IT.

Zenarmor Plug. SASE. Everywhere. eliminates this issue entirely.

Zenarmor’s ‘Inspect locally, Manage centrally’ approach means you do not have to rely on ‘middle’ infrastructure. Users stay protected at all times, security becomes invisible - exactly how it should be.

3 - Centralized Management, Decentralized Enforcement

Deploying security everywhere shouldn’t mean complexity in managing.

Zenconsole gives you centralized control across your entire deployment. Whether you’re managing a fleet of laptops or firewalls, you get one source of truth.

This is critical not only for operational efficiency, but also for security. You can enforce consistent policies without problems, monitor traffic in real time, and troubleshoot issues without switching between tools or portals.

4 - Privacy by Design, Not Just by Policy

Too many SASE solutions rely on shared cloud PoPs, creating a host of compliance concerns.

Zenarmor Deploy-Anywhere SASE™ Platform follows privacy by design principles.

There’s no traffic rerouting. No shared infrastructure. No risk of IP blacklisting. For teams subject to GDPR, HIPAA, or regional data sovereignty regulations, this is a relief.

Your traffic stays where it belongs - under your control.

5 - Scales Without Infrastructure Constraints

Most security tools start lightweight and become bloated. Zenarmor remains lean - even at scale.

Irrespective of how many endpoints you are managing, there’s no need to invest in new servers. Zenarmor’s lightweight engine is designed for high-efficiency enforcement and minimal resource usage.

This makes it suitable not just for enterprises but also for MSPs or mid-sized organizations that need to scale without increasing their costs.

6 - Protects What Cloud-Only SASE Cannot

Cloud-only SASE platforms struggle with devices that cannot (or should not) route traffic through external gateways.

Think security cameras, industrial controls, medical sensors, and other IoT devices.

Zenarmor protects these assets by enforcing policy locally, giving you visibility into east-west traffic patterns that cloud inspection can’t address. You can identify lateral movement attempts, quarantine compromised nodes, and close gaps that would otherwise go unnoticed.

Legacy Systems: Still Critical, Still Vulnerable

Not every business can switch overnight. Many still rely on legacy applications and systems that are essential but hard to secure in a modern architecture. Their management is also clunky and not user-friendly, making shifting out a lot more complex

Zenarmor provides a solution. Its flexible deployment model allows you to bring zero trust enforcement and micro-segmentation into environments that cloud-native tools often miss.

Zenarmor Deploy-Anywhere SASE™ Platform is more than a tagline. It’s a product philosophy based on a deep understanding of how modern networks operate - and where traditional SASE models fail.

At a time when enterprises are rethinking what secure connectivity means, Zenarmor offers a refreshing alternative:

• fast to deploy,
• light on infrastructure,
• highly efficient, and
• designed for the environments that most others overlook.

It’s not about discarding the cloud. It’s about taking control (and security) back in your hands. If you want to learn more about Zenarmor’s Plug. SASE. Everywhere. Approach, reach out to us today.

Details:

• Date and Time: Saturday, June 28, 2025, from 05:00 am - 06:00 am GMT(Summer Time) (00:00 am - 01:00 am EDT, Sunday, June 27, 2025 9:00 pm to 10:pm PDT).
• Duration: 1 hour
• Affected Service: Zenconsole Cloud Management Portal
• Reason for Maintenance: OS Migration for Zenconsole Infrastructure

We thank you for your understanding and patience during this maintenance window and apologize for any inconvenience it may have caused.

Zenarmor Team

While SASE represents a big change in how organizations approach network security, traditional SASE implementations often fall short of their requirements.

The SASE market is booming. It is projected to reach USD 44.20 billion in 2024 and grow at an 11.2% CAGR through 2032. This growth reflects a real need for integrated and scalable security.

Many “traditional” SASE solutions however, often fall short of expectations. Many are not built as unified platforms from the start, which leads to complexities and limitations.

This is where Zenarmor comes in, not just as an alternative but as a solution that directly addresses these issues.

Let’s explore where traditional SASE struggles and how Zenarmor excels in solving your data security challenges.

Limitations of Traditional SASE and the Zenarmor Advantage

Zenarmor addresses traditional SASE issues with a practical, high-performance, and cost-effective approach. Here are some drawbacks of traditional SASE and how Zenarmor scores over the same.

Complexity and Disjointed Management

Traditional SASE will often have you managing multiple dashboards and multiple policies. This fragmented approach is because traditional SASE was not conceived as a cohesive platform. This complexity increases operational burdens and raises the chances of misconfigurations.

Zenarmor Advantage: True Unified Management and Simplicity

Zenarmor SASE 2.0 delivers true unified security management, whether you’re deploying on-prem, in the cloud, or directly to endpoints. Unlike traditional solutions tied to specific hardware or OS, Zenarmor is fully agnostic. That means you get the flexibility to secure any infrastructure. Through Zenconsole, you gain centralized, single-pane-of-glass control across all deployments, enabling consistent policy enforcement and dramatically reducing operational complexity

Performance Bottlenecks and Latency Issues

Cloud-native SASE typically reroutes traffic to central Points of Presence (PoPs) for inspection, causing significant delays. Cloud backhauling for security services can worsen this issue. Moreover, relying on shared PoPs introduces risks: outages can disrupt services, and shared IP addresses can lead to your organization getting blacklisted, and eventually harm your reputation.

Zenarmor Advantage: Edge-Centric Performance and Resilience

Zenarmor operates directly within your existing network infrastructure and enforces security right at the network edge. This way, you can avoid the need to reroute traffic, and reduce delays, thereby optimizing performance. By not depending on shared PoPs, you avoid the risks of outages and blacklisting, enhancing your network’s reliability and reputation.

High Costs and Hidden Fees

While SASE aims to reduce costs, many traditional vendors charge high subscription fees and impose bandwidth limitations. Overages or unexpected traffic spikes can lead to high bills overall. Additionally, egress fees for data leaving the vendor’s cloud can quietly drain your budget.

Zenarmor Advantage: Transparent Costs and Unrestricted Scaling

Zenarmor SASE Anywhere Architecture™ eliminates the need for expensive cloud infrastructure by performing inspection locally—on the edge, on the device, or on-premises. This approach removes egress fees entirely and avoids bandwidth throttling. It runs on your existing hardware, reducing initial setup costs and allowing you to scale without worrying about hidden charges or unpredictable cloud expenses.

Limited Visibility and Shadow IT Blind Spots

Traditional SASE often manages well with North-South traffic visibility (traffic entering or leaving your network) but lacks insight into East-West traffic (internal communications). This critical oversight allows Shadow IT and internal threats to go unnoticed, leaving your network vulnerable.

Zenarmor Advantage: Comprehensive Visibility: North-South and East-West

Zenarmor excels in Deep Packet Inspection (DPI) and application-layer control, giving you detailed command over thousands of applications. Importantly, it offers full visibility, covering both North-South and East-West traffic. This capability allows you to spot and manage Shadow IT, internal threats, and lateral movements, closing essential security gaps.

In addition, Zenarmor provides Zero Trust Network Access (ZTNA) and Secure Service Edge (SSE) capabilities on a single platform, enabling granular access control and threat mitigation - all from a unified management layer.

Vendor Lock-in and Restrictive Architectures

Choosing a traditional SASE vendor often results in significant vendor lock-in. Their proprietary systems and inflexible architectures make it hard and costly to change providers or customize the solution to your needs, which stifles agility and innovation.

Zenarmor Advantage: Unmatched Flexibility without Vendor Lock-in:

Zenarmor ensures transparency and prevents vendor lock-in. It is an extremely versatile platform, as it works across OPNsense, various Linux distributions, FreeBSD, and cloud environments. You can deploy it wherever you need it, adapting to your network architecture rather than the other way around.

Choosing Wisely in the SASE Era

The shift to SASE is an important step towards a more resilient cybersecurity posture. With over 60% of organizations moving to hybrid or fully remote work, secure and seamless connectivity is crucial. While complete SASE implementation is still developing, 32% of organizations are already in progress, and 24% plan to implement it in the next 12 months.

However, selecting the right SASE solution is key. Don’t let the lure of consolidation distract you from the potential complexities, performance issues, hidden costs, and visibility gaps of traditional options.

Zenarmor offers a compelling, agile, effective, and clear approach. It fulfills the SASE promise while removing the drawbacks, helping you to truly protect your network without compromise.

Ready to discover a modern way to secure your network that eliminates the weaknesses of traditional SASE? Learn more about Zenarmor and try it for yourself today. Zenarmor offers a user-friendly trial policy of 15 days for regular users, and 3 months for partners.

However, working styles have changed fast. Now, VPNs are at best an outdated security system that not just have glaring gaps, but also increase friction in everyday operations.

Traditional VPNs are no longer adequate to handle the security requirements of the modern organization. This is especially true if your organization is undergoing digital transformation, has remote workers or if you work with cloud applications.

Here are some reasons why traditional VPNs do not suffice the security requirements of the modern organization:

Centralized ‘choke’ points

Imagine redirecting all cars in a city traffic through one lane, during rush hour. The result? Everything is slowed down, and there is chaos. VPNs send all your traffic through a single gateway, which is usually at HQ. If the gateway crashes, everyone is stuck.

Zenarmor Solution: Peer-to-peer mesh connectivity using ZTNA

Zenarmor helps connect each user directly and securely to the information they need. Zenarmor’s ZTNA implementation creates encrypted, point-to-point tunnels between the endpoint and the target application or server without detouring through a VPN hub or a data centre. This helps your organization significantly:

• Eliminates centralized network congestion
• Limits the attack surface for bad actors and improves security
• Improves scalability and flexibility through an easily adaptable solution (ZTNA)

Dependence on VPN Gateway

If your VPN application or cloud PoP has issues, your users get kicked out or rerouted through slower routes. This means network lags, session drops, frustrated users, and your IT teams getting calls throughout the day.

Zenarmor Solution: Endpoint based inspection

Zenarmor flips the script - Zenarmor runs right on your device, eliminating any issues of gateway getting choked. This means security checks happen locally - no need for a VPN, no detours or bottlenecks. As a result? Smoother and safer remote work for everyone, and IT teams are not burdened with calls throughout the day.

• Improved performance due to minimal reliance on centralized infrastructure (20-1500 times faster than traditional VPN or SD-WAN solutions)
• Consistent, reliable connections with no ‘single-point-of-failure’
• True Zero Trust Security with unlimited micro-segmentation

Threat surface increases significantly - including all systems on the network

Once a VPN connection is active, a compromised device can open the floodgates to the entire network. Think about it - when a laptop gets infected with malware or falls victim to a phishing attack (quite common), the attacker has the same network access as your employees. What should ideally be an isolated instance on one remote worker’s device, quickly becomes a company-wide security nightmare.

Zenarmor Solution: Microsegmented ZTNA + Default-Deny Access

With Zenarmor, the control is in your hands. You can restrict access to per user and per application. Every connection is explicitly granted, giving you full visibility into access. Even if a device is compromised, access is blocked by default, which means bad actors cannot move laterally.

• Peer-to-peer secure connectivity, minimizing exposure and bottlenecks
• Default-Deny Access model as an approach to enforce Zero Trust Security
• Granular control of applications and user access to reduce exposure and risk

The Bottom Line

Traditional VPNs were built for a different era and were useful long back. The modern environment of remote teams, distributed workforces, and evolving threats needs a more modern approach to security.

Zenarmor is built on a fundamentally modern approach - on Zero Trust, endpoint intelligence, and peer-to-peer connectivity. The result? Faster, safer, and more resilient access, without the usual bottlenecks and breakdowns. It’s time to give your network security a fresh, new upgrade it deserves. Talk to us today to learn how Zenarmor can help strengthen your security posture.

It means more than just a version number update. It’s the result of a vision we’ve been pursuing for some time: a unified SASE platform that truly matches how businesses operate today — instant, simple, flexible, fast, and built for an agile, mobile and distributed world.

I wanted to take a few minutes to share with you why this release matters — not only for us, but for any organization navigating the new realities of work and security.

The Way We Work Has Changed — For Everyone

Five years ago, work looked very different. Employees worked at fixed office locations, connected to internal company networks, using company owned desktops. Data lived safely inside on-premises data centers. The network perimeter was clear.

But that world is gone — for everyone.

Today, workforces are mobile. Teams work from home, cafés, client sites, on the road, using laptops, smartphones, tablets and accessing sensitive data from anywhere.

This shift has not only happened to large enterprises or tech firms.

It’s just as true for small businesses such as law firms, architecture firms, real estate agencies constantly moving between offices, client locations, and remote workspaces.

Agility and mobility are now how business is done in every industry, at every size.

Yet traditional network security models, perimeter-based products and VPNs, were not designed for this environment. They can’t fully protect users who are mostly off-network.

We are not the only ones noticing this shift and recognize there needs to be a fresh approach.

Recognizing this shift, the industry moved toward a new framework: Secure Access Service Edge (SASE), first defined by Gartner.

This initial version of SASE, which we call cloud-only SASE, was a good step in the right direction. However it spawned new challenges.

Cloud-only SASE Challenges

Below are some of the common complaints we’ve heard:

• High costs → Cloud infra and data egress fees
• Performance issues → Latency from routing all traffic through vendor clouds
• Complex setup → Fragmented licensing, heavy vendor lock-in
• Privacy concerns → Sensitive traffic handed off to vendor clouds
• IoT & legacy gaps → Poor support for hybrid environments

It became clear: businesses of all sizes need a better way to secure their distributed, cloud-first, mobile workforces; and cloud-only SASE needed to be improved as well.

Introducing: Plug. SASE. Everywhere.

With Zenarmor 2.0, we’re redefining SASE to become faster, simpler and even more agile.

Plug. SASE. Everywhere. — because security inspection should happen where it makes the most sense:

• Edge gateway
• Cloud VPC gateway
• Endpoint (desktop or laptop)

The benefits:

• No cloud backhauling → Lower latency, lower cost
• No POP outages or IP blacklisting
• Local inspection & enforcement
• Deploy in minutes
• Unified Zenconsole management
• IdP integration + API support

What’s in Zenarmor 2.0

Zenarmor SASE is built on two core components:

1. Secure the Internet — with Secure Service Edge (SSE)
2. Secure Access to Private Networks — with Zero Trust Network Access (ZTNA)

Together:

SSE + ZTNA = SASE → Secure all user traffic (public & private) from anywhere

• → Consistent policies & full visibility
• → Zero Trust architecture — no VPN dependence

Built for Real-World Use Cases

Our initial customers — from small businesses to large organizations — are using Zenarmor 2.0 to:

• Secure remote workforces (with or without network hardware)
• Replace MPLS / SD-WAN / VPN
• Enable ZTNA access to private networks
• Protect branch and school edges
• Protect cloud workloads
• Support IoT and legacy infrastructure
• Gain Shadow IT visibility and control

Available Now

Zenarmor 2.0 is available today.

We’re proud to deliver this unique, industry-first SASE platform built for how businesses of every size operate today — instant, simple, fast, flexible, and secure.

That’s Plug. SASE. Everywhere. That’s Zenarmor.

To find out more, please visit our website: https://www.zenarmor.com

Murat Balaban Founder & CEO, Zenarmor

Bridging the Gap: How Zenarmor Secures macOS Devices

In contrast to conventional Security Service Edge (SSE) solutions that necessitate routing network traffic to the vendor’s cloud for inspection, Zenarmor’s pioneering Plug. SASE. Everywhere. approach delivers the complete SSE stack directly to your macOS endpoint. Consequently, inspection and control are now conducted locally on the device interface, irrespective of the network to which the device is connected.

With the rise of remote and hybrid work environments, maintaining security across various operating systems is increasingly vital. Zenarmor has already delivered a complete, lightweight SSE stack to Windows endpoints, and now, by extending support to macOS devices, Apple users can enjoy the same high level of network security.

Zenarmor Deploy-Anywhere SASE™ Platform: Just like our Windows agent, the new macOS agent is now included with the SSE subscription. Existing SSE users automatically receive macOS protection without any additional steps.

AI-Powered Threat Detection: Get real-time, advanced threat protection against malware, phishing, and other cyber threats.

Comprehensive Web Filtering: Block malicious websites and enforce acceptable usage policies across macOS devices.

Centralized Policy Management: Manage and enforce security policies for both Windows and macOS devices from a single, unified dashboard.

Zero Trust Security Approach: Ensure that every connection is authenticated and authorized before access is granted.

Secure Your Entire Workforce – No Matter the Device

The Zenarmor macOS agent is available exclusively for SSE and upper-tier subscriptions, reinforcing our commitment to comprehensive endpoint security. If you’re interested in securing your macOS endpoints, we invite you to start an SSE trial and experience the full capabilities of Zenarmor SASE Anywhere Architecture™.

In addition to supporting macOS, Zenarmor offers comprehensive protection across various platforms, including Windows, Linux, FreeBSD, and OPNsense/pfSense firewalls. Whether your organization utilizes Windows, macOS, or a combination of various platforms, Zenarmor guarantees that your workforce remains safeguarded regardless of the network they are connected to.

With over 20,000 deployments worldwide, Zenarmor safeguards hundreds of thousands of users, delivering innovative and reliable network security solutions. SOC 2 certification further strengthens this mission, providing users with added confidence that their data is managed securely and responsibly.

This milestone comes as Zenarmor prepares to launch its new SASE product, a groundbreaking innovation that extends security to the user endpoint level through our Zenarmor Deploy-Anywhere SASE™ Platform. This transformative method redefines network security by enabling seamless, comprehensive protection wherever your users are. By simplifying deployment and management, our Zenarmor Deploy-Anywhere SASE™ Platform empowers organizations to maintain robust security across diverse environments easily.

SOC 2 certification marks another step in our journey to empower users with world-class security and peace of mind as we continue to innovate and expand.

Are you curious to learn more about our commitment to security and what’s next for Zenarmor?

Read more about Zenarmor’s innovations and roadmap.

This evolving landscape presents a significant opportunity for MSPs and MSSPs. With businesses seeking better ways to protect remote workforces and manage endpoint security, there’s a clear need for solutions beyond traditional approaches. Zenarmor 1.18 offers an industry-first “Plug. SASE. Everywhere.” capability that allows native deployment directly on Windows (and MacOS, which will soon be available) devices.

Not to be mistaken for traditional EDR/XDR or antimalware solutions, Zenarmor can now be installed directly on Windows devices such as laptops and desktops. All of Zenarmor’s protective features and benefits are now available locally directly on the Windows device, eliminating the need to backhaul traffic via a VPN to an onsite Zenarmor gateway for inspection. This effectively secures the network traffic regardless of the user and device location.

In addition to endpoint deployment, Zenarmor 1.18 also includes advanced identity and access management capabilities, allowing seamless integration with popular platforms like Azure Entra ID, Google Workspaces, and Okta. Combined with Zenarmor’s multi-tenant, organization-focused dashboard, managing policies and reporting across multiple clients or environments has never been easier. These features enable granular user and group-based policies, offering unparalleled flexibility and visibility into network activity.

Moreover, Zenarmor’s software-only architecture ensures easy deployment without additional hardware investments. Its ability to inspect network traffic locally provides enhanced security while reducing latency and performance issues often associated with backhauling traffic through VPNs. With features like Full TLS Inspection and Cloud Access Security Broker (CASB) included in its SSE subscription, Zenarmor 1.18 is a comprehensive solution for securing modern, distributed networks.

By integrating Zenarmor at the endpoint level, service providers can address critical client pain points:

• Comprehensive protection for remote devices: Zenarmor eliminates the need to backhaul traffic through VPNs, providing secure, local network traffic inspection without compromising performance or usability.

• Cost-effective deployment: This software-only solution enables providers to serve clients who operate without physical offices or those unwilling to invest in expensive gateway appliances. Enhanced user experience: By removing reliance on traditional VPNs, Zenarmor significantly improves performance and ease of use, ensuring employees remain secure without frustrating delays or interruptions.

• Enhanced user experience: By removing reliance on traditional VPNs, Zenarmor significantly improves performance and ease of use, ensuring employees remain secure without frustrating delays or interruptions.

• Expanded client reach: Businesses previously constrained by traditional security architectures can now adopt Zenarmor’s advanced features, opening up new market segments.

These benefits address pressing cybersecurity challenges and create pathways for MSPs and MSSPs to generate recurring revenue by delivering cutting-edge solutions that clients truly need.

Revenue Opportunities for MSPs and MSSPs

Zenarmor’s new capabilities open doors to multiple revenue streams:

1. Targeting Remote-First and Hybrid Businesses

   Offer a security solution for clients operating without physical offices or those unable to invest in gateway appliances. Zenarmor’s software-only approach is ideal for businesses with fully remote teams.

2. VPN Alternative

   Position Zenarmor as a next-generation alternative to VPNs for secure traffic inspection, especially for clients solely relying on VPNs for security.

3. Centralized Multi-Tenant Dashboard

   Zenarmor’s centralized, multi-tenant dashboard makes managing multiple client organizations easy. Included in the dashboard is the ability to control your clients access based on roles such as administrator, contributors and viewers. Moreover, if your client makes use of an existing identity providers (IdP) such as Google Workspaces, Azure Entra ID or Okta, Zenarmor can easily integrate using the all new Identity & Access Management feature, all from the same central dashboard, allowing you to easily build policies around existing users and groups.

4. Full TLS Inspection and CASB in One Solution

   Zenarmor’s advanced features, including Full TLS Inspection, Cloud Access Security Broker (CASB), and centralized reporting, bring enterprise-grade protection to businesses of all sizes. These capabilities, part of Zenarmor’s cutting-edge SSE subscription, provide unparalleled visibility into encrypted traffic, robust threat prevention, and centralized management.

Start Free Trial

Zenarmor 1.18 combined with a Zenarmor SSE subscription is more than just an update—it’s a shift in how endpoint security is delivered.

As an MSP or MSSP, you can now offer your clients cutting-edge security with unparalleled flexibility, empowering them to secure their endpoints wherever they operate.

If you’re ready to explore how Zenarmor can transform your security offerings and unlock new revenue opportunities, start your free trial of Zenarmor SSE today.

Have questions or need a deeper dive into Zenarmor’s features? Contact our sales team at .

Together, let’s redefine cybersecurity.

Zenarmor SASE 2.2 release changes that.

Zenarmor now installs directly on OpenWRT, the world’s most widely used CPE/router platform, instantly converting existing gateways into fully capable SASE enforcement points.

This is a game-changer for ISPs, MSPs/MSSPs, and any organization with distributed edges.

Why OpenWRT Matters

OpenWRT isn’t just “router firmware.”

It is the de facto operating system running on millions of ISP-provided routers and CPEs across homes, remote offices, and SMB branches.

By running Zenarmor directly on OpenWRT, service providers can now deliver:

• SASE-powered internet protection
• IoT and unmanaged device security
• Branch/home-office visibility
• DNS, TLS, and traffic inspection
• Real-time Zero Trust enforcement

All without shipping new hardware or rerouting traffic to PoPs.

For ISPs: New Revenue, Zero Hardware

ISPs can now offer: “SASE-as-a-service on your existing gateway.”

Key benefits:

• No truck rolls
• No additional appliance
• No bandwidth tax
• No reliance on centralized PoPs

Security happens on the path to the internet, inside the customer’s existing router. This dramatically improves performance, reduces operational overhead, and creates premium service tiers instantly.

For MSPs/MSSPs: True SASE on CPEs You Already Manage

Most MSP networks rely on OpenWRT-based gateways. With Zenarmor on the device:

• You can extend SASE and SSE into any small office or remote location
• You can enforce Zero Trust even when you cannot touch the endpoint
• You can protect IoT and OT networks that cannot run agents

This turns “dumb edge routers” into smart security nodes with no forklift upgrades.

For Enterprises & Mid-Market: Powerful, Agentless Edge Protection

OpenWRT support means:

• Remote sites, contractors, and small branches get full SASE protection
• IoT-heavy environments gain instant inspection and filtering
• Zero Trust policy enforcement happens before traffic ever leaves the site

And because Zenarmor is single-app, single-stack, single-pass, the performance impact is minimal compared to traditional security appliances.

Why This Is Better Than Traditional PoP-Based SASE

Most traditional SASE vendors require:

• Backhauling all traffic
• Sending it through central inspection points
• Paying for bandwidth and compute in the vendor’s cloud

Zenarmor on OpenWRT does the opposite:

• No backhaul
• No cloud dependency
• No PoP bottlenecks
• No degraded UX

Security lives at the edge, not in someone else’s cloud.

OpenWRT + Zenarmor = SASE Everywhere

This integration clearly demonstrates the power of Zenarmor’s SASE Anywhere Architecture™:

One App. One Stack. One Pass.

Every edge becomes a SASE edge.

Whether it is a home user, a micro-branch, a retail location, or a multi-tenant ISP environment, Zenarmor delivers consistent protection without new infrastructure.

Next Steps

Service providers, MSPs, and distributed enterprises can begin deploying Zenarmor on OpenWRT immediately.

Lighthouse opportunities are now available for early implementers.

With the Zenarmor SASE 2.2 release, OpenWRT support turns the world’s most widely deployed router platform into a full SASE edge at scale, bringing true SASE-as-a-service to your existing gateway and removing the need for expensive hardware refreshes.

For details of the release please check the documentation: Zenarmor SASE 2.2 Release

While 40% of Zenarmor’s customers are located in North America, another 40% are located in the EU region.

And to better serve our customers in the EU region, we have recently opened a new office in Frankfurt, Germany!

As Europe continues to lead the way in digital transformation, from smart cities to industrial automation, information security has become a critical concern for businesses and governments alike. Regulations like the General Data Protection Regulation (GDPR) have set a high standard for data protection, making cybersecurity a top priority across the continent. In this dynamic landscape, ensuring the safety of data and network infrastructures is more important than ever.

Zenarmor already protects a wide range of customers across Europe, from French educational institutions to Italian ports, along with many other organizations. Our new Frankfurt office will enable us to accelerate this expansion, meeting the growing demand for omni-present network security anywhere and anytime across the EU region and supporting Europe’s digital transformation.

Zenarmor’s industry-first, unique “Plug. SASE. Everywhere.” technology is designed to meet the needs of today’s agile enterprises, offering advanced threat detection and prevention anywhere and anytime. Whether protecting complex hybrid workforces, cloud environments or securing on-premise networks, our solutions continue to set the standard for network security globally.

With our new office at Meisengasse 13-15, 60313 Frankfurt am Main, we’re excited to be closer than ever to our European customers. This location will allow us to connect and collaborate more closely with partners and businesses across the region, enhancing network defenses and supporting Europe’s journey in cybersecurity innovation.

Stay tuned for more updates as we continue to innovate and grow in Europe and beyond!

To achieve this, Zenarmor 1.18 has become more organization-focused and user-centric with the ability to create central organization-based security policies not just around device categories or networks but also around the users and groups assigned to these devices. To achieve this, we have introduced new Identity & Access Management (I&AM) and Single Sign-On (SSO) capabilities and an all-new organization dashboard giving you complete control and visibility of your gateway and endpoint deployments.

Speaking of endpoint deployments, as of this release, you will now be able to deploy Zenarmor natively on Microsoft Windows devices, affording you additional deployment possibilities. Users can now benefit from Zenarmor’s great protection locally on their Windows endpoint, regardless of which network they are connected to, true on-the-go security without being tethered to a VPN, more to come on this shortly.

So without further ado, let’s jump straight into the details.

All-New Organization Dashboard and Reporting

A truly great SASE product is nothing without a single, fully integrated, and intuitive dashboard. As of Zenarmor 1.18, for all subscribers with an SSE license and above, you will now be able to enroll your organization into Zenconsole to make use of this dashboard. The organization dashboard offers a birds-eye view of your global organization deployment. This dashboard has been designed to give you a high-level overview of your gateway and endpoint deployments, as well as the ability to use it to identify any immediate high-level threats that may be actively impacting a specific gateway, endpoint, or region, allowing you to act quickly to investigate the potential threat further.

In addition to this high-level network visibility, we have further enhanced our built-in reporting functionality to be more user-centric, meaning you will be able to view reports around specific users and user groups and not just devices as seen in previous releases.

Because this release allows for multiple gateway and endpoint deployments within a single organization, we have included a means for all gateways and endpoints, regardless of their location, to stream reporting data back to Zenconsole, where a consolidated organization-wide report is made available, including all the great filtering capabilities you should already be accustomed to, giving you complete visibility of your network and users regardless of how distributed your organization may be.

If you are an MSP/MSSP the new organization dashboard delivers enhanced multi-tenancy capabilities where you can enroll multiple organizations under one account and manage each organization on an individual basis through Zenconsole. You also have the ability to invite administrators from each organization, respectively, and provide them with roles that define the level of control they have over the organization.

Figure 1: Organization selection menu

While we understand that our latest SSE subscription, which includes TLS inspection, CASB, and now our new organization dashboard, may not be for everyone, rest assured that for those on Business, Home, and Free subscriptions, your Zenconsole experience will remain unchanged. We do, however, encourage you to reach out and try our SSE subscription; we have a lot to offer.

Figure 2: The Organization Dashboard

Enhanced Identity & Access Management Capabilities

Exploring the new organization dashboard further, we have included a new settings menu that allows you to not only manage basic organization settings, like users and groups, but also includes our latest Identity & Access Management capabilities. As mentioned before, this release is all about creating security policies around signed-in users and their groups, and to make this possible, we have included the following new authentication methods:

1. Built-In Authentication: This is a basic user/password-based authentication built into Zenconsole and is ideal for smaller organizations that don’t make use of identity providers like Azure Entra ID, Okta, and Google Cloud Identity, etc.

2. Generic SAML 2.0: This is for bigger organizations that make use of Azure Entra ID and other SAML 2.0 capable identity providers. Right now we only support Entra ID, Okta, and Google providers; however, more customizable options will follow in future releases.

3. Google Cloud Identity: For organizations that make use of the Google Workspace ecosystem, Zenarmor 1.18 is fully integrated with Google and allows for not only the authentication of users but also the importing of users and groups into Zenconsole. SCIM and LDAP functionality will be implemented for other providers in a future release.

Using one of the above authentication methods, you can easily enforce network control based on users and groups. As of this release, you can enforce SSO before a user accesses the network either through a browser-based, agentless authentication process initiated by your gateways or if you are using the native Windows Zenarmor application, users will need to sign in to the application before accessing the network.

Both of these enforcement mechanisms can be used simultaneously across endpoints and gateways, giving you the ultimate control over your organization’s users and groups.

Figure 3: Identity & Access Management Settings

Figure 4: Generic SAML 2.0 settings configured using Azure Entra ID as the IdP.

Organization-based policies for Gateways and Endpoints

Now that we have covered the new organization dashboard as well as Zenarmor’s latest user authentication capabilities, it only makes sense to introduce Zenarmor’s latest organization-based policies.

In order to accommodate Zenarmor’s latest Windows endpoint application as well as our user-focused enforcement approach, some slight changes needed to be made to how we create policies in Zenconsole. All policies are now created at an organizational level and not at a gateway level, as seen in previous releases. These organization policies can then be applied to either all gateways or all endpoints, or select gateways or select endpoints, or all gateways and all endpoints combined. That was a mouthful, however, I am sure by now that you can tell you have a lot of flexibility as to how you deploy your policies.

You will also notice in this release some slight UI changes in the policy menu with an added focus on creating policies around users and groups, additional filtering capabilities, etc., however, rest assured all the previous matching criteria are still available.

Figure 5: Organization policy creation menu.

Figure 6: New policy configuration menu.

Deploying Zenarmor on Windows Endpoints

Dashboards, SSO, and policies aside, we have saved the best new capability of this release for last, the all-new Windows native Zenarmor application! We have taken all the greatness of the Zenarmor engine and ported it to run on Windows.

This means that you now have the ability to carry the Zenarmor engine and the great security we offer on your Windows laptop. Regardless of the network you are connected to, you will be secured because the Zenarmor engine performs all inspection locally on the Windows endpoint, which also means you no longer have to backhaul all your traffic via a VPN to have an on-prem Zenarmor gateway inspect your network traffic.

In some cases, you may choose not to deploy Zenarmor on a perimeter gateway considering that all inspection and control is now available on your endpoints, which opens additional deployment options that were never possible with previous releases of Zenarmor.

So you may be asking, How do you control Windows endpoint deployments? All configurations are done via your Zenconsole organization dashboard, and policies are automatically pushed to all targeted endpoints. Reporting data is streamed back from each endpoint to Zenconsole. It’s really as simple as that.

As part of our Plug and Secure approach to SASE and how we intend to secure distributed and remote workforces, Zenarmor’s Window application is a major step forward in bringing the network edge closer than ever before to endpoints without the shortcomings often associated with cloud-only SASE solutions, such as additional latency, PoP outages, and other unnecessary complexities that degrade the overall user experience.

If you are a Mac user and feeling left out, don’t worry, a native Zenarmor application for MacOS is coming soon, we are just ironing out the bugs.

Figure 7: Zenarmor Native Windows Application running on Windows 11 Pro.

Wrapping things up.

We have been working really hard behind the scenes to bring you this latest major release of Zenarmor 1.18, and we truly hope that you enjoy using it as much as we enjoyed creating it. We appreciate every single one of you that have supported us and helped us get to this point in our long development journey.

If you would like to see a full list of all the additions, changes, and bug fixes, please feel free to have a look at our release notes.

We encourage you to follow us on social media and keep an eye on your mail as we have some exciting new additions planned for our next release, including Zero-Trust Network Access (ZTNA) as a VPN replacement and MacOS support, to name a few.

We wish you all the best!

Watch Now

We want to inform you about an upcoming scheduled maintenance for Zenconsole, during which the system will be temporarily unavailable.

Details:

• Date and Time: Wednesday, October 23, 2024 from 9:00 pm to 10:pm PT (00:00 am - 01:00 am ET, 04:00 am - 05:00 am GMT).

• Duration: 1 hour

• Affected Service: Zenconsole Cloud Management Portal

• Reason for Maintenance: Zenconsole v1.18 major upgrade

We appreciate your understanding and patience during this maintenance window and apologize for any inconvenience caused.

Stay tuned for more updates on the exciting new features coming with Zenconsole v1.18!

Even within our home lab tier, it’s not unusual for Zenarmor’s support team to assist a subscriber running a home network setup that rivals enterprise data centers. We’re talking active-active hypervisors, firewalls in high-availability configurations, Active Directory servers, NAS systems—you name it.

Our customers are some of the best in the field, and they demand the best from us.

This is precisely why our customers love Zenarmor’s home subscription. It’s widely regarded as the top solution on the market that delivers enterprise-grade protection, even for home and home lab environments.

However, this also presents us with a unique challenge: how do we continue offering enterprise-level protection at a home-lab price point while ensuring that the home lab tier is used solely for personal, non-commercial purposes?

The Unique Challenge

For the past few years, we have been trying to maintain this “delicate balance”. I can say we have been successful to some extent.

Having said that, listening to some of our customer’s feedback, it became even more apparent that our customers wanted more from the product.

The Homelab Survey: We Hear You—and We’re Taking Action

At Zenarmor, we take great pride in listening to our community. Recently, we conducted a survey among our home subscribers. This wealth of feedback will play a vital role in shaping the future of our home/personal tier; and will ensure that we continue delivering the best possible security experience for your home network.

We’re Grateful to You, Our Community

First and foremost, we want to express our deep gratitude to the hundreds of users who took the time to share their thoughts. Your responses show us that you care deeply about Zenarmor, and it’s heartening to see the strong emotional connection our users have with the product. . This sense of community drives us to improve and deliver an even better Zenarmor for you.

Key Take-aways and What We’re Doing About Them

Performance and User Experience—Overwhelming Satisfaction

We’re absolutely thrilled that 94% of you are satisfied with Zenarmor’s protection and performance, and a similar percentage expressed satisfaction with the overall user experience. While 5% of you reported some performance issues, we deeply appreciate the detailed feedback you’ve shared, and our team is already working to resolve these concerns.

Configurable Policies—Room for Improvement

When we asked, “Are you satisfied with the number of configurable policies available in your Plug and Secure Home. subscription?” The responses were a bit divided: 50% said yes, but a significant 42% expressed desire for more policies. We understand this is an important capability for many of you, as we’ve seen on social media as well. While it’s encouraging that over half of the respondents are content with the current options, we are committed to addressing the requests of those who aren’t. Stay tuned for upcoming changes—we’re on it!

Device Limits—Preparing for IoT Growth

The growing use of IoT devices is becoming a major consideration for many of our users. Currently, 65% of respondents are satisfied with the 100-device limit, but we’re already anticipating the increased demand for more devices, especially as homes become more connected through IoT. Well noted.

More Enterprise Capabilities: Encrypted Threats Prevention, CASB and More!

It’s exciting to see that nearly half of the respondents would like to pay a premium for enterprise capabilities like Full TLS Inspection, CASB and ZTNA.

Many respondents also expressed a strong desire to bring Zenarmor’s Plug. SASE. Everywhere. capabilities to their workplaces—provided they could first test those advanced features in their home lab environments.

This further encourages us to explore ways to be able to do so…

We understand that such capabilities are regarded as a game-changer by many users.

Shaping the Future—Together

We’d like to wrap up by saying that your feedback plays a critical role in shaping the future of Zenarmor’s home subscription service. Rest assured, we are working tirelessly to create an even better Zenarmor for you, focusing on alternative subscription plans and features that align with our commitment to bringing enterprise-level security into your “home datacenters” 😉.

Together, we’re building a stronger, safer, and more connected Zenarmor experience. Thank you for being an essential part of our journey—we can’t wait to share more updates with you soon!

Why? Because when everyone is working from the office, the threat landscape is much more contained and manageable. However, as the workforce becomes increasingly distributed, with employees logging in from various locations and devices, securing the organization becomes a far more complex challenge.

THE SHIFT TO REMOTE WORK

Home office, or working from home, is not a new phenomenon. Even before the pandemic, companies allowed employees to work outside the company premises occasionally. Some personnel chose to continue their tasks from home for various reasons (we won’t judge their work-life balance). Security teams could handle this scenario for several reasons.

Firstly, the extent to which teams used home office was not that high, making it manageable. Measures like Virtual Private Networks (VPNs) were sufficient to ensure that remote connections remained secure. Employees would connect to the company network through VPNs, creating a secure tunnel for their data and maintaining the integrity of the corporate network.

Secondly, it was considered an acceptable risk. The limited time workers spent vulnerable to attacks was manageable. Security teams assessed that the likelihood of a significant breach during these sporadic remote working periods was low. With most employees working from secure office environments, the occasional remote connection posed a relatively low threat.

However, the landscape has drastically changed. The pandemic accelerated the shift towards remote and hybrid working models, making it a permanent fixture in many organizations. Suddenly, a significant portion of the workforce was outside the protective bubble of the corporate network. The traditional security measures which were once sufficient started to show their limitations. According to recent statistics, one in five workers are now working remotely in the US, a figure that has profound implications for work culture, productivity, and of course cybersecurity. This shift is challenging pre-existing norms and opening doors to new and context-aware security strategies.

Looking ahead, the future of remote work seems promising. According to Upwork, by 2025, an estimated 32.6 million Americans will be working remotely, which equates to about 22% of the workforce. This projection suggests a continuous, yet gradual, shift towards remote work arrangements.

THE RISE OF CLOUD COMPUTING

As the increasing trend of remote work presents a significant challenge to conventional firewall solutions, another trend has gone hand in hand with remote working: the rise of cloud computing. With cloud computing, companies have started enjoying the agility and scalability it brings. Traditional firewall appliances, with their limited capacity and lengthy deployment processes, struggle to keep pace with these advancements. Not only has the workforce become decentralized, but so has the data, spreading across various cloud environments globally. Additionally, companies now manage hundreds of networks spread across the world, further complicating security management. Each employee’s home has effectively turned into a company branch, requiring appropriate security measures to ensure the integrity and security of corporate data. This decentralization of both workforce and data underscores the need for a robust and well-functioning Secure Access Service Edge (SASE) solution to protect these distributed assets effectively. As we delve deeper, we will see why conventional SASE solutions often fail to meet these critical needs.

Security vendors recognized the need to address this completely new threat landscape environment. They tried to tackle the emerging problems with the same old solutions. As the saying goes, extraordinary times need extraordinary measures. However, many security companies merely attempted to solve the problem by creating better, faster, and stronger versions of old solutions, which were designed to overcome the security challenges of pre-COVID times. These revamped solutions were improvements, but they still operated on the same fundamental principles that were becoming increasingly obsolete in the face of modern threats and the radically changed work environment. Some companies even went as far as sending home routers to their employees to ensure a sufficient level of security was guaranteed. While these measures provided some immediate relief, they ultimately highlighted the inadequacy of relying on traditional methods to secure a modern, distributed workforce. This approach has proven insufficient for the dynamic and dispersed nature of today’s workforce and data distribution, necessitating a truly innovative shift in security strategy.

THE PROMISE OF SASE

This is where the concept of SASE comes into play. First introduced by Gartner analysts in 2019, SASE represents a transformative shift in network security architecture. Gartner recognized that the growing reliance on cloud services, the increased mobility of users, and the decentralization of data required a new approach—one that could combine networking and security functions into a single, cloud-native service model.

SASE was envisioned to address the complexities of modern IT environments by converging wide area networking (WAN) and network security services, such as secure web gateways, cloud access security brokers (CASB), firewalls, and zero-trust network access (ZTNA), into a unified, flexible, and scalable solution. This convergence allows organizations to deliver secure access to applications and data, regardless of where users, devices, or resources are located.

Gartner’s vision for SASE was driven by the understanding that the traditional perimeter-based security models were no longer sufficient in a world where the perimeter itself had become fluid and boundaryless. By integrating security and networking in the cloud, SASE promises to provide the agility, control, and protection needed in today’s rapidly evolving digital landscape.

THE REALITY OF SASE

As companies rushed to offer SASE solutions following the Gartner report, the mentality behind these offerings largely remained unchanged. Most conventional SASE solutions are simply improved versions of older approaches rather than true innovations.For example, Gartner’s SASE vision proposed increasing the number of Points of Presence (PoPs) to reduce latency and improve network performance. In response, many vendors have implemented this by opening more data centers. However, this isn’t a breakthrough change that addresses the fundamental problems of the new security context. While the increase in PoPs may help to some extent, the underlying issue of latency remains largely unresolved. Despite these efforts, many organizations continue to experience performance bottlenecks, especially when users are far from the nearest PoP. The latency challenge persists, undermining the overall effectiveness of SASE in delivering seamless and responsive network access.

In fact, it introduces its own risks—new data centers can become single points of failure. For instance, in a real-life case, a company receiving security services from a SASE vendor lost internet connectivity when the SASE provider changed the PoP handling their internet traffic. The PoP change resulted in a new IP address, causing all connectivity to be lost for the company. This example highlights the vulnerability and potential disruption that can occur with these conventional SASE implementations. As companies become more dependent on the vendor’s infrastructure, it is likely to cause severe problems that adversely impact business continuity. Such disruptions can lead to significant costs for companies, both in terms of reputation and finances, and may also create legal problems.

FINANCIAL IMPLICATIONS AND HIDDEN CHALLENGES

Furthermore, the cost of implementing SASE solutions can become a substantial issue for companies. Since all internet traffic passes through the vendor’s infrastructure in the cloud, the costs associated with this can be significant. Vendors typically reflect these costs to their customers in two ways: either by directly passing on the costs or by limiting internet bandwidth. The latter is particularly problematic in the digital age, where unrestricted internet access is crucial for business operations. Additionally, as highlighted in the report on egress fees by the Competition and Markets Authority, these costs are exacerbated when transferring data out of cloud environments, making it even more expensive for companies to manage their data and maintain flexibility in their operations. Such limitations not only hinder business efficiency but also raise the risk of incurring high costs related to egress fees, further complicating the financial and operational challenges companies face in this new security landscape.

While the concept of SASE marks a significant step forward, the current implementations often fall short of addressing the complex challenges presented by modern IT environments. The persistence of issues like latency, the risks associated with centralized Points of Presence (PoPs), and the financial burden of cloud-based traffic routing highlight the gaps that still exist. To truly secure the distributed workforce of the future, more innovation and novel approaches are needed. The industry must move beyond simply improving existing solutions and instead, embrace new paradigms that can effectively safeguard data and networks in an increasingly decentralized and dynamic world.

There is still much work to be done, and the journey toward a fully executed SASE vision is only just beginning.

At Zenarmor, we are committed to maintaining transparency and ensuring that our policies reflect the evolving needs of our users and the dynamic landscape of network security.

We’ve made some updates to our Privacy Policy, Website Terms of Use, Terms of Service, and more, designed to clarify our practices.

Here are the highlights:

Company Address: Please note that our company address has been updated. New address is: 10080 N. Wolfe Rd. Ste SW3-200 Cupertino, CA 95014

Domain Names: All domain names associated with our previous names have been replaced by Zenarmor.

Prohibited Conduct: We have also included a clause that prohibits the use of the Website, Platform, or Software for any other purpose than what is described in the product or service description. This includes using a different edition of any of the foregoing that is not included in your service order/description.

Privacy Policy Updates: We have updated our Privacy Policy to include new domains and changes to the third-party processors we use.

These changes are made to ensure the proper use of our services.

Please take a moment to review the updated Privacy Policy, Terms of Service and Terms of use on our website.

• Privacy Policy: https://www.zenarmor.com/legal/privacy-policy
• Terms of Service: https://www.zenarmor.com/legal/terms-of-service
• Terms of Use: https://www.zenarmor.com/legal/terms-of-use

For any questions or further information, please do not hesitate to reach out to us via

Firstly, our Free, Home, SOHO, and Business subscription plans remain as is for the foreseeable future, you will continue to receive regular updates, improvements, and the great security capabilities you have come to know and love from Zenarmor, so rest assured, you are covered.

As for our newly added SSE subscription, it has been part of the Zenarmor roadmap for some time already, where we have strived to bring even more advanced security functionality to our product, like Full TLS Inspection and Cloud Access Security Broker (CASB) capabilities, and as of this release, we have achieved this and is the starting point as we venture more so into the business and enterprise world where Security Service Edge (SSE) and Secure Access Service Edge (SASE) solutions are desired to tackle the security challenges faced by companies with a hyper distributed, remote workforce.

Some have noticed that we have not listed the pricing for our SSE plan, whereas our other plans have pricing listed, the main reason for this is that we would like the opportunity to create a tailormade, personalized solution and experience for our customers, and is a common practice across most providers in the SSE/SASE space. Rest assured, it’s not because pricing is astronomical or complex, in fact, we remain highly competitive in the SSE/SASE marketplace.

Regarding Full TLS Inspection, we acknowledge that this capability has both strong proponents and opponents, and there are definitely pros and cons to using it. The fact of the matter is that Full TLS Inspection is required in order to deliver more advanced security and reporting features like CASB, DLP, Sandboxing, etc which are all common capabilities in all fully-featured SSE/SASE solutions. Furthermore, some industries and educational institutions require Full TLS Inspection to meet compliance requirements.

With Zenarmor we have made TLS Inspection simple to implement and you have the following options:

1. Simply keep it disabled and continue using our current SNI-Based TLS Inspection which does not decrypt the payload, you can still benefit from web and application control and reporting capabilities as enjoyed with your current Zenarmor deployment to date.

2. Enable Full TLS Inspection partially by selecting the categories of traffic or custom web content you wish to inspect while disabling inspection on sensitive traffic like banking or medical-related services.

3. Enable Full TLS Inspection on all categories or for particular device groups or networks/VLANS, with granular controls for exclusions of apps or web content that may have certificate pinning-related issues.

To cater to everyone’s unique needs or stance about TLS Inspection, Zenarmor’s TLS Inspection has been designed to be flexible giving you the option and control over its use on your network. With a proper implementation strategy in place, Full TLS Inspection can help improve your overall security posture by identifying what bad actors are hiding in encrypted packets.

Some closing and final thoughts, Zenarmor as you know it is not going anywhere, we are just getting better. If you are a home user or a business that does not need full TLS Inspection, simply don’t use it, we have plenty of current and future features on our roadmap that you can still enjoy. If you are shopping around for an SSE/SASE solution, give us a try, you will be pleasantly surprised as to what is on offer and is included in our roadmap.

Finally, if you are an IT or Security pro by day and, “homelaber” by night we have created the Zenarmor Tinkerer Club where you can be one of the first to experience the latest Zenarmor has to offer. If you would like to contribute and help shape Zenarmor this club is for you, feel free to sign up today.

Watch Now

Expanding Platform Support

A significant point of discussion has been the adaptability of Zenarmor across various platforms. The inquiry specifically questioned whether Zenarmor’s Zero Trust Network Access (ZTNA) solutions could extend beyond OPNsense to several platforms.

Rest assured, our expansion into new capabilities does not mean leaving our foundational users behind. We continue to support and update our solutions for open-source firewalls, ensuring that your trusted setups remain robust against emerging threats.

Innovation Can’t Stand Still

At Zenarmor, we are proud of our origins as a Next-Generation Firewall (NGFW) plugin for open-source firewalls and deeply understand the importance of continuing to support these platforms. However, in response to the rapidly evolving threat landscape, we recognize that innovation cannot stand still. Constant innovation is in our DNA, it’s essential for staying ahead of threats and ensuring our users’ networks are secure and efficient. Therefore, we are expanding our capabilities to provide our advanced security features instantly on any device with network connectivity.

We are committed to “Plug. SASE. Everywhere.” solutions that extend our reach beyond traditional boundaries. With the recent launch of Zenarmor 1.17 and the integration of new advanced features like Full TLS Inspection, we’re not just maintaining our standards—we’re elevating them. Our mission goes beyond being an NGFW plugin; we aspire to deliver these cutting-edge security solutions on any device with network connectivity. This commitment to innovation is underscored by our focus on enhancing security features that empower organizations to stay ahead in a complex digital landscape.

Looking Forward

The discussion further emphasizes how Zenarmor is enhancing its security offerings to include full visibility and granular access controls, alongside Layer 7 inspection capabilities within a Zero Trust Network. These comprehensive security measures are crucial for organizations navigating the intricate threats in today’s digital environment. By implementing these robust features, Zenarmor will provide detailed insights and control over both public and private network activities without compromising performance.

The enthusiasm from our partners and long time users is a strong indicator of the potential market demand for Zenarmor’s expanded capabilities. As Zenarmor continues to innovate, our core mission remains unchanged: to deliver powerful, flexible, and immediate security solutions that provide for the evolving needs of modern networks. We are excited about the future and invite our community to stay tuned as we roll out these groundbreaking features.

We understand the importance of clear and open communication with our community and appreciate our users who interact with us which helps shape our path forward. We value your feedback as we navigate this path of innovation. Please share your thoughts and let us know how these changes can better serve your security needs.

Thank you for being a part of our journey towards redefining network security.

Full TLS Inspection: Balancing Security and Privacy

Zenarmor 1.17 introduces Full TLS Inspection to enhance security by providing visibility into encrypted traffic, a critical need as cyber threats evolve. This feature effectively uncovers hidden threats, ensuring encrypted data does not become a security blind spot. Understanding the potential legal concerns of decrypting sensitive communications, Zenarmor offers both options. This allows users to exclude specific traffic, such as medical or financial information, ensuring legal compliance and data confidentiality. For more insights on the ethical and legal aspects of TLS inspection, please refer to our detailed blog post on TLS inspection ethics and legality.

Read more: A Guide for a Successful TLS Inspection Deployment

Elasticsearch 8 Support: Optimized for Efficiency

To enhance the way businesses store, search, and analyze their large volumes of data efficiently, Zenarmor 1.17 now supports built-in Elasticsearch 8 in addition to Elasticsearch 5 and remote Elasticsearch 8. This integration means improved scalability and faster search capabilities, allowing for real-time insights that are essential for dynamic threat detection and system management.

ARM 64-bit Support on FreeBSD 13.x: Broadening Horizons

Recognizing the diverse infrastructure needs of modern enterprises, Zenarmor has extended its support to ARM 64-bit architectures on FreeBSD 13.x platforms. This development significantly broadens the scope of deployment options and paves the way for Zenarmor’s features that can now be used across a wider range of devices and environments including Rasberry Pi and Banana Pi.

Below you can find the list of new platforms you can use Zenarmor 1.17:

• ESPRESSObin
• Gem5
• HiKey
• MACCHIATObin
• Allwinner based boards
• Rockchip based boards
• Raspberry Pi 3 + 4 ( RPI3 + RPI4 + RPI400 )

Single Sign-On using Microsoft Accounts: Simplifying Access

Streamlining user authentication across corporate networks, Zenarmor 1.17 introduces Single Sign-On for Microsoft accounts to Zenconsole. This feature simplifies the login process, reduces password fatigue, and enhances the user experience while maintaining high-security standards.

You can read more on 1.17 Release Notes

As we continue to innovate, Zenarmor remains committed to providing cutting-edge solutions that meet the evolving needs of modern IT environments.

Stay tuned for further updates 😉

Watch Now

Before we go any further, let’s start by first addressing the elephant in the room, full TLS inspection, you either love it or you hate it. TLS inspection has been the center of many debates where those who are pro-security argue that without it, you can’t sufficiently secure network traffic because you are blind to the many threats that hide within encrypted traffic, considering that according to Google roughly 96% of traffic is encrypted, leaves a considerable blind spot to worry about.

On the other hand, you get the pro-privacy user who argues that by using TLS inspection their privacy can be violated because full TLS inspection allows for the encrypted payload to be decrypted, inspected, and encrypted again before it is passed upstream, which has very little technical difference to a man-in-the-middle type “attack” a bad actor may attempt to perform.

Both these arguments can be true. With this said, we find ourselves in a catch-22 situation because encryption benefits both the user and the business but at the same time also benefits the bad actors by giving them a place to hide, however, as soon as we implement TLS inspection we can expose the bad actor’s nefarious ways, while at the same time potentially violating the user’s privacy, so where do we begin? How do we reach a compromise?

To address these questions, for the remainder of this article, we are first going to briefly explore TLS inspection, looking at some of the pros and cons. Secondly, we will provide a general overview of how TLS inspection is implemented by Zenarmor and provide some steps to get you started with TLS Inspection. Finally, we will discuss some TLS Inspection caveats that you may encounter and how to overcome them.

We are hoping that by the end of this read, you will have all the necessary information you need to make confident decisions as to how you will implement Zenarmor’s latest TLS inspection capabilities in your network.

What is full TLS inspection and the pros and cons?

Let’s start at the beginning, what is TLS inspection in the Zenarmor product ecosystem? If you are familiar with the previous versions of Zenarmor it won’t be the first time that you would have seen us mention TLS inspection in our products or marketing materials. Up until now, the TLS inspection we offered was only Certificate/SNI-based TLS inspection, where Zenarmor inspects the SNI (Server Name Indication) information located in the TLS certificate which is in clear text, and through this, we can determine the hostname of the service the user is attempting to access.

Combining this with other information like port numbers, DNS enrichment, IP addresses, etc, we can categorize the application or services with a high degree of accuracy. SNI-based TLS inspection, unlike full TLS inspection, does not decrypt the encrypted payload, so private information remains intact. For the remainder of this article, let’s call the current SNI-based TLS inspection “lite” TLS inspection moving forward.

If we consider the new enterprise-focused Full TLS Inspection capabilities of Zenarmor, this takes TLS inspection even further where we cannot only categorize the application or service with greater accuracy but also inspect the encrypted payload for any nasty things a bad actor may be hiding there.

A very simple explanation as to how Zenarmor achieves this is that Zenarmor acts as an intermediary between the client endpoint and the web server, basically as the trusted “man-in-the-middle.”

1. The client endpoint initiates a connection request which is intercepted by Zenarmor.
2. Zenarmor then forwards the request to the original web server or resource that the client endpoint is requesting.
3. The server responds with its certificate to Zenarmor and a secure connection is formed.
4. Zenarmor then inspects the payload and re-encrypts the content with a certificate that is signed by Zenarmor.
5. Zenarmor then responds to the client endpoint with the original request.

In a nutshell, two TLS negotiations are taking place here, one between the client endpoint and Zenarmor, and another between Zenarmor and the web server resource. Zenarmor is then able to decrypt the payload, inspect it, and then re-encrypt it before passing it to the client endpoint.

For this to work correctly the client endpoint needs to trust Zenarmor and this is achieved by installing the Zenarmor trusted root CA certificate on the endpoint.

While “lite” TLS inspection is powerful and may be all that you require to satisfy your unique security requirements, full TLS inspection, gives you extra visibility into your network traffic which can take your network security to a whole new level.

Some pros of full TLS inspection are:

1. Full visibility of your network traffic even if it’s encrypted, which is a requirement for more advanced security functions such as:

   • Cloud Access Security Broker (CASB) offering granular control of cloud applications where you can limit actions like uploads or downloads, changing settings, and almost every aspect of the cloud app.

   • Data Loss Prevention (DLP) to prevent sensitive or private data from leaving your network through unsanctioned uploads to cloud apps like Dropbox or via standard email or IM messages.

   • Preventing users from using their work credentials to sign up with unsanctioned services or apps.

   • Remote Browser Isolation (RBI) and Sandboxing where webpages can be rendered on the firewall or files can be opened in an isolated secure sandbox drastically reducing the possibility of infecting the endpoint from embedded threats.

   • In-stream Antivirus, Malware, Phishing, Ransomware, and Spyware scanning capabilities.

2. Finally, the ability to meet certain compliance requirements that some enterprises, industries, or educational institutions are required to uphold.

These advanced security functions would otherwise not be possible without full TLS Inspection. Without implementing full TLS inspection you are potentially opening a large gap in your overall security posture which is easily pluggable with Zenarmor.

To remain transparent and to empathize with all our users, we acknowledge that full TLS inspection is not for everyone and comes with its own risks and challenges:

1. If used incorrectly, has the potential to violate user privacy and is likely the biggest challenge of full TLS inspection.

2. Potential performance drawbacks due to the decryption and re-encryption process as described earlier in the article.

3. Potential legal issues depending on the country or region you are located in.

4. The potential to cause some applications or websites to function incorrectly, mainly due to certificate pinning issues.

So now that you have a better understanding of the two types of TLS inspection functionality available with Zenarmor, the next step is to talk about how Zenarmor can be used in a flexible way to improve your overall security posture.

A general overview of the full TLS inspection capabilities in Zenarmor

The Full TLS inspection capabilities will be available to everyone with a Zanarmor SSE subscription. If you are an existing, qualified business subscription user, you can upgrade to SSE free of charge for a limited time, so be sure to check your mail explaining the process, or alternatively, contact our sales team for more information.

With licensing out the way, in your Zenarmor policies menu, for each policy, you will see the new “TLS Controls” option. This is where you will apply TLS Inspection on a policy-by-policy basis. Please note that this is the first iteration of TLS Inspection that has been made publicly available, so keep a lookout for further improvements and additional features in the coming months.

Figure 2: The default policy menu showing the usual Zenarmor controls, with the edition of the “TLS Controls”

While some of the options in the TLS Controls menu are self-explanatory, some may not be as straightforward, so let’s look at what each new TLS option does referring to Figure 2 above:

1. The first toggle, “Enable full TLS inspection” is one of those self-explanatory options. This simply enables full TLS inspection for the policy. Keep in mind, that Zenarmor offers an easy and flexible way to create and manage policies, and the same applies to full TLS inspection where you can choose exactly which devices, device categories, VLAN, networks, users, or groups you want to apply TLS Inspection for and exclude others should you wish.

2. The second toggle allows for the exclusion of whitelisted websites or apps, including those with pinned certificates which are known to prevent full TLS encryption from functioning correctly. Here you can create your whitelist or add to the database of already defined apps with known pinned certificates, giving you complete control over the exclusion of web URLs and apps you don’t wish to apply full TLS inspection to.

   

   Figure 3: Menu to manage pinned sites and application exclusions.

3. The fourth toggle as stated, allows you to exclude traffic flows without hostnames, so pure IP address traffic only will be excluded from TLS Inspection and is once again optional.

4. The final toggles available in the menu allow you to either apply TLS inspection to all web traffic or select the category of web traffic you are interested in.

Another new addition in this release of Zenarmor is URL Blocking which works hand in hand with TLS inspection and is located under the “Web Controls” menu in your policies. This new functionality allows you to block URLs at a more granular level with the ability to use (*) wildcard options in your URL to target specific subdomains or paths globally.

Figure 4: URL Blocking option located in the Web Controls section of the policy

In addition to the policies menu changes, you will also notice that TLS Inspection has been included in the Zenarmor Settings Menu giving you an alternative place to manage your TLS Inspection Bypass settings for Website and Applications. You will also have the option here to manage and set Zenarmor Certificate Authority settings. You can also download your Root CA certificate here in the preferred format which will need to be installed on your endpoints for full TLS Inspection to work correctly.

You also have the ability to import an intermediate CA certificate if you have already installed a certificate authority in your organization that is trusted by your endpoints.

Figure 5: TLS Settings menu located in the general Zenarmor settings menu

Figure 6: Certificate Authority menu allowing you to manage and download your Root CA certificate required for TLS Inspection.

How to get started with Zenarmor TLS inspection

Now that you have a better understanding of what the new TLS Inspection capabilities look like in Zenarmor, let’s talk about a high-level overview of how to get started with your implementation.

Overcoming the privacy and legal issues

The first step to deploying TLS inspection should be to overcome any privacy or legal issues in your organization. It may make sense at this point to start involving people from the legal department, people responsible for privacy and compliance, the security department as well as any workers’ union representatives if applicable.

The key to this first step is to create full transparency between everyone involved in the organization and to make sure everyone’s concerns are addressed. At this stage, you may also need to review any fair usage or privacy policies your organization may have as they will likely need to be updated to reflect the implementation of TLS inspection.

It may also be advisable to hold staff or user training sessions to explain exactly what TLS Inspection is, how it will be implemented, and what they as users can expect from using this technology to secure the organization’s networks.

Root Certificate Deployment

The second major step is making sure that Zenarmor is set up as a trusted root certificate authority (CA) on any endpoints that will be secured by TLS inspection to avoid any connection or certificate warning messages in the browser.

For smaller deployments, this may be as simple as distributing the certificate generated by Zenarmor to all endpoints. For larger deployments, on the other hand, you may already have your own certificate authority setup with your endpoints preloaded with your root CA certificate. In this case, you may want to create an intermediate CA certificate and import this to Zenarmor instead. The choice is ultimately yours.

Enabling TLS Inspection

Enabling TLS Inspection is best done in a phased or controlled manner. It’s best to establish a pilot group of users or devices other than those operated by IT or security teams as usually, these users will have the means to work around issues and fail to report them successfully. Their work environment may also differ from that of general users in the organization, which may interfere with the accuracy of initial testing. Communication and reporting of issues are important in the early stages of your implementation to ensure that the initial bugs are ironed out before the implementation is made available company-wide.

It’s best that you select your pilot group from a closed set of users, preferably with a diverse set of applications or devices in use so that you can thoroughly test if TLS inspection is functioning correctly. It’s important to once again communicate with this user group and encourage them to report any issues they are experiencing so that they can be investigated thoroughly before TLS bypassing is put in place as a last resort.

If a phased approach like this is followed potential interruptions can be controlled and minimized should they arise. It is generally encouraged that TLS inspection is applied network-wide where possible to ensure your organization benefits the most from its additional security.

For more information on this be sure to have a look at our TLS Inspection Implementation Guide.

TLS Inspection caveats and how to handle them

TLS Inspection unfortunately comes with a few caveats and other considerations that are important to understand. Not all traffic can be inspected which mainly has to do with the following reasons:

1. Certificate Pinning - mainly used by applications and some websites to force the client to use a pre-defined certificate built into the application which will reject all other certificates. This was created to prevent man-in-the-middle attacks and because TLS inspection follows a similar process these applications won’t function correctly. The choices you have here are to bypass these applications from TLS Inspection only under extreme circumstances or apply Zenarmor ‘lite” TLS encryption, or if you need Full TLS inspection, find an alternative application that does not use certificate pinning. The industry has moved in some cases to deprecate certificate pinning due to these and other issues and is important to understand when enabling TLS Inspection as this is most likely the biggest issue you will face.

2. QUIC Transport Protocol - Google and other popular application developers have started to use the QUIC protocol which is mainly used to improve speed and accomplishes this by skipping the TCP handshake by using UDP instead. Because TLS is TCP-based and is relied on for TLS Inspection, It is advised that when using TLS Inspection you block the QUIC protocol on your network. If QUIC is blocked, the services will fall back to TCP/TLS which can be inspected and secured. If you favor security over minimal speed improvements, this is an important consideration.

3. Special Circumstances - in some cases, for legal reasons, you may not be able to apply TLS inspection on banking, financial, healthcare, or other sensitive applications or content that could open your organization to security threats. In these special circumstances you may not have any choice but to bypass TLS inspection or you may also choose to potentially block all applications and content like this from the network depending on its importance to your daily operations and your overall stance on security.

When dealing with TLS Inspection and its caveats, it’s important to weigh up the security risks, pros, and cons on a case-by-case basis to determine whether bypassing TLS inspection is justified or if an alternative more secure approach can be followed.

Figure 7: Best Practices for Zenarmor TLS Inspection

Next Steps…

You should now have a pretty good understanding of TLS Inspection and how it’s implemented in Zenarmor 1.17 as well as its caveats. It’s now time to start your TLS Inspection journey.

If you are an existing partner or business user with an annual business license, you can take advantage of a free-of-charge upgrade to our new Secure Service Edge (SSE) subscription by reaching out to your account manager or our sales team before July 17 2024 to initiate the upgrade. Please note that this process is not automatic and you will need to reach out to us to communicate your interest.

We look forward to hearing from you and are ready to introduce you to a world of advanced cyber security, let us help you get started with your Secure Service Edge (SSE) journey today.

Watch Now

The agenda for the webinar was clearly outlined, indicating a duration of approximately 35 to 45 minutes, followed by a Q&A session. It covered high-level introductions to OPNsense and Zenarmor, discussing their origins, hardware options, flexibility, and extensibility. Additionally, the agenda included topics such as reporting and monitoring, remote work, VPNs, advanced protection, and central management for both products.

Key takeaways from the discussion about OPNsense and Zenarmor included:

• Introduction to OPNsense: Schellevis introduced OPNsense as an open-source firewall solution founded in 2014, emphasizing its transparent development process, large user base, and frequent releases with new features and security patches.

• Enterprise Features: The presenters elaborated on OPNsense’s enterprise-grade features, including routing, firewall rules, VPN technologies, traffic shaping, and intrusion detection/prevention.

• Flexibility & Extensibility: Schellevis discussed how OPNsense offers flexibility and extensibility through community-developed plugins, citing examples like WireGuard integration and support for third-party solutions like Zenarmor.

• Compatibility & Hardware Options: It was mentioned that OPNsense runs on x86 hardware and supports various virtualization platforms, offering its own hardware appliances tailored for firewall use.

• Reporting & Monitoring: Schellevis detailed OPNsense’s comprehensive tools for network diagnostics, traffic analysis, and real-time monitoring, allowing users to track network issues, bandwidth usage, and security events.

• Advanced Protection: The presenters described how OPNsense provides advanced protection using Suricata with various rule sets and how Zenarmor enhances security with advanced threat intelligence. Remote Work (VPN): Schellevis covered OPNsense’s support for various VPN technologies for remote work scenarios and discussed how Zenarmor complements this by providing traffic monitoring and control for remote users.

• Central Management: The presenters discussed OPNsense Business Edition’s OPN Central for centralized firewall management and mentioned Zenarmor’s Zenconsole for cloud-based management.

Insights from the Q&A session highlighted:

• Strategic Deployment of Security Tools: Participants explored the optimal placement of tools like Suricata and Zenarmor within network infrastructure, emphasizing flexibility.

• Transitioning to Business Editions: Discussions centered around migrating from community versions to business editions of security software, with considerations provided on managing version disparities and leveraging the latest features.

• Empowering Learning: Attendees were encouraged to explore various learning resources, including YouTube tutorials and free trial options, to deepen their understanding of OPNsense and Zenarmor functionalities.

• Future Roadmap and Enhancements: Participants gained insights into upcoming features and enhancements, underscoring the commitment to continuous improvement.

• Support and Collaboration: The importance of robust support channels and collaboration opportunities was emphasized for nurturing a vibrant security community.

Overall, the webinar provided valuable insights into network security integration, offering perspectives on fortifying security posture in an evolving digital landscape.

Watch Now

As a business, you must strike a balance between leveraging the power of the cloud and protecting your data and resources from cyber threats. This is where CASB for businesses can help.

Cloud Access Security Broker (CASB) is a practical solution to protect your business from cloud-based threats, as it sits between the cloud users and the applications they access.

Read on to learn how CASB can safeguard your applications and data from cyberattacks and breaches, and discover Zenarmor’s CASB integration coming soon.

Shadow IT and Data on the Loose

Shadow IT is any application or resource used by an employee without the explicit approval or knowledge of the IT department. The hidden danger is that the IT department doesn’t know about these applications and, hence, doesn’t monitor them for security risks. As a result, shadow apps can be exploited by hackers to steal sensitive company data. Moreover, they can steal the credentials used in this application to access other critical applications like customer databases. It is estimated that 76% of SMBs found a moderate to severe cybersecurity threat to their business due to the presence of shadow IT.

Data Slips Through the Cracks: Accidental Leaks and Insider Risks

Besides the security risks, shadow IT can allow data to slip through the cracks. Accidental data leaks happen when employees unknowingly expose sensitive information, to any of the cloud services. Additionally, insider risks can arise from intentional or accidental security missteps by your employees. These human errors are impactful and make it challenging for businesses to maintain control over the use of data and applications.

CASB Brings Order to Chaos: See What’s Happening, Control Access, and Protect Your Data

Large organizations use a wide variety of tools to address the issues that come with shadow IT. However, as a business, it’s difficult to monitor and prevent the use of shadow IT, given your limited resources. CASB brings order to this chaos by continuously monitoring your cloud activities. It provides visibility into employee activities and allows you to enforce security policies uniformly. More importantly, CASB protects your data from unauthorized access.

More Than Just Data Breaches

A report by Thales Group shows that 39% of small businesses have experienced a data breach in their cloud environment, with human error accounting for more than 55% of these data breaches. The causes of some of these security issues are:

• Data breaches often occur when employees unknowingly open a phishing email or other malicious content on the Internet.
• A related attack is account hijacking, where a cybercriminal steals an employee’s credentials through phishing or brute-force methods and uses them to access your organization’s sensitive information.
• Insider attacks can occur due to intentional or accidental security missteps by employees.
• Insecure APIs allow hackers to access an organization’s cloud data and applications.

It is hard for businesses to stay on top of every employee’s actions, and this is where CASB security for businesses can be a game-changer.

A CASB solution can monitor all the cloud applications and services to help you identify and stop threats quickly. It can detect unusual behavior and identify ransomware attacks before they impact your business. Some CASB platforms can even automatically remediate impending attacks by blocking unauthorized access.

Overall, CASB watches for trouble online, detects threats, fights back, and keeps you safe.

Keeping Up with the Rules

Complying with the ever-changing regulations is one of the biggest operational challenges for businesses. With few resources and employees, it’s hard to continuously stay on top of regulatory changes and adapt your operations to meet them. This is where CASB for businesses can help.

Automated Reports, Easier Audits, and Less Risk of Fines

CASB generates automated reports that contain detailed information about the compliance status of all your cloud applications and services. Based on this report, you can review the apps and address the existing gaps, if any. Undoubtedly, your audit process becomes easier, and you have complete control and visibility into the status of your cloud apps.

More importantly, CASB allows you to check if your security policies align with your country’s and industry’s regulations. Such a proactive approach ensures that there’s no compliance blindspot and reduces the risk of costly fines that can be imposed due to non-compliance.

CASB Makes Life Easier

Businesses face many challenges while navigating cloud security. CASB can be a tool for simplifying this monitoring process while enhancing the effectiveness of your security strategies.

One Tool to Rule Them All: Manage cloud security in one place

CASB consolidates multiple security aspects like authentication, tokenization, logging, sending notifications, malware and ransomware detection, authorization, and more. With such wide-ranging capabilities, you can manage cloud security in one place.

Saves You Money: No Need to Buy Lots of Different Tools

Since CASB combines so many capabilities, you don’t have to invest in multiple tools. This cost-effective approach helps businesses, often operating with limited budgets, efficiently manage cloud security without the financial strain of acquiring and maintaining various tools.

Get Smarter About Your Cloud Use: Learn how to use the cloud better

With the right CASB for businesses, you can better understand what’s happening with your cloud applications and get smarter about your cloud usage. Furthermore, you can optimize and secure your cloud resources for the best outcomes.

Zenarmor’s Cloud Game Strong: CASB Capabilities Coming Soon

The CASB feature, which will be available to businesses with the 1.17.2 release of Zenarmor, is about to change the game when it comes to cloud security. As businesses increasingly rely on cloud services, Zenarmor takes a proactive stance that can help businesses make the most of all that the cloud has to offer without worrying about the associated security issues.

With this CASB integration, Zenarmor positions itself as a reliable ally for businesses looking to balance cloud accessibility and security. Recognizing the hurdles that businesses encounter in navigating the complexities of the cloud, Zenarmor extends its security reach by employing CASB. This proactive approach reflects the company’s readiness to tackle specific security concerns associated with cloud usage. More importantly, it reflects the company’s commitment to creating an enhanced and secure digital experience for all business owners and employees. With Zenarmor, businesses can securely and confidently embrace cloud apps.

This move not only protects business interests on the cloud but also enables businesses to fully leverage the benefits offered by the cloud for their operations. As Zenarmor integrates CASB, it is a transformative solution that not only enhances security but also empowers businesses to thrive in the dynamic digital landscape, making it a must-have tool for every business owner.

Watch Now

Some of the immediate benefits you will receive by using Device ID and Access Control are:

• Enhanced network visibility - Devices are now tracked in real-time as they connect to your network, which means you can easily, “weed out” the potentially risky untrusted, or rouge devices in between the trusted devices on your network.

• Policy Enforcement & Access Control - Taking things a step further, you will not only be able to identify the devices, but also through Zenarmor policies, be able to control their access to your network resources which we will discuss in more detail in this article.

If you would like a more in-depth read about Zenarmors Device ID capabilities and a breakdown of additional benefits, please check out a previous article titled, “The Core of Network Security: Device Identification Defined”.

As promised in the title, the remainder of this article is a practical guide and we will be showcasing how Zenarmor Device ID and Access Control can be used to secure your network.

So without further ado, let’s get started.

The Devices Dashboard - A Quick Walkthrough

If you are on one of the Zenarmor paid subscription plans, the Devices menu option will be hard to miss. By simply clicking on it, the device management dashboard will be displayed which is designed to be intuitive. At first glance, the dashboard is broken down as follows:

Figure 1: The Zenarmor Device Identification dashboard

1. The Devices menu option is visible to all Zenarmor paid subscribers.
2. Device Categories - A convenient way to sort through devices by type and their status.
3. Device List - All the detected devices on your network will be listed here when they are discovered in real time. These can be arranged in a list or tiled view with various filtering options to suit your needs.
4. Device details menu - Here you can see detailed information about the device you selected with the option to rename and recategorize it to your choosing. In this menu, you also can “star” the device as a favorite, “hide” it, and select if it’s “trusted” or “untrusted”.

All devices identified by Zenarmor will by default be untrusted until such a time you choose to trust the device. This default behavior is useful when using the Zenarmor policies to enforce device network access.

Policy Enforcement and Access Control

Building on this default behavior, one of the simplest ways you can start enforcing device access to your network is by using the built-in Zenarmor default policy and simply enabling the “Block Untrusted Devices” option. By doing this, any new device that joins the network will immediately have all its traffic blocked until such a time you decide to trust it.

This offers some immediate security benefits, let’s picture the following scenario, an employee brings their personal laptop or device to work and connects it to the corporate network without notifying IT about it, perhaps they figured out the Wifi password or plugged into an open LAN port in the office that someone in IT forgot to disable. Without Zenarmor access control policies in place, this device could have full internet and network access which could lead to productivity issues or worse, if that device has unknown malware “calling home” it could open a door for a potential bad actor to access the corporate network.

Figure 2: Zenarmor default policy to block all untrusted devices by default.

Stepping this up a gear, policy enforcement, and access control does not end here. Zenarmor also has the ability to create individual policies around certain devices or categories of your choosing.

To put it into a practical scenario let’s say you want to control all the mobile devices on your network blocking certain applications they are allowed access to. This is very simple to achieve with Zenarmor, you will simply need to create a “Mobile Device Policy” and under the criteria add the individual device or device category as depicted in the image below.

Figure 3: Creating a policy defined around device categories or individual devices.

Once this has been done, you can simply add other security, app, and web controls to this policy, the choice is yours. Like in most firewalls, policies are processed from top to bottom, and this is exactly the case in Zenarmor. Remember to place your policies in the stack in the correct order to be matched correctly.

Creating policies around devices and categories is as simple as that, however, this is not the only place where device identification is useful in Zenarmor.

Live Session and Reporting enhancements leveraging Zenarmor Device Identification

Device integration functionality has also been carried through into the Zenarmor Live Session and Reporting dashboards and at a glance you can easily identify the traffic for each device or category in near real-time. In addition to this, you can also easily filter by devices or device categories giving you ultimate visibility of your network traffic.

Figure 4: Live Session view showing device and device category columns with the ability to filter on these devices or respective categories.

If we head over to the Reports dashboard, you will notice that device identification has also been integrated into this dashboard. Here you can easily view Top devices and their respective device categories talking over your network. Filtering options have also been included here to help you easily drill down on individual devices giving you complete and granular information about which applications and websites they are accessing via your network.

Figure 5: Reporting dashboard showing top devices and device categories with controls to filter each respectively giving you ultimate network visibility.

So to wrap things up, we encourage you to get creative and start building your own policies around the devices attached to your network. Not only is this capability powerful it’s also easy to implement. If you are a freemium user or new to our community and would like to explore Zenarmor device identification as well as all the other amazing security capabilities on offer, we highly encourage you to try it on a free 15-day business edition trial that includes all this great functionality.

Alternatively, feel free to contact Zenamor at and ask for assistance getting your free trial set up and started today. We’d love to hear from you!

Watch Now

Figure 1. Block Bypass Codes on Zenarmor

Flexible Secure Access Solution: Bypass Codes

Security policies and tools can interfere with the productivity and convenience of users, who may need to access legitimate websites and resources that are blocked by default. How can organizations balance security and productivity without compromising either one? One strategic solution is to use bypass codes, temporary or permanent passcodes that can be entered on a blocked landing page to access the website.

Bypass codes offer several benefits, such as:

a. Reduced Helpdesk Burden

Bypass codes offer a major perk by easing the load on helpdesk support. Typically, when users hit blocked sites, they contact the help desk for access or report false positives. This flood of inquiries can backlog tickets, wasting precious time and resources. Enter bypass codes—they put the power in users’ hands, allowing them to self-service access by inputting a code on the blocked page, granting instant entry. This solution is a win-win, slashing time and hassle for users and helpdesk teams. It improves efficiency across the organization, freeing up valuable resources for more critical tasks.

b. Enhanced Control

Bypass codes have an added advantage: they grant administrators precise control over access. These codes allow admins to craft and allocate them to particular users, policies, or domains, tailoring their duration and reach. For example, a permanent bypass code for a trusted site that’s typically blocked or a temporary one for a potentially risky site ensures a one-time entry. Furthermore, admins can revoke or modify these codes anytime and track their usage and behavior. This level of control empowers administrators to fine-tune security measures, adjusting access flexibly yet securely. Essentially, bypass codes offer a dynamic tool for administrators to manage access intricately, enhancing the overall security posture of the system.

c. Improved User Experience

Bypass codes offer a significant plus: they enhance the user experience. Getting stopped by blocked sites is a major annoyance for users, especially when they need access for work or personal tasks. With bypass codes, users gain a bit of control—they can sidestep security measures when needed. It’s about allowing them to reach essential websites without sacrificing security or work efficiency. This autonomy provided by bypass codes goes a long way in boosting user satisfaction and involvement. Moreover, it cultivates a culture of trust and responsibility within the organization. By empowering users to navigate security barriers when warranted, bypass codes ultimately contribute to a smoother user experience.

d. Prevention of Unauthorized Access

A significant benefit of bypass codes lies in their ability to protect against unauthorized access. These codes are fortified with superior encryption and authentication mechanisms, ensuring they are used exclusively by the people they are intended for. Administrators have the capability to impose expiration deadlines or usage constraints on these codes, creating a robust two-tiered defense system. Such measures ensure that access to restricted areas is closely monitored and controlled, preventing unapproved entry. By leveraging bypass codes, organizations fortify their security and compliance measures, erecting a robust defense against cyber threats and potential data breaches. Ultimately, these codes act as a shield, ensuring that access to sensitive or blocked content remains strictly controlled and safeguarded from unauthorized entry, bolstering the organization’s overall security posture.

Figure 2. Using Block Bypass Code for Accessing a Website

The Intersection: Using Whitelists and Bypass Codes Together

Whitelists and bypass codes serve as a dynamic duo in access control, each playing a crucial role. Whitelists are like exclusive VIP lists, granting automatic access to predetermined websites. Bypass codes, on the other hand, are akin to secret keys that open doors to otherwise blocked sites. Together, they create a flexible and secure access framework tailored to meet the specific needs of an organization. Their adaptability is a key feature, enabling organizations to modify these tools in response to changing scenarios and preferences, seamlessly blending security with productivity. By leveraging both, organizations create a seamless approach that doesn’t compromise. They can confidently navigate the delicate balance between robust security measures and enabling smooth, efficient work processes. The flexibility to adjust these tools according to evolving demands ensures that organizations stay ahead, securing their networks while facilitating the necessary access for productivity. Essentially, it’s a strategic dance between the trusted and the unlockable, ensuring a harmonious blend that benefits both security and productivity.

Types of Bypass Codes: Admin vs. User

Zenarmor introduces a flexible approach to website access within secure networks through its implementation of bypass codes by providing these codes in two distinct role-based forms: admin and user. Bypass codes work like special keys, granting entry to websites that are usually off-limits. Zenarmor has two types of bypass codes: admin and user. Admin bypass codes, managed by administrators, permanently whitelist a website for all network users and devices. They’re perfect for widely used, trusted sites that admins give the green light. On the flip side, user bypass codes are like limited-time passes, also set up by admins, but they temporarily unlock a website just for the specific device using the code. These are used for rare, individual site visits, especially for potentially risky or unverified sites. Mixing these admin and user codes gives organizations a precise, adaptable way to control who can access what, flexibly catering to security and productivity needs.

Managing Bypass Codes: A Simple and Efficient Process

Managing bypass codes is straightforward and efficient, done either manually or programmatically. Admins can manually create, modify, or remove bypass codes via the Zenarmor Settings page interface. They’re in control, able to tailor codes for specific users, policies, and domains, setting expiry dates and usage limits as needed. They can also closely monitor usage and activity for monitoring and auditing purposes. Bypass codes offer a secure and adaptable method for access control, striking the right balance between security and productivity.

Figure 3. Using Block Bypass Code for Accessing a Website

Zenarmor: Empowering Users, Enhancing Security

This article has explored the functionalities of Zenarmor, a software-based firewall solution, and its integrated feature of bypass codes. Zenarmor provides robust network protection, catering to enterprise-level security needs. The addition of bypass codes within this system allows for controlled access to otherwise restricted websites, striking a balance between maintaining security and facilitating productivity.

Watch Now

Discover the power of proactive cybersecurity with Zenarmor. Visit our extensive library of cybersecurity concepts to learn more about how we can protect your network with purpose-driven security solutions.

What is Cyber Threat Intelligence (CTI)?

Cyber Threat Intelligence (CTI) assists companies in staying updated about emerging threats to defend themselves. Threat intelligence can be defined as cyber security specialists compiling, evaluating, and improving the information they collect about attacks to learn from it and better defend enterprises. The types of threat intelligence are defined by sources, which can be put into three categories: open source, closed source, and internal source. Each source has its strengths and weaknesses, and you need to take advantage of them to gain a complete picture. CTI aids in lowering costs, maximizing efficiency, preventing financial loss, and lowering risk. Your security stance, resilience, and preparedness against cyberattacks may all be improved with CTI. It is an essential tool for every business that prioritizes security rather than considering it an optional addition.

Zenarmor Cyber Threat Intelligence

Zenarmor CTI, utilizing AI-based threat intelligence from Zenarmor’s Cloud Threat Intelligence System, safeguards networks against threats from over 300 million websites. Business Edition subscribers get access to BrightCloud Threat Intelligence, offering advanced protection with an additional 1+ billion domains and 4+ billion IP addresses. BrightCloud, a leading cybersecurity provider, evaluates over 48 billion domains, providing high-quality threat intelligence daily. This collaboration involves a global network of 140+ cybersecurity vendors using BrightCloud Threat Intelligence.

Zenarmor’s Cloud Threat Intelligence (CTI) is a key component of its security features and web categorization capabilities. It continuously updates and categorizes over 300 million websites (for the business edition 1B website), safeguarding networks against a wide range of threats. This AI-based classification system automatically identifies and inhibits new and sophisticated threats, enhancing network security by preventing emerging outbreaks and mitigating the most recent and dangerous security threats effectively. Zenarmor’s Advanced Security profiles, available through Zenarmor Premium Subscriptions, provide Advanced Threat Protection against the latest malware, viruses, and phishing attacks by blocking websites known to host such threats.

Bright Cloud Threat Intelligence: An Overview

In cybersecurity, having a trustworthy ally for top-notch threat intelligence (TI) solutions is crucial. That’s where Bright Cloud steps in. They’re a leading threat intelligence and cyber security provider dedicated to safeguarding your network, data, and reputation from cyber risks.

Zenarmor CTI uses BrightCloud® at the backend. Zenarmor Business Edition provides users with enhanced protection, including an additional 1+ billion categorized domains and 4+ billion recorded IPv4/6 addresses. In addition, Business Edition users gain access to a global threat intelligence network comprised of over 140 leading cyber security vendors utilizing BrightCloud® Threat Intelligence to enhance and expand their threat detection solutions. Therefore, you can breathe easy knowing that you have access to the highest quality threat intelligence available. BrightCloud® has evaluated more than 48 billion domains to date and adds to this database daily by analyzing approximately 25,000 threats and URLs.

Bright Cloud follows a robust approach to TI, focusing on four key aspects: collecting, analyzing, sharing, and using information. They gather TI data from diverse sources—open, closed, and internal—and then use advanced algorithms and machine learning to offer precise, timely, and pertinent insights into potential hazards. Bright Cloud shares this valuable TI data with you across multiple feeds like IP reputation, URL reputation, file reputation, and mobile reputation. Finally, they apply this intelligence to fortify your security infrastructure, bolstering your hazard detection and prevention capabilities.

The Convergence of Zenarmor and Cyber Threat Intelligence

Zenarmor integrates with Bright Cloud threat intelligence (TI) feeds to enhance its threat detection and prevention capabilities. The integration with Bright Cloud, a leading TI provider, empowers Zenarmor users with enhanced protection, including access to a global threat intelligence network comprised of over 140 cybersecurity vendors.

By utilizing TI data from these integrated feeds, Zenarmor significantly strengthens its cybersecurity posture. The TI data is used to provide real-time security threat intelligence, website categorization, and site reputation and ranking. This empowers Zenarmor to safeguard networks against a wide range of threats, including phishing attacks, malware infections, and data exfiltration. The comprehensive and timely TI data provided by Bright Cloud enables Zenarmor to offer advanced threat protection against the latest cybersecurity threats, making it an invaluable asset for organizations seeking to bolster their security defenses.

Who Benefits From Cyber Threat Intelligence?

Threat intelligence (TI) proves indispensable across diverse industries, providing proactive defense against the evolving cyber threat landscape. Critical infrastructure entities, such as power grids and transportation systems, leverage TI to identify and thwart cyber threats targeting their vital services. Financial institutions rely on TI to detect and prevent fraud, malware infections, and data breaches, safeguard sensitive financial data, and ensure operational integrity. Healthcare providers utilize TI to protect patient data from cyberattacks that could disrupt care delivery, while government agencies defend against cyber threats to critical infrastructure and classified information, reinforcing national security. Retail, e-commerce, media, and entertainment sectors also benefit from TI by preventing data breaches, protecting online transactions, and mitigating risks to brand reputation. Notably, the advantages of TI extend beyond large corporations, proving especially valuable for small and medium-sized businesses (SMBs). SMBs face increasing cyber threats due to perceived security resource limitations. TI for SMBs reduces risk by enabling early detection and prevention of cyberattacks, offering cost-effective protection through open-source and tailored threat intelligence feeds, and enhancing overall security posture by prioritizing vulnerabilities and implementing targeted security controls. In conclusion, TI emerges as a universal tool, empowering organizations of all sizes and industries to fortify their cybersecurity defenses, protect critical assets, and maintain operational resilience.

Advantages for Zenarmor Users

We are a top-of-the-line platform that joins Bright Cloud TI feeds, granting users a suite of advantages for fortified network security. Some of these Zenarmor threat intelligence benefits are:

1. AI-Based Classification System: Zenarmor employs an AI-based classification system to classify and update web categories in real-time, enhancing network security by automatically identifying and inhibiting new and sophisticated threats.

2. Advanced Security Profiles: Zenarmor provides three predefined Advanced Security profiles, including Permissive, Moderate Control, and High Control options available through Zenarmor Premium Subscriptions, offering Advanced Threat Protection against the latest malware, viruses, and phishing attacks.

3. Continuous Threat Intelligence Data Feeds: Zenarmor’s threat intelligence tools continuously feed the most up-to-date threat intelligence data to security systems such as endpoints, firewalls, APIs, and IPSs, enabling security teams to focus on analysis and planning.

4. Cloud Reputation and Threat Intelligence: The Zenarmor Cloud, a huge database consisting of reputation and security information for over 1 billion websites, provides real-time security threat intelligence, website categorization, and site reputation and ranking, safeguarding networks against a wide range of threats.

Figure 1 : Cloud Reputation and Threat Intelligence Settings on Zenarmor

Advanced Threat Detection and Prevention

It isn’t just a firewall—it’s a powerhouse that links up with threat intelligence (TI) feeds from Bright Cloud, empowering advanced threat detection. By monitoring DNS traffic within your network, you can cross-reference requested domains and IP addresses with TI data from Bright Cloud. It promptly flags any matches as malicious and notifies you. Employing machine learning and anomaly detection, you can stay vigilant for irregular network behavior like unusual traffic spikes, unauthorized access attempts, or data breaches. It promptly identifies and alerts you to potential threats. We help you proactively shield your network from cyber threats before they even strike. Integrated with intelligence (TI) feeds from Bright Cloud, it helps to be ahead by identifying malicious domains and phishing attempts and blocking them. It employs robust encryption, authentication, and firewall rules to fortify your network, thwarting unauthorized access and intrusion. Capable of preventing a range of cyber attacks—from phishing to DNS tunneling and more—we stand as a vital ally in securing your network, data, and reputation. Zenarmor offers a watchful defense against evolving cyber threats with enhanced prevention capabilities.

Figure 2 : Advanced Security Controls on Zenarmor

Reporting and Analysis

Zenarmor exceeds traditional firewall roles—it detects and prevents cyber threats and reports and analyzes them. Integrated with Bright Cloud intelligence feeds, Zenarmor NGFW taps into threat trends, attacker behaviors, and vulnerabilities. This data crafts detailed reports on your network’s landscape, security posture, and incidents. These insights into cyber vulnerabilities empower your security team to make informed decisions, fortify defenses, and optimize security strategies. TI-driven reporting and analysis elevate your security game, offering more than just protection—it provides strategic guidance for enhanced network defense.

Figure 3 : Threats Report on Zenarmor

Conclusion

In cybersecurity, staying protected isn’t a one-time fix—it’s an ongoing commitment demanding continuous adaptation. This is where Zenarmor comes in, offering more than mere protection. It’s your ally, offering security information, cutting-edge threat detection and prevention, insightful reporting, and proactive identification. It synchronizes with Bright Cloud threat intelligence feeds, delivering precise, timely data.

By safeguarding your network, data, and reputation from cyber concerns, you are having advocates for convergence—a unified, holistic cybersecurity approach aligning seamlessly with your business goals and values. It’s a purpose-driven solution dedicated to your security needs. Experience our comprehensive protection and foresighted defense. Explore how we can safeguard your network with purpose-driven cybersecurity. Connect with us to learn more about how we can assist you. Whether you are a small business or a large enterprise, our team is ready to collaborate with you to enhance your cybersecurity posture and address your specific challenges. Embrace a proactive stance against cyber threats with Zenarmor as your trusted partner in safeguarding digital assets and ensuring a resilient cybersecurity infrastructure.

Zenarmor is a next-generation firewall (NGFW) that provides comprehensive network security with a suite of features, including the TLS inspection feature, advanced threat intelligence, machine learning, and more.

Understanding TLS Inspection

TLS inspection empowers security systems to scrutinize and encrypt data without compromising encryption integrity. It decrypts and inspects incoming and outgoing TLS traffic, enabling robust threat detection and prevention. By unveiling encrypted content, advanced security measures like IDS/IPS, URL filtering, and virus detection can effectively identify and thwart sophisticated threats. This process strengthens network defense by allowing for comprehensive monitoring, threat identification, and control over encrypted communications, ensuring that malicious content hiding within encrypted data flows doesn’t bypass security measures.

The Need for TLS Inspection

As the use of TLS encryption increases so does the risk of cyberattacks that exploit it. These threats include malware, phishing attacks, data exfiltration, and more. Traditional firewalls cannot inspect encrypted traffic because they do not have the keys to decrypt it. They can only see the metadata, such as the source and destination IP addresses, ports, and protocols. They cannot detect or block malicious content or activities hidden in encrypted traffic. This is where TLS inspection for network security comes in. By doing so, the firewall can gain visibility into the content and behavior of encrypted traffic and apply security policies and rules accordingly.

Benefits of Zenarmor’s TLS Inspection Feature

Zenarmor is an NGFW that offers a powerful TLS inspection feature along with a comprehensive suite of network security features. Zenarmor’s TLS inspection feature for network security provides the following benefits:

Enhanced visibility into encrypted traffic for comprehensive threat detection

Zenarmor’s TLS inspection feature allows you to see the details of encrypted traffic, such as the URL, the content type, the file name, the user agent, and more. This enables you to detect and block threats hidden in encrypted traffic, such as malware, phishing attacks, and other malicious content.

Protection against malware, phishing attacks, and other malicious content

Zenarmor leverages its advanced threat intelligence and machine learning capabilities to analyze decrypted traffic and identify malicious content. The threat intelligence is updated in real-time with data from multiple sources, such as the cloud, endpoints, network sensors, and third-party feeds. Zenarmor’s machine learning algorithms can detect unknown, zero-day threats and strange, suspicious behavior.

Enforcement of security policies and compliance with industry regulations

Zenarmor’s TLS inspection feature allows you to enforce security policies and rules on encrypted traffic, such as blocking or allowing access to certain websites or applications, filtering or modifying content, or logging. The TLS inspection feature also helps you comply with industry regulations, such as PCI DSS, HIPAA, GDPR, and more, by ensuring encrypted traffic is secure and auditable.

Improved network performance by optimizing encrypted traffic flow

Zenarmor’s TLS inspection feature improves network performance by optimizing encrypted traffic flow. Zenarmor’s TLS inspection feature also supports selective decryption, which allows you to choose which traffic to decrypt and which to bypass based on your security needs and preferences.

How Zenarmor’s TLS Inspection Works

Zenarmor’s TLS inspection operates in two modes, prioritizing transparency while ensuring robust security measures:

• Lightweight Analysis: Zenarmor captures early-stage TLS session details without decryption. It extracts essential information like remote hostnames and web categories, maintaining encryption integrity.

• Full Inspection (As of v1.17): Zenarmor will decrypt, inspect, and re-encrypt traffic. This comprehensive analysis, powered by advanced threat intelligence and machine learning, ensures security without compromising end-to-end encryption.

Implementing TLS Inspection in Zenarmor NGFW involves:

1. Configuration: Access Zenarmor’s dashboard and enable TLS inspection settings.
2. Certificate Management: Import and manage SSL/TLS certificates to facilitate decryption (for full inspection mode).
3. Policy Setup: Define inspection policies based on security needs, specifying which traffic undergoes analysis.
4. Monitoring and Analysis: Access reports to view TLS traffic insights, identifying potential threats or anomalies.

This process ensures that while Zenarmor deeply inspects traffic for security threats, it maintains the confidentiality of data through a transparent and vigilant inspection methodology.

Real-World Scenarios

TLS inspection can be useful in various real-world scenarios where network security is a priority. Here are some examples of how Zenarmor’s TLS inspection feature can help you protect your network from different types of threats and risks:

Scenario 1: Preventing Data Breaches and Leaks

If you are handling sensitive or confidential data, such as customer information, financial records, or intellectual property, you must ensure that no unauthorized or malicious parties can access or steal your data. Zenarmor’s TLS inspection can help you monitor and control the data transmitted over encrypted channels like email, cloud services, or file-sharing platforms. Zenarmor can detect and block any attempts to exfiltrate or leak your data, such as phishing emails, ransomware attacks, or rogue employees.

Scenario 2: Enhancing Web Filtering and Application Control

If you manage a network with multiple users, devices, or locations, you must ensure that your network resources are used efficiently and securely. Zenarmor’s TLS inspection can help you filter and control the web and application traffic that flows through your network, such as social media, streaming, gaming, or messaging. Zenarmor can identify and categorize the websites and applications that your users access and apply granular policies and rules based on your needs and preferences. Zenarmor can block, allow, or limit access to specific web categories, applications, users, groups, or devices, enhancing your network’s productivity, performance, and security.

Security and Privacy Considerations

Zenarmor NGFW prioritizes privacy while inspecting encrypted traffic for security. It upholds stringent privacy protocols by implementing selective decryption, ensuring only necessary inspection occurs. Personal or sensitive data remains confidential, with Zenarmor focusing solely on threat identification within encrypted content. This approach safeguards privacy by balancing robust security measures with a commitment to preserving the integrity of encrypted communications, mitigating potential risks without compromising user confidentiality.

Zenarmor - Protecting Privacy, Detecting Threats, and Defending Networks

TLS inspection is a vital security feature in today’s security landscape, where encrypted traffic is prevalent and often used by attackers to hide their malicious activities. TLS inspection allows you to gain visibility and control over your encrypted traffic without compromising the security and privacy of your network. Zenarmor NGFW’s TLS inspection feature offers you a powerful and flexible solution that can help you protect your network from various types of threats and risks while enhancing the productivity and performance of your network. Zenarmor NGFW’s TLS inspection feature is easy to set up and use and integrates seamlessly with your existing security infrastructure.

Discover Zenarmor’s TLS inspection feature to elevate your network security defenses today!

Watch Now

In this blog post, we will explore the definition and role of device identification in network security, the risks of unidentified devices, and how device identification empowers security with various controls. We will also give you a sneak peek at Zenarmor’s device identification feature, which is available in paid editions to enhance your network security.

Understanding Device Identification

A Device­ ID is pretty straightforward. It’s something that says ‘hey, this is who I am’ to a ne­twork. It could be a computer, a phone, a tablet, a printer, or even an IoT device. What does it share? Lots of info! The name, the model, who made it, the operating system it’s using, what software and hardware it has, and its IP and MAC addresses. These attributes are used to create a unique fingerprint or profile of the device, distinguishing it from other devices on the network. In network security, identifying devices entails categorizing them based on function, purpose, ownership, and location. This approach comprehends device behaviors and their interactions within the network and infrastructure, enhancing overall security measures.

The Risks of Unidentified Devices

Unidentified or unauthorized devices seriously threaten network security, as they can compromise the confidentiality, integrity, and availability of network resources and data. Some of the potential risks and vulnerabilities associated with unidentified devices are as follows:

• Data breaches: Unidentified devices can be used to steal, leak, or tamper with sensitive or confidential data, such as personal information, financial records, intellectual property, etc. For example, in 2017, Equifax, one of the largest credit reporting agencies in the US, suffered a massive data breach that exposed the personal data of 147 million customers. The breach was caused by a vulnerability in a web application running on an unidentified device that was not adequately scanned or patched.

• Network attacks: Unidentified devices can be used to launch various types of network attacks, such as denial-of-service (DoS), distributed denial-of-service (DDoS), man-in-the-middle (MITM), ransomware, etc. These attacks can disrupt or damage the network operations, performance, and availability and cause significant losses or damages. For example, in 2016, a massive DDoS attack was launched against Dyn, a major DNS provider, using a botnet of millions of infected IoT devices. The attack affected many popular websites and services, such as Twitter, Netflix, Spotify, etc., and caused widespread internet outages.

Empowering Security with Device Identification

Device identification is not only a defensive measure but also a proactive and strategic one. It enables the organization to implement various security controls to enhance network security posture and resilience. Some of the security controls that device identification supports are outlined below:

Access Control

Access control determines who or what can tap into network resources and data. It depends on who the user is, what device they’re using, and what they’re allowed to do. This key security step keeps unwanted guests out and makes sure only approved users and devices reach the network. Identifying a device is important because it gives all the information needed to check, confirm, and apply access rules, which is a crucial step in stopping anomalies like fake identities or unapproved access. Leveraging device identification, organizations can adopt diverse access control models like RBAC (Role Based Access Control), ABAC (Attribute Based Access Control), or ZTNA (Zero Trust Network Access Control), tailoring security measures to specific needs while fortifying against impersonation or brute-force attacks.

Policy Enforcement

Policy enforcement assures adherence to organizational security standards, which is crucial for maintaining network integrity and curbing potential risks. Identifying devices is a key tool, bringing clarity and accuracy to manage and apply network safety rules accurately while offering careful tracking, control, and use of relevant safety settings, which aid in checkups for compliance and fixes when rule violations occur. Encouraging the use of various safety rules, covering device­ configurations, updates, encryption, firewalls, and the like, helps maintain a regular safety position while­ reducing discrepancies via proactive steps and complete reports.

Incident Response

Incident response tackles security breaches, malware attacks, and data breaches, which are pivotal for minimizing their impact and restoring network functionality. Device identification expedites responsive actions by furnishing crucial insights to pinpoint incident origins, assess severity, and isolate affected devices. It aids in thorough investigation, identifying root causes, and swiftly executing necessary remedial steps. Leveraging device identification, organizations align with incident response frameworks like NIST or SANS, streamlining actions for effective resolution. It’s instrumental in swiftly addressing security incidents, containing their effects, and executing precise measures for recovery and mitigation, ensuring a prompt return to normalcy in network operations.

BYOD Security

Securing personally used devices for network access, known as BYOD (Bring Your Own Device) security, poses challenges due to varied device security levels and potential vulnerabilities. Managing these devices within a BYOD framework demands control and visibility, addressed through device identification. It classifies and enforces security policies, safeguarding data and privacy while averting potential leaks. Device identification is key in implementing BYOD security solutions like MDM (Mobile Data Management), MAM (Mobile Application Management), or MTD (Mobile Threat Defense), ensuring comprehensive management and defense against threats across personal devices accessing the network. Device ID is essential to mitigate risks associated with diverse devices and fortify network security within a BYOD environment.

Network Visibility

Network visibility is gaining insight and understanding into the network infrastructure, devices, traffic, and activities. Network visibility is significant for network security, as it helps optimize network performance and efficiency and detect and prevent security threats or anomalies. Device identification enhances network visibility by providing comprehensive and detailed information about the connected devices, locations, and activities. It also helps generate and analyze various network metrics and indicators, such as device inventory, device health, device utilization, device behavior, etc., by enabling the organization to leverage various network visibility tools, like network monitoring, analysis, forensics, or intelligence.

Regulatory Compliance

Meeting cybersecurity regulations like GDPR, HIPAA, or PCI DSS is imperative for safeguarding data and maintaining trust. Device identification is pivotal in ensuring compliance by furnishing essential data to validate device security levels and adherence to relevant controls. It facilitates evidence provision by aiding in demonstrating compliance and rectifying any gaps. Organizations align with frameworks like ISO/IEC 27001 or NIST through device identification, ensuring sustained adherence to regulatory standards. It’s instrumental in upholding data privacy, mitigating legal risks, and preserving the organization’s reputation by promptly maintaining consistent compliance and addressing any regulatory shortcomings.

Zenarmor’s Device Identification

Device identification is a core and critical component of network security, and it offers many benefits and advantages for enhancing your network security posture and resilience. However, device identification is not an easy or simple task, and it requires a robust and reliable solution that can handle the complexity and diversity of the devices and the network environment. For this reason, we are ecstatic to introduce you to the revolutionary device identification feature of Zenarmor, which will transform your network security.

Figure 1: Devices Report on Zenarmor

The Zenarmor platform offers a Device Identification feature that autonomously detects and classifies all network-connected devices, providing a comprehensive summary of their characteristics, including hardware vendor, operating system, name, hostname, IP addresses, and MAC addresses. This feature is available in the Zenarmor Paid Editions and helps improve network visibility and overall network security by maintaining a current list of all connected devices and furnishing comprehensive data regarding every device linked to the network. Additionally, it allows users to group devices into their respective categories and provides real-time tracking to ensure that IT teams always know what new devices have been added to the network.

Watch Now

In this release, we are proud to introduce a new device identification and management capability, giving you improved visibility and control of the devices using your network, as well as Community ID flow hashing support to easily correlate device logs with connection logs, giving you full end-to-end visibility of the process on the device initiating the connection on your network to its final destination on the internet.

In addition, almost every module of Zenarmor has had an improvement or general bug fix, so let’s take a closer look at what you can expect from this feature-packed edition of Zenarmor 1.16.

Enhanced Visibility and Security with Device Identification and Access Control

The engine is the heart of Zenarmor, and in this release, device identification is now available, where Zenarmor automatically detects the devices attached to your network, providing an overview of their details, such as hardware vendor, operating system, name, hostname, IP and MAC addresses, with the ability to group these devices into their respective categories. The device identification feature provides valuable insights into the IT ecosystem, enhancing your network visibility and overall network security. The following are the principal benefits of utilizing the Zenarmor device identification function:

• Maintaining an up-to-date device inventory: Zenarmor keeps an up-to-date list of all connected devices, so you don’t have to keep track of them manually, ensuring no devices are missed.

• Enhanced network visibility: Zenarmor provides detailed information about each device connected to the network, which can be useful to IT teams when investigating their infrastructure, providing an easy means to spot “rogue” or risky devices attached to the network.

• Real-time device tracking: Zenarmor continuously scans the network for new devices. This real-time tracking ensures that IT teams always know what new devices have been added to their network, once again providing a powerful means to protect the network against rogue or unauthorized devices.

It must be noted that this is the first implementation of the Zenarmor device identification feature, and while it’s highly capable of detecting most devices on your network, there may be some cases where minor inconsistencies or erroneous information is observed, which may require manual user correction and input. This is because, without full TLS inspection, only partial device information is obtained when inspecting the network traffic. The good news is that as of Zenarmor 1.17, expected to ship in the first quarter of 2024, full TLS inspection will be available, which will improve device identification as well as enhance the overall network inspection capabilities of Zenarmor as a whole.

Taking device identification functionality further, device access control has been integrated where detected devices can be categorized as trusted or untrusted, and through your Zenarmor policies, you can choose to restrict untrusted devices from accessing the network. This essentially empowers IT teams with more granular control over the devices attached to the network, enhancing overall network security and preventing potential data breaches by blocking unauthorized device access In addition to this, this feature also simplifies IT asset management (ITAM) by enabling IT teams to centrally control devices through a single pane of glass. To drill down into this feature’s use cases a bit further, IT teams can:

• Set Access Rules: That inform devices what resources they can reach and how they can connect to the network.
• Prevent Unauthorized Access: Zenarmor can prevent devices that aren’t trusted from connecting to the network. This stops users from gaining access without permission and plays a part in your zero-trust strategy, ultimately lowering your risk.
• Enforce Device Compliance: IT teams can ensure that all devices meet certain security standards before they can connect to the network by enforcing device compliance rules.

Figure 1: New Zenarmor device identification and management dashboard

Community ID Support for Advanced Threat Hunting

Another great addition to this release is Community ID flow hashing support. Community ID, in a nutshell, creates a unique hash identifier for each connection made through the network, derived from the network connection’s source/destination port, source/destination IP address, seed, and transport protocol (TCP/UDP). This unique hash identifier can then be used while correlating log data between your systems to give more context to the flow of traffic. This gives you full end-to-end visibility of the process on the device initiating the connection to its final destination on the internet. If you are interested in learning more about this, please have a look at the previous article we published, where we demonstrated a basic threat-hunting exercise using the Community ID Network Flow Hashing capabilities built into Zenarmor and ELK (Elasticsearch, Logstash, and Kibana) to correlate the log data between Zenarmor and a Windows 11 device using Sysmon.

Figure 2: Reporting and Data Settings menu to toggle Community ID support in Zenarmor

Figure 3: An example of how Community ID can be used to correlate log data between Zenarmor and a Windows 11 client using a Kibana dashboard

Additional advanced security features including DNS Tunneling Attack Detection, Botnet DGA protection, and Internal CA Support

At Zenarmor, we strive to improve our feature set based on industry standards and client feedback, and we are dedicated to providing you with the best network security possible. With this update, you can now enjoy additional enhanced security controls that provide advanced threat-prevention capabilities, including:

• Improved threat detection and data exfiltration prevention capabilities by identifying tunnels over the DNS protocol.

• Internal CA certificates are now supported, enhancing security in packet inspection.

• Enhanced security with Botnet DGA (domain generation algorithm) detection and prevention making it harder for botnets and malware to use these advanced attack techniques to evade detection.

We encourage you to try these exciting new additions today to truly experience their benefits.

Figure 4: Enabling Botnet DGA and DNS Tunneling Protection in the Advanced Security Configurations.

Reporting improvements and new functionality

Zenarmor comes standard with 60+ reports, giving you a complete overview of your network. In light of the addition of device identification and management features, reporting has now become more powerful. In this release:

• By popular request, a previous feature has returned from the old Zenarmor OPNsense UI, where you can once again access the Live Session Explorer with a single click on the piechart or by selecting the piechart names followed by the ellipsis icon to explore the traffic details.
  
  

  

  Figure 5: By clicking the pie charts, you can now access the Live Session Explorer, back by popular request
  
  

• You can conveniently access the device details by clicking on the device column in Live Sessions Explorer or by clicking on the device-related charts, like Top Devices, in Reports.
  
  

  
  
  
  

  Figure 6: Viewing device details by selecting the device name in the Live Session Explorer
  
  

• We added the “Show only blocked connections” option to view blocked connections exclusively in Live Session Explorer, aiding in threat analysis.

• Direct access to “Detected” and “Blocked Threats” reports from the firewall dashboard streamlines traffic analysis and threat hunting.

In addition to this, a few other improvements have been made to the existing reports, giving you a more streamlined user experience.

UX Enhancements and new features

Through Zenarmor’s partnership with OPNsense, you are already offered a well-integrated user experience, and as of Zenarmor 1.14 released earlier this year, the Zenarmor dashboard was completely rewritten and designed to give you an identical look and feel to what you may have experienced using the Zenconsole dashboard.

As of this release, this integration has been enhanced further, where you can now download internal CA certificate files in CRT format via the “Block Notification Page” and “Certificate Authority” settings pages, which is more convenient.

In addition to this, the user experience is improved with a newly implemented and intuitive Zenarmor user interface. The updated fonts and color scheme ensure a seamless and enjoyable experience. Moreover, if you make use of High Availability (HA) in your deployment, this has been improved, offering better synchronization on the OPNsense UI with additional configuration options.

Other minor improvements include general UI enhancements and bug fixes.

Filtering, Application Control, and Threat Intelligence enhancements

Zenarmor’s web and application filtering, driven by the creation of policies, has just gotten better. Filtering management capabilities have been enhanced, with the option to allow or block based on Security categories via Live Sessions Explorer through Zenconsole.

In addition to this, to support the new device identification and management features, the “Device” and “Device Category” options are now available in the policy configuration settings, allowing you to filter by device type or category. This functionality can be powerful when you have to treat certain device types differently. e.g., IoT devices may need a more restrictive policy, so you can now easily target those devices independently with a unique policy. For more thoughts on this, feel free to check out the article, IoT Data Security in a Connected World: The Necessity of SASE in IoT Data Protection.

Other improvements in this release include better identification of WireGuard applications through improved fingerprinting of these applications.

Figure 7: The addition of device management controls, where you can create policies around devices or device categories

Zenconsole and Agent improvements and additions

If you prefer using Zenconsole to manage your Zenarmor deployments, you will be pleased to know that this has also been improved in this release. You can now add more charts to your scheduled reports, and as previously mentioned, you can now download internal CA certificate files in CRT format via the “Block Notification Page” and “Certificate Authority” settings pages.

Various other UI and functional improvements, as well as bug fixes, make Zenconsole more streamlined and powerful than ever. For more information about these minor improvements, please check out the release notes.

Figure 8: Dashboard view showing the ability to download CA certificates in the CRT format. This is now available in both the OPNsense and Zenconsole dashboards

Improved platform support

Zenarmor is versatile and can be installed on multiple Linux or Unix-based platforms other than OPNsense, including Ubuntu, FreeBSD, Amazon Linux, pfSense CE, and CentOS. This is necessary to support the deployment of Zenarmor as a Secure Web Gateway (SWG) part of a SASE architecture or if you are unable to run OPNsense in your environment.

As of this release, Zenarmor now fully supports Ubuntu 23.04 Lunar Lobster. In addition to this, Dynamic Kernal Module Support (DKMS) has been shipped, allowing for Netmap module improvements and a simplified installation process. If you are interested in learning more about Netmap and the important role it plays in making Zenarmor packet filtering possible, please check out this article that discusses Zenarmor’s mission towards a device-agnostic Netmap in the FreeBSD kernel and emulated Netmap support.

Some closing thoughts…

So as you can tell, we have had another productive year at Zenarmor, finishing up the year with a bang and announcing the release of Zenarmor 1.16, with even more exciting new developments planned for 2024.

We would just like to take this opportunity to thank everyone who is part of the Zenarmor community for their support, and we would like to wish everyone who is taking time off a safe and happy holiday.

If you are new to our community and would like to explore Zenarmor, we highly encourage you to try it on a free 15-day business edition trial that includes all this great functionality.

Alternatively, feel free to contact Zenamor at and ask for assistance getting your free trial set up and started today. We’d love to hear from you!

Watch Now

While the software is still in the final stages of development, we are almost ready to bring you a product filled with innovative features that will surely enhance your experience. Additionally, this release will introduce fundamental features of a next-generation firewall, marking a significant step forward in our technology. Stay tuned for the imminent arrival of our most advanced and user-friendly version yet!

The upcoming release of Zenarmor 1.16, with its advanced features like Device Identification, Device Access Control, and Community ID flow hashing, promises to elevate network security; however, to leverage these enhancements fully and mitigate potential misconfiguration issues, this guide outlines essential best practices for administrators to effectively implement and optimize the new configuration settings.

From policy configuration simplicity to device examination and security rule enforcement, these practices cover essential aspects. Additionally, insights into IoT device protection, virtual environment considerations, and efficient reporting strategies are outlined. The guide concludes with recommendations for seamless integration with packet-filtering firewalls, VPN security enhancements, and the advantages of cloud-based management.

Figure 1. Zenarmor 1.16 Devices

To aid you in maximizing the capabilities of the Zenarmor next-generation firewall and averting misconfiguration complications, we establish best practice principles for Zenarmor configuration:

1. Using minimal criteria: Define your policy configuration as simply as possible. When multiple criteria are specified for a policy, it is applied exclusively to network packets that satisfy each of the specified criteria.
   
   

   Please note that the ‘AND’ logical operator is used to evaluate all policy criteria in Policy Configuration, not the ‘OR’ logical operator. So, for a particular type of traffic to match a specific policy, all criteria must be met. For instance, if you’ve created a policy and specified VLAN ID, IP, and username criteria, a session must match all of those. The only exceptions to this rule are Devices and MAC addresses, where they can be used interchangeably.

   • For example, in the case where a policy configuration specifies the “Mobiles” device category and the 10.0.0.0/24 network, these should all be identical. Upon observing a transmission originating from the “Mobiles” device with the IP address 10.11.11.11, this flow will fail to comply with the specified policy.

   • As another example, adding a detected device, CEO_laptop, and a user, CEO, to the policy named CEO_Rules would ensure that the policy would only be triggered when a user whose login identity is CEO utilized the CEO_laptop to connect to the network. When another user account utilizes this device to connect to the network, the CEO_Rules policy is not implemented on its network traffic.

2. Device Examination: Once Zenarmor 1.16 has been installed on your firewall, proceed to examine devices on your network by navigating to the Zenarmor Devices page, and then verify them as trusted. Zenarmor defines all newly detected devices as untrusted by default. Suspicious or unknown devices should be left untrusted.
   
   

3. Give Zenarmor some time and a chance for more accurate device identification: It should be noted that this is the initial iteration of the Zenarmor Device Identification function. Although it demonstrates exceptional capability in identifying the majority of devices connected to your network, certain instances may arise where minor inconsistencies or inaccurate data are detected, necessitating manual user intervention for correction and input. This is because, when examining network traffic in the absence of a complete TLS inspection, only incomplete device information is obtained. The good news is that a full TLS inspection will be available with Zenarmor 1.17, which is scheduled for release in the first quarter of 2024. This enhancement will not only improve device identification but also the network inspection capabilities of Zenarmor in its entirety.
   
   The more network packets inspected and the more information they provide, the more accurate device identification. Device identification is an ongoing process until you stop it intentionally. Zenarmor continuously examines network flow to find detailed information about devices and to catch updates on them. To ensure that all devices are accurately displayed on your Zenarmor interface, allow Zenarmor some time and opportunity to detect them.
   
   

4. Default Policy Configuration: Although the “Default” policy configuration is mostly static and you can configure a limited set of parameters depending on your subscription, it is advised to enable the “Block Untrusted Devices” option in this policy. This will prevent rogue devices from accessing your network for harmful activities.
   
   

   

   Figure 2. Block Untrusted Devices in Default Policy
   
   

5. Block Untrusted Devices: It is recommended to enable Block Untrusted Devices on policies whose criteria match a broad range of endpoints, such as networks and VLANs, to prevent unauthorized access to your network by unknown devices.
   
   

6. Descriptive Naming for Static IPs: For a static IP address definition in DHCP configuration, it is better to type a descriptive name for the device. Zenarmor automatically detects and displays the name of a device. Such a device name is displayed in device details and reports. This will enhance the visibility of your network, facilitating more effective threat monitoring.
   
   

7. MAC Address Criteria in Policies: There is no requirement to include MAC address criteria for Device- or Device Category-based policies. Caution is advised, as this particular policy applies solely to devices whose MAC addresses are explicitly specified within the policy. Inaccurate policy configuration due to improperly designed policies results in unforeseen packet filtering and package mismatching.
   
   

   

   Figure 3. Adding Device in Policy
   
   

8. Enable Essential and Advanced Security Rules: To safeguard your IT resources from potential malicious connections and prevent any suspicious network activities, it’s recommended to enable all Essential and Advanced Security Rules by selecting the High Control option in the upper right corner of the Security Rules page. In case you encounter false positive issues, you can effectively resolve them by creating exclusions through Live Sessions Explorers.
   
   

   

   Figure 4. Enabling Predefined Security Profiles
   
   

9. Be Careful with Whitelisting: Beware that exclusions take precedence over all your Security, Application Control, and Web Control rules. Particularly when adding a whitelist to a security category, exercise caution, as an erroneous definition could compromise your network.
   
   

10. Device Categorization and Policy Creation: From the policy configuration page, you can select device categories such as IoT, Multimedia, Smart Glasses/Watches, TVs, Gaming Consoles, and Vehicles to create a policy and safeguard your IoT devices. Note that while Zenarmor’s device identification feature will automatically recognize most of your IoT devices, it may not identify all of them. In such cases, you might need to manually identify the rest of your devices to ensure comprehensive protection.
    
    

    

    Figure 5. Adding Device Category in Policy
    
    

11. Network Segmentation for IoT Devices: By separating your IoT devices from valuable IT assets using separate VLANs/networks and subsequently activating the Exempted VLANs & Networks option, you can prevent your devices from exceeding the device limitations specified in your purchased license. Exempted VLANs and Network addresses are circumvented by Zenarmor processing. There will also be no activity reported for these devices in the reports.
    
    

12. Updating Device Details: You can manually update automatically detected device details, such as name and device category. User-defined settings have higher priority than the settings automatically detected by Zenarmor. For instance, when a user changes the detected name or category of a device, Zenarmor device database is updated, and detected values are ignored. Values set by the user manually are displayed.
    
    

13. Drill-down: For streamlined data analysis, like you used to on the previous Zenarmor UI, you can now access the Live Session Explorer with a single click on the chart pies or by selecting the pie names followed by the ellipsis icon to delve down to traffic details.
    
    

    

    Figure 6. Drill-down
    
    

14. Considerations for Virtual Environments: Since resources in virtual environments are typically shared among guest systems, we do not advise deploying Zenarmor as a virtual guest if the sustained WAN bandwidth exceeds 500 Mbps and the number of active devices exceeds 500.
    
    

15. Optimal Reporting Database Selection: Select the best reporting database option that meets your needs. Elasticsearch appears to be a superior backend database option for large enterprise networks with hundreds of devices. A minimum of 8GB of RAM is required to operate ES in conjunction with Zenarmor. Additionally, you may transfer your data to a remote Elasticsearch database. In the case of residential networks or tiny networks, SQLite can adequately facilitate efficient reporting. SSD drives are suggested for optimal reporting performance.
    
    

16. Policy Processing Order: Zenarmor policies are processed in order, beginning from top to bottom. The most frequently matching rule should be placed at the top of the rule list for better performance, reducing unnecessary processing.
    
    

17. Enable Community ID Flow Hashing: Enable Community ID flow hashing to easily correlate network security events generated by other security tools on your network, like Suricata and Snort. This correlation provides a more comprehensive view of network activities and aids in the identification and response to potential threats. Enabling Community ID flow hashing ensures a synchronized and unified approach to network security across different tools, contributing to a more robust defense against various cyber threats.
    
    

    

    Figure 7. Enabling Community ID Flow Hashing in Policy
    
    

18. Stream Reporting Data to Syslog or SIEM: Enable “stream reporting data” to your Syslog server or SIEM tool, such as Wazuh, Splunk, or Datadog, for unified security and powerful monitoring.
    
    

    This capability ensures unified security across your network and empowers you with powerful monitoring capabilities. By seamlessly integrating reporting data into your chosen Syslog or SIEM solution, you gain valuable insights, enhance threat detection, and streamline the management of security events. This proactive approach contributes to a more resilient and responsive security infrastructure.
    
    

19. Configure Reporting Data Period: Configure the reporting data period in accordance with the hardware specifications and reporting database of your choice. Zenarmor includes the optimal reporting data period for your database type by default.
    
    

20. Efficient Real-time Network Activity Management: By utilizing the Actions icon while examining real-time network activities in Live Session Explorer, one can efficiently permit or prohibit connections according to various criteria such as hostname, application, application category, web category, or security category.
    
    

    

    Figure 8. Blocking a connection via Live Session Explorer
    
    

21. Operational Independence: It should be noted that the principles of Zenarmor and a packet-filtering firewall operate independently of one another. Initially, incoming packets are processed by the Zenarmor engine. If the engine permits them to pass, they are then processed by the L4 firewall platform, such as pfSense or OPNsense, on which Zenarmor is operating. Outgoing packets, conversely, are initially processed by your L4 firewall. When the packet-filtering firewall grants access to the outgoing packets, the Zenarmor engine proceeds to analyze them. In order to be permitted through, a network communication must not violate any rule specified on either the L4 firewall or Zenarmor.
    
    

    It is advisable to independently configure Zenarmor to enable L7 filtering and configure your firewall for L4 filtering.
    
    

22. NIC Compatibility: We recommend using Intel adapters, as they are known to have good compatibility with Netmap. Try to utilize emulated network driver mode with Zenarmor for Ethernet interfaces that are incompatible with Netmap. This should help you overcome the compatibility issues and ensure a smooth experience. The emulated mode has been enhanced to deliver superior performance.
    
    

23. VPN Security Enhancement: Deploy tap interfaces in your OpenVPN implementation for packet inspection and safeguarding the VPN clients against malicious traffic.
    
    

24. Cloud-Based Management: Register your node to the Zenconsole and enable the cloud management portal to administer all of your firewalls from the cloud and through a single pane of glass. Sharing firewall administration and establishing centralized, location-independent policies is incredibly beneficial, particularly for MSSPs and enterprises with multiple Zenarmor deployments.
    
    

Building upon the success of the “Zenarmor 101: Components and Benefits” webinar, this session continued to unravel the advanced functionalities of Zenarmor, providing valuable insights and configuration tips for cybersecurity enthusiasts and professionals alike.

1. Introduction to Zenarmor:

• Overview: Zenarmor is a comprehensive network security solution providing granular control over traffic, applications, and websites.
• Dashboard Overview: Complete visibility and control over network activities, including traffic, apps, and websites.
• Exclusions Option: Manage exclusions efficiently, allowing whitelisting of blocked websites.
• Settings Menu: All settings are conveniently placed in one menu for easy configuration and maintenance.

2. Deep Dive into Zenarmor Features:

• Data Management: Zenarmor can stream reporting data through a CIS log or external elastic search for integration with SIM or SIEM solutions.
• Active Directory Integration: Integration with Active Directory allows the creation of policies based on user groups, enabling a least privilege environment.
• TLS Inspection: Current light TLS inspection with plans for full TLS inspection in the upcoming release (February 2024).
• Threat Intelligence: Utilizes BrightCloud threat intelligence database and plans to support custom threat intelligence databases, including local databases.
• Application Filtering: Recognizes applications based on fingerprint information, IP addresses, or domain names.
• Deployment Modes and Netmap: Various deployment modes, including routed mode, passive mode, and bridge mode, use Netmap for packet grabbing.
• High Availability (HA): Zenarmor reads the OPNsense HA configuration and operates as OPNsense when traffic switches to the passive device.
• Logging and Privacy Settings: Configurable system logs, rotation dates, and log levels, with privacy settings like anonymizing IP addresses.
• License and Subscription Management: Supports license management, including a 50% discount for educational and nonprofit organizations.
• Device Identification (Upcoming): Version 1.16 will introduce device identification, counting devices instead of unique IP addresses for licensing purposes.

3. Q&A Session:

• Filtering WireGuard/OpenVPN Traffic: Zenarmor supports OpenVPN, and WireGuard support for kernel mode is almost finished and planned for the next release.
• RDP Service Support: Zenarmor uses the last login information from Active Directory, and it can recognize different users with Microsoft’s remote IP virtualization.
• Functional Differences in Security Zones: Advice on configuring interfaces correctly to avoid confusion in reports
• Discounts for Educational and Nonprofit Organizations: Offers a 50% discount for educational and nonprofit organizations.

Watch Now

You can find detailed information on the

Cybersecurity has emerged as a critical concern in today’s highly interconnected manufacturing domain. As manufacturing organizations embrace digital transformation, they face heightened vulnerabilities and sophisticated cyber threats. From safeguarding critical systems and IoT devices to defending against intellectual property theft, they must adopt effective security solutions to protect their operations and assets. One such solution is Zenarmor, a next-generation firewall plugin that provides real-time visibility, swift threat detection, and simplified compliance. This article delves into how Zenarmor is a solid defense mechanism, safeguarding sensitive industrial systems and data from malicious intrusions to address manufacturing organizations’ cybersecurity challenges.

We’ll explore key areas where Zenarmor excels. Discover how Zenarmor’s comprehensive suite of security features can be the shield against cyber threats for your organization today!

Real-Time Visibility and Swift Threat Detection

Real-time visibility and swift threat detection are essential for manufacturing organizations to protect their networks from cyberattacks. Without network visibility, manufacturing cybersecurity teams cannot monitor their network traffic and spot any suspicious or malicious activities. This can leave them vulnerable to cyberattacks that can cause serious consequences, such as disrupting manufacturing processes, damaging equipment, compromising data, and causing financial losses. Zenarmor provides real-time visibility into network traffic, enabling manufacturing organizations to detect and respond to cyber threats promptly.

• Advanced artificial intelligence and machine learning: Zenarmor utilizes cutting-edge AI and ML to scrutinize network traffic, detecting anomalies, potential vulnerabilities, and malicious activities.

• Real-time threat detection and reporting: Manufacturing organizations benefit from the real-time threat detection and advanced reporting capabilities of Zenarmor for swift action against cyber risks.

• Enhanced network security: By leveraging Zenarmor, manufacturing entities strengthen their security posture, preventing cyberattacks from disrupting operations and compromising assets.

• Latest cybersecurity technologies: Zenarmor’s swift threat detection relies on state-of-the-art cybersecurity research and technologies, ensuring up-to-date protection.

Safeguarding Critical Systems and IoT Devices

Manufacturing organizations rely on critical systems, such as industrial control systems (ICS) and IoT devices, to run their operations. These systems and devices are often connected to the internet, making them vulnerable to cyberattacks. Cyberattacks on these systems and devices can cause physical damage, operational downtime, safety hazards, and data breaches. Zenarmor can help simplify and secure complex IT/OT environments by providing a unified security platform that can protect many devices and systems, including legacy systems, ICS, and IoT devices.

Comprehensive network traffic management: Zenarmor monitors and controls network traffic for these devices, preventing unauthorized access, data breaches, and malicious commands.

Application of security policies: Zenarmor enforces security policies and rules, ensuring adherence to industry standards and best practices across devices and systems within the IT/OT environment.

Simplified and secured IT/OT integration: Utilizing Zenarmor streamlines and strengthens the integration of complex IT/OT environments, safeguarding diverse devices while ensuring compliance and security standards are met.

Cost-Effective Cloud-Based Security Solutions

Cost-effective cloud-based security solutions are an excellent option for cybersecurity manufacturing companies with limited resources to invest in. Traditional cybersecurity solutions can be expensive and complex, requiring hardware installation, software updates, and maintenance. These tasks can consume a lot of time and money, which can be better spent on other aspects of the business. Zenarmor offers cost-effective cloud-based cybersecurity solutions, ideal for organizations with limited resources.

• Hassle-free deployment: Eliminating hardware installation, software updates, and maintenance, Zenarmor operates as an Internet-delivered service, ensuring seamless access without technical concerns.

• Accessibility and reliability: Organizations enjoy round-the-clock access to security features from any location, free from worries about technical glitches or downtime.

• Flexible, scalable pricing: Zenarmor offers adaptable pricing plans, enabling organizations to pay based on usage and scale security provisions as their needs evolve.

• Savings in time and money: By leveraging Zenarmor, manufacturing entities streamline operations, save costs, and enhance cybersecurity efficiency without compromising performance.

Overcoming Limited Cybersecurity Resources

Resource-efficient cybersecurity solutions are necessary for manufacturing organizations with limited resources to invest in a robust cybersecurity program. They may lack the cybersecurity staff, skills, or infrastructure to implement and manage effective security measures. This can expose them to cyber threats and compliance issues, jeopardizing their operations and reputation. Zenarmor is a resource-efficient solution, allowing organizations to maintain their security posture without requiring extensive cybersecurity staff or infrastructure.

• Effortless deployment and usability: With no technical expertise required, Zenarmor offers easy deployment and user-friendly operation, backed by 24/7 support for expert guidance.

• Automation and simplification: Zenarmor streamlines security processes, reducing workload and complexity and effectively managing cybersecurity.

• Insights and recommendations: Providing valuable insights, Zenarmor assists in enhancing security awareness and skill sets within manufacturing organizations.

• Overcoming resource limitations: Zenarmor empowers organizations to transcend restricted cybersecurity resources, boosting capabilities and confidence in their security measures.

• User-friendly interface: Featuring an intuitive interface, Zenarmor ensures ease of use for all levels of staff within manufacturing organizations, promoting widespread adoption and utilization.

Defending Against Intellectual Property Theft

Protecting intellectual property from theft is a crucial cybersecurity challenge for manufacturing organizations. Intellectual property, such as trade secrets and product designs, is a valuable asset, as it gives them a competitive edge and drives innovation. Intellectual property theft can result in revenue loss, reputation damage, and legal consequences, as competitors or adversaries can use the stolen information to gain an advantage or cause harm. Zenarmor helps protect against intellectual property theft with features like data loss prevention and content filtering, critical for safeguarding proprietary information.

• Data protection measures: Zenarmor blocks sensitive data, thwarting unauthorized transfers or email communications to maintain data integrity.

• Content filtering for security: Zenarmor filters and blocks malicious content like phishing emails, malware, and spyware, fortifying defenses against threats that jeopardize data security.

• Defending innovation and competitiveness: Utilizing Zenarmor, organizations fortify defenses to safeguard intellectual property, preserving their competitive edge and innovative potential.

• Incident response capabilities: Zenarmor enables swift and effective incident response, minimizing the impact of security breaches and ensuring a proactive approach to managing cybersecurity incidents.

Simplified Compliance with Regulations

Complying with industry-specific regulations is a vital cybersecurity challenge for manufacturing organizations. Regulations like the NIST Cybersecurity Framework (CSF) provide guidelines and best practices for improving cybersecurity and reducing cyber risks. Compliance with these regulations can be challenging and complex, as it involves meeting various requirements and standards, such as identifying, protecting, detecting, responding, and recovering from cyber incidents. Integrating manufacturing cybersecurity with Zenarmor aids organizations in complying with industry-specific regulations, simplifying the process of meeting these requirements.

• Evidence of adherence: Through generated reports, audits, and logs, Zenarmor furnishes tangible evidence showcasing organizations’ adherence to regulatory requirements and security performance.

• Guidance for improvement: Zenarmor offers recommendations and feedback, enhancing security performance and aligning with regulatory expectations for manufacturing organizations.

• Simplified compliance processes: Utilizing Zenarmor streamlines compliance efforts, reducing cyber risks and simplifying adherence to industry-specific regulations.

• Customized compliance controls: Zenarmor allows customization of controls to align with specific regulatory requirements, ensuring tailored compliance measures for different industry standards.

Zenarmor Solution For Manufacturing Organizations Cybersecurity Challenges

In addressing the multifaceted cybersecurity landscape of manufacturing, Zenarmor emerges as an all-in-one safeguarding solution. From strengthening against threats and protecting intellectual property to simplifying compliance and securing complex environments, it stands as a comprehensive defender. It’s the shield manufacturing organizations need, blending cutting-edge technology with user-friendly adaptability.

Explore how Zenarmor can revolutionize your cybersecurity approach—reach out today for a tailored solution that ensures uninterrupted production, preserves innovation, and shields your assets.

Are you getting the most out of your cloud security solution? If you are using the free edition of Zenarmor, you might be missing out on some powerful features that can take your cloud experience to the next level. Zenarmor is an appliance-free, all-software, lightweight, next-generation firewall that provides comprehensive security for your network. But what if you want to enjoy premium benefits such as advanced threat intelligence, unlimited web filtering, user-based policies, and more? That’s where Zenarmor’s premium plans come in.

Discover the enhanced features you’ve been missing in the free version and take your cloud experience to the next level with Zenarmor’s premium management.

Centralized Reporting: Uncovering the Full Picture

Imagine you are managing multiple cloud resources across different platforms and regions. You want to track how they perform, how much they cost, and how secure they are. How do you get a clear and consistent view of your cloud management platform? That’s where centralized reporting comes in. The centralized reporting feature offered by Zenarmor streamlines cloud resource monitoring, offering a consolidated view through a single dashboard. This feature grants users access to in-depth insights regarding network activity, security incidents, web filtering, and user policies, among other aspects.

Its flexibility allows personalized report customization, tailoring the information to individual preferences and requirements. This empowers users to understand their cloud resources comprehensively, facilitating informed decision-making to enhance resource optimization and bolster overall network security. Zenarmor’s centralized reporting is a pivotal tool for efficiently managing and safeguarding digital assets in today’s dynamic and complex cloud environments.

Centralized Policies: Streamline Security, Amplify Control

Imagine you are a cloud security administrator for a large organization with multiple cloud nodes across different platforms and regions. You have to manage diverse security policies across cloud nodes, such as firewall rules, web filtering rules, user access rules, and more. How do you ensure your policies are consistent and effective across all your cloud nodes?

The answer lies within centralized policies. Centralized policies are a feature of Zenarmor that allows you to standardize your security policies effortlessly. You can create, edit, and apply your policies via a single dashboard that is accessible from anywhere. You can also sync your policies across all your cloud nodes with one click. Using centralized policies, you can streamline your security management and enhance your control over your cloud resources.

Cloud Scheduled Reports: Your Insights, Your Schedule

If you are a busy professional who needs to keep track of their cloud security performance, you know how tedious and time-consuming it can be to generate reports manually. You must log in to your dashboard, select the desired data, export the report in your preferred format, and then share it with your stakeholders. And you have to do this every day, week, or month, depending on your needs. Wouldn’t it be nice if you could automate this process and get your reports delivered to your inbox or cloud storage without any hassle? That’s what cloud-scheduled reports can do for you. This is a dedicated feature of Zenarmor that allows you to schedule your reports tailored to your preferences and needs. You have the freedom to choose your reports’ frequency, format, recipients, and destination. With cloud-scheduled reports, you can save time and effort and stay informed effortlessly.

Unlock Collaboration: Multiple Admins, Limitless Potential

Managing a firewall can be complex and challenging, especially when doing it alone. You might have to deal with multiple cloud nodes, platforms, regions, and user groups. You might have to handle different security policies, events, alerts, and reports. You must balance security and performance, compliance and flexibility, speed and accuracy. How can you make your firewall management more efficient and effective? The answer is collaboration. Collaboration is working with others on a common goal or project. With Zenarmor’s premium plans, you can unlock collaboration by having multiple admins in your account. With multiple administrators, you can enhance your workflow efficiency and delegation of responsibilities.

Utilizing the skills and expertise of your team presents a valuable opportunity to fine-tune and enhance the performance and security of your firewall infrastructure. This approach involves capitalizing on your team’s knowledge to delve into the intricacies of firewall management, enabling them to make informed decisions and implement customized configurations.

Role-based Firewall Management: Precision in Your Hands

One of the challenges of managing a cloud environment is controlling user access and permissions to your firewall. To do so, you need the ability to grant or restrict the access of different types of users to certain features, functions, or data. You should also comply with your organization’s or industry’s security and privacy regulations. This can be achieved through role-based firewall management without compromising your firewall performance or security.

Role-based firewall management is a feature of Zenarmor that allows you to create and assign customized roles to your users. While you have the flexibility to customize the roles based on your specific needs and preferences, you can also modify or delete the roles as needed. With role-based firewall management, you will be in a position to enhance your security and compliance by giving each user the right level of access and permission.

What is more, you can also simplify your firewall management by reducing the complexity and confusion around user roles. This entails streamlining the organization and specifications of user roles within your firewall system. By doing so, you will be creating greater clarity and transparency in allocating responsibilities and permissions, ultimately leading to a more efficient and straightforward management process.

Upgrade Today: Unleash Your Cloud’s Full Potential

Zenarmor is the most advanced cloud firewall solution that provides complete protection, performance, and control over your network. You can take a closer look and compare the different plans and prices that Zenarmor offers, like the Home, SOHO, and Business options. Now, you are ready to upgrade your cloud experience and unleash your cloud’s full potential. How do you do that? It’s simple. Just follow these steps:

1. Visit Zenarmor’s website and click on the “Upgrade” button. This will refer you to a site where you can check out each Zenarmor plan and feature. You can evaluate the plans to find out which one best meets the needs of your finances. You can also see the pricing and billing options for each plan.

2. Pick the option that best meets your requirements and price range. You may also choose to test out the product before purchasing. Once you have decided on your project, click the “Start Free Trial” or “Buy Now” button. You can confirm your purchase overview and activate any available promo vouchers or discounts.

3. Proceed to make the payment by any means suitable to you. You can pay with your card of choice, PayPal, or other means accessible in your area. You can also choose to pay monthly or annually.

4. Enjoy your premium cloud management features and benefits. You will also be able to access your dashboard and start using your premium features and benefits right away. You can manage your policies, reports, users, admins, and more via a single dashboard that is easy to use and customize. You can also contact Zenarmor’s support team anytime for help or guidance.

That’s it. You have successfully upgraded to premium cloud management software with Zenarmor. With this upgrade, you’ve unlocked a wealth of advanced features and capabilities that will empower you to optimize and secure your cloud resources with even greater efficiency and effectiveness. Congratulations! You are now on your way to achieving cloud excellence.

Network control and security are vital for any organization that wants to protect its data and resources from cyber threats. However, traditional firewalls and network devices are often limited in their ability to handle the complexity and diversity of modern network traffic. How can you achieve granular and flexible control over your network without compromising performance or usability? The answer is advanced policy-based filtering.

Policy-based filtering is an effective strategy for defining and enforcing distinct security policies and procedures for different categories of traffic. In this blog post, we will show you how you can master network control with advanced policy-based filtering using Zenarmor.

Understanding Policy-Based Filtering

Policy-based filtering is a technique that allows you to control and manage your network traffic based on different criteria and rules. It is crucial for network management because it helps you to:

• Enhance network security by blocking or allowing specific applications, web categories, users, IP addresses, VLANs, etc.
• Optimize network performance by prioritizing and shaping traffic based on your business needs.
• Simplify network administration using a centralized and user-friendly interface to create and monitor policies across all your network devices.

Policy-based filter matches traffic flows with predefined policies and applies the corresponding actions. A policy is a set of conditions defining what type of traffic to match and what actions to take.

Figure 1. Zenarmor Policy Configuration

Here is a step-by-step guideline to show how it actually works:

Step 1: Define the criteria for matching traffic. You can use various parameters, such as applications, web categories, users, IP addresses, VLANs, etc. For example, you can create a criterion that matches all the traffic from social media applications, such as Facebook, Twitter, Instagram, etc.

Step 2: Define the actions for the matched traffic. You can use various actions, such as block, allow, log, etc.

Step 3: To create a policy, integrate the requirements and the actions. You may give the policy an identifier and an explanation.

Step 4: Arrange the policies in descending order of significance. You can reorganize the policies by dragging and dropping them. The first relevant policy is applied to the traffic after all of the policies have been thoroughly examined.

Step 5: Set the policies to be rendered applicable only during specific periods or days. You can use a calendar and a clock to specify when the policies are active or inactive.

These are the steps involved in creating and applying policy-based filters for your network traffic. You can use Zenarmor to implement advanced policy-based filtering using a cloud-based management interface or the OPNsense WebUI.

Unleashing the Power of Advanced Policy-Based Filtering

Advanced policy-based filtering is a feature that allows premium users to leverage the full capacity of Zenarmor and gain more control and flexibility over their network security. Premium users can achieve the following thanks to the advanced policy-based filtering:

1. Defining policies based on IP, MAC, and Network addresses: You can customize your security rules for different devices, users, and groups on your network. For example, you can block social media for some devices, allow streaming for some users, and restrict access for some groups.

2. Fine-tuning web security to match unique requirements: This feature allows you to adjust your web filtering settings to suit your specific needs. For example, you can block gambling and adult sites for your network, allow educational and news sites for your students, and whitelist some domains or URLs for your staff.

3. Flexible security options, including exempted Networks and VLANs: With Premium, you can choose to bypass filtering for trusted sources or isolate sensitive segments on your network. For example, you can exempt some networks or VLANs from filtering, such as your VPN or your servers.

4. Enhanced network segmentation: This feature allows you to create separate zones with different levels of access and protection on your network. For example, you can create a public zone for your guests, a private zone for your employees, and a secure zone for your administrators.

5. Granular control over network traffic: This feature allows you to inspect, block, or shape any application or protocol on your network. For example, you can inspect encrypted traffic with TLS inspection, and block malicious or unwanted applications with application control.

Benefits and Outcome

You may increase the degree of control and flexibility over your network security with advanced policy-based filtering. By implementing advanced policy-based filtering, you can expect the following benefits and outcomes:

1. Enhanced security: You can block or allow specific applications, web categories, users, IP addresses, VLANs, etc., based on your security needs. You can inspect encrypted traffic and block malicious or unwanted applications and websites. This helps you protect your data and resources from cyber threats and prevent data breaches.
2. Better network performance: You can prioritize and shape traffic based on your business needs. You can isolate specific networks or VLANs from each other to create separate zones for different purposes. This helps you optimize network efficiency and reduce network congestion and latency.
3. Compliance with regulatory requirements: You can create policies that match the regulatory standards and best practices for your industry or region. You can log or alert you to traffic events and generate reports for auditing purposes. This helps you comply with legal and ethical obligations and avoid penalties or fines.
4. Simplified network management: You can use Zenconsole, a cloud-based management interface, to control and monitor the security policies and traffic across all the deployments. You can also use the OPNsense WebUI to configure and manage policies for Zenarmor. This helps simplify network administration and reduce operational costs and complexity.

This heightened level of control, combined with the ability to inspect encrypted traffic and block malicious elements, serves as a robust defense against cyber threats, effectively safeguarding your data and resources. Zenarmor’s advanced policy-based filter presents a holistic and practical approach to network security, setting the stage for a strong and efficient network infrastructure.

Zenarmor - Empowering Your Network Security

Achieving comprehensive network control and security is essential in today’s ever-evolving digital landscape. Traditional methods may fall short when dealing with the complexities of modern network traffic. This is where advanced policy-based filtering, as exemplified by Zenarmor, comes into play. By mastering policy-based filtering, you can enhance your network’s security, optimize its performance, streamline administration, and ensure compliance with regulatory requirements.

Implementing advanced policy-based filtering can seem like a daunting task for some. That’s where Zenarmor’s user-friendly approach and extensive capabilities truly shine. Zenarmor guides you toward a robust, efficient, and user-friendly solution to bolster your network security. With Zenarmor, you can leverage the full potential of advanced policy-based filtering to secure your network and optimize your web performance.

So, don’t hesitate to take the leap and explore Zenarmor for yourself. With advanced policy-based filtering, your network will be more secure, perform at its best, and simplify administration, all while safeguarding your data and resources from cyber threats.

If you haven’t already tried our free trial version, where you can test all the advanced features, you can now test our advanced policy-based filtering feature. If you are using the free trial and decide to upgrade to premium, you can easily upgrade your license from the subscription page.

Watch Now

Organizations can bolster their cybersecurity posture by shedding light on the rationale behind web access restrictions, identifying potential threats, and mitigating risks effectively. Such elucidations promote accountability and ethical usage, ensuring a balance between privacy and protection. In this blog, we embark on a journey to dissect the critical role of web-blocking explanations, shedding light on their profound impact on network security. To learn more about how Zenarmor can help you with web blocking and custom landing pages you can visit the page.

Why Custom Landing Pages Matter

A custom landing page is a web page that appears when a user tries to access a blocked website or web content. A custom landing page can inform the user about the reason for the block, the policy or rule that applies, and the options or actions the user can take. Custom landing pages are essential for website blockers because they can:

• Enhance the user experience and satisfaction by providing clear and helpful information and guidance.
• Increase user compliance and trust by explaining the rationale and benefits of the web-blocking policy.
• Reduce user frustration and confusion by offering alternative resources or solutions.
• Improve network security and performance by preventing users from bypassing the block or accessing malicious web content.

Figure 1: Block Notification Message for accessing a webpage or application

Organizations should pay attention to this feature and design custom landing pages that are relevant, informative, and engaging for their users. One way to create custom landing pages for web blocking is to use Zenarmor to block and control unauthorized or misbehaving applications and websites and display custom landing pages informing users why certain web content is blocked.

Benefits of Using Custom Landing Pages

Custom landing pages are crucial to network security, providing transparency and compliance enforcement. They educate users about website blocker policies, reduce frustration, and enhance security awareness. By empowering users with knowledge and options, these pages bridge the gap between security measures and user understanding, ultimately strengthening the organization’s cybersecurity framework.

Figure 2: Customizing Block Notification Page

Here are the benefits custom landing pages offer:

Enhanced Security Awareness

Custom landing pages can inform the users about the reason for the block, the policy or rule that applies, and the options or actions they can take. By doing so, custom landing pages can educate users about the potential risks and threats on the web and how to avoid or mitigate them. Custom landing pages can also provide tips and best practices for safe and responsible web browsing. Custom landing pages can contribute to a more informed and security-conscious user base, improving overall network security and performance.

Transparent Compliance

Custom landing pages can help organizations communicate and enforce compliance policies effectively by explaining the rationale and benefits of the web-blocking policy. It can also provide the users with relevant legal or regulatory information, such as the laws or rules that apply, the consequences of violating them, and the rights and responsibilities of the users. Custom landing pages can help users understand and accept the website blocker policy and avoid any disputes or conflicts arising. Custom landing pages can promote transparent compliance and trust between organizations and users.

Reduced User Frustration

User frustration is a common negative emotion that can arise when users encounter web blocking, especially if they do not understand why or how it happens. This can lead to dissatisfaction, anger, stress, or even attempts to bypass the block. Custom landing pages can alleviate user frustration by providing precise and informative messages or pages that explain why certain web content is blocked and what the user can do about it. It can also offer alternative resources or solutions to help users achieve their goals or needs.

Risk Education

Custom landing pages can be used to educate users about the potential security risks and threats they may encounter on the web. Custom landing pages can inform users about the type, source, impact, and prevention of blocked web content, such as malware, phishing, ransomware, etc. By doing so, custom landing pages can help users understand and avoid security risks, making them more security-conscious. Custom landing pages can improve the security awareness and behavior of users.

Permanent Bypass

Permanent bypass is a feature of custom landing pages that allows users to access blocked web content without entering a password or a code every time. It creates a cookie on the user’s browser that remembers their preference and authorization for particular web content. Permanent bypass can benefit users by saving them time and hassle and by giving them more control and flexibility over their web browsing.

Reduced Downtime

Downtime is when a user cannot access web content or services due to technical or security issues. Downtime can cause frustration, inconvenience, and loss of productivity for the user. Custom landing pages can contribute to reduced downtime by helping users quickly understand and address web access issues. By providing this information, custom landing pages can help users resolve their web access issues faster and easier and reduce the negative impact of downtime. Custom landing pages can improve the user experience and satisfaction during downtime.

Reduced IT Burden

Custom landing pages can reduce the IT burden by decreasing the workload on IT support and helpdesk teams. It provides users with self-service options and solutions, reducing the number of requests or complaints sent to the IT support or helpdesk teams. It also educates users about the website blocker policy and the security risks, such as malware, phishing, or ransomware. This can increase user compliance and awareness and prevent users from bypassing the block or accessing malicious web content.

User Empowerment

User empowerment is another benefit of custom landing pages for web blocking. Custom landing pages empower users with knowledge, making them responsible internet users within the organization. Custom landing pages provide users with clear and helpful information and guidance about the blocked web content, such as the reason, the policy, the options, and the solutions. It gives users more control and flexibility over their web browsing, such as permanent bypass, alternative resources, or contact information. This can help users make informed and rational decisions about their web access and behavior.

Zenarmor - Empowering Security

Custom landing pages play a pivotal role in network security and user communication. By enhancing security awareness, promoting transparent compliance, reducing user frustration, and facilitating risk education, these pages are integral to a well-rounded security strategy. To create custom landing pages for your network, you may want to check out Zenarmor. This software-based next-generation firewall provides comprehensive security for your network. With Zenarmor, you can effectively block and manage unauthorized or problematic applications and websites while seamlessly integrating custom landing pages to inform users about content restrictions. This combination of security measures is fundamental to a holistic security strategy in the ever-evolving digital landscape. Explore the unique features and get started with Zenarmor for free.

Watch Now

Imagine a world where your organization can streamline data flow and centralize insights effortlessly. Integrations provide that very opportunity. They act as the bridge that connects your security systems, enabling seamless data exchange and real-time monitoring.

Why are these comprehensive security insights so crucial? Simply put, they offer a 360-degree view of your network’s health. From the moment a potential threat is detected to the actions taken to mitigate it, a centralized system enhances your ability to detect, respond to, and prevent security incidents.

This blog will explore the significance of these insights in our ever-connected world. Let Zenarmor take you through the realm of integrations, where the power of data, streamlined flow, and heightened security converge to protect your digital assets.

The Need for Robust Security Insights

In today’s digital age, the importance of maximizing security insights cannot be overstated. These insights are crucial for several key reasons:

• Complex Threat Landscape: Cyber threats are continually evolving and growing in sophistication. Consequently, traditional security measures become insufficient to safeguard against these dynamic risks.

• Preventive Measures: Security insights offer a proactive approach to security. By continuously monitoring networks and systems, they ensure companies can detect and prevent potential threats before dire consequences occur.

• Data Protection: Comprehensive security insights ensure data protection, making it easier for businesses to comply with data protection regulations such as GDPR, HIPAA, and PCI DSS.

• Total Visibility: They provide organizations with total visibility into their systems and networks, allowing for quicker and more effective detection and response to security incidents.

• Predictive Analytics: By leveraging predictive analytics, security insights can identify potential threats before they occur, helping businesses stay vigilant and secure in the face of increasing threats.

Challenges Organizations Face Without a Centralized Insight System

Let’s take a look at the various challenges faced by organizations without a centralized insight system:

• Fragmented Security: Critical security information is scattered across various tools and systems, resulting in fragmented security management.

• Delayed Threat Detection: The lack of cohesion leads to delayed threat detection, making it challenging to respond swiftly to potential breaches.

• Ineffective Risk Assessment: The absence of a centralized insight system hinders proactive risk assessment, increasing the likelihood of data breaches.

• Financial and Reputational Damage: These challenges can result in significant financial and reputational damage in the event of a security incident.

In this dynamic digital landscape, the integration of advanced security insight services and centralized systems is the solution to these challenges. These insights empower organizations to protect against the ever-evolving threat landscape while ensuring peace of mind and security for their digital assets.

Streamlining Data Flow with SYSLOG Integration

Streamlining data flow through SYSLOG integration is a game-changer in the realm of security insight integration. This integration offers a trifecta of benefits that organizations simply cannot afford to overlook:

• Real-Time Monitoring: SYSLOG integration provides the capability for real-time monitoring of your network and systems. This means that as data is generated, it’s immediately transmitted to SYSLOG servers, allowing security teams to keep a constant watchful eye on the system. With this quick response capability, threats can be nipped in the bud.

• Log Management Simplification: You no longer need to spend hours sifting through endless log files. With SYSLOG integration, reporting data is seamlessly collected and centralized, making log management a breeze. This ensures that critical security data is easily accessible when needed, and it’s very time-efficient.

• Immediate Threat Detection: The ability to detect threats as they happen is a priceless advantage. SYSLOG integration enables immediate threat detection by providing real-time visibility into activities within your network. Suspicious activities can be flagged, investigated, and addressed promptly, minimizing potential damage.

The battle against cybersecurity issues and threats is hard, and SYSLOG integration is a crucial tool. It empowers organizations with real-time insights, simplifies log management, and ensures immediate threat detection. The result? Enhanced security, faster response times, and ultimately, peace of mind.

Integrations for SOHO and Business Users

The beauty of integrations lies in their versatility, benefiting small office/home office (SOHO) setups and larger businesses alike. Here’s how these integrations offer scalability and cost-effectiveness, regardless of the scale of your operation:

For small offices and home-based businesses, scalability is often a prime concern. Integrations can start small and grow with your needs. They adapt to the size of your operation, ensuring that even the tiniest of setups can access advanced insight security. Larger organizations require robust scalability. Integrations seamlessly accommodate the growing data flow and security demands of businesses, providing a flexible solution that scales effortlessly as the organization expands.

Budget constraints are common for SOHO setups. Integrations offer a cost-effective solution by minimizing the need for extensive hardware and personnel. In short, you obtain maximized security at a very reasonable price. Cost-effectiveness is equally vital for businesses. Integrations reduce operational costs by streamlining processes, optimizing resource utilization, and enhancing threat detection. This results in better resource allocation and cost savings.

Whether you’re running a small office or a large enterprise, integrations offer the perfect synergy of scalability and cost-effectiveness. They adapt to your needs and budget, ensuring that every business, regardless of size, can access advanced security insights tailored to their requirements.

Third-Party Security Tools Integration

Zenarmor takes security insights to the next level through seamless integration with various third-party security tools, enhancing your defense against cyber threats. Here’s how these integrations work:

Open-Source Firewalls

Zenarmor collaborates effortlessly with open-source firewalls like OPNsense and pfSense both built on FreeBSD. This integration bolsters your network security by combining the power of Zenarmor’s insights with the robust firewall capabilities of these open-source solutions. It results in a potent combination for safeguarding your network from threats.

Security Information and Event Management (SIEM) Systems

Zenarmor’s integration with SIEM systems is a pivotal step in enhancing your security posture. By collecting and analyzing security logs, Zenarmor ensures that critical data is shared with SIEM systems like Splunk, LogRhythm, QRadar, Datadog, and Wazuh. This collaboration enables in-depth analysis, correlation, and alerting to identify potential threats promptly.

Figure 1: Datadog Integration with Zenarmor

Wazuh and Zenarmor can be integrated to provide a more comprehensive security solution. When integrated, Wazuh can collect security events from Zenarmor and use these events to generate alerts, identify threats, and investigate security incidents. You can find more information about the Wazuh and Zenarmor integration in our YouTube video.

Network Traffic Analysis (NTA) Systems

The integration between Zenarmor and NTA systems such as NetFlow Analyzer and Suricata empowers organizations to monitor and analyze network traffic comprehensively. This real-time analysis detects anomalies and potential security threats, ensuring a proactive approach to safeguarding your network.

Authentication and DB Systems

For username resolution, Zenarmor supports Active Directory and OPNsense Captive Portal. If you have an Active Directory, you can integrate it with Zenarmor to obtain information about user logins and groups. Policies can be defined for AD groups and users.

Please see the Active Directory Integration Guide for more information on how to integrate AD with Zenarmor.

Figure 2: Active Directory agent for Zenarmor

If your OPNsense Captive Portal is operational, Zenarmor can obtain username information from it as well by integrating Zenarmor and OPNsense Captive Portal.

Zenarmor can be integrated with the following database systems:

• MongoDB
• SQLite
• Elasticsearch

MongoDB is a NoSQL document database that is known for its scalability and performance. SQLite is a lightweight relational database that is embedded in Zenarmor. Elasticsearch is a search engine and analytics engine that is based on the Apache Lucene project.

Take Your Security to the Next Level with Zenarmor

In a world where cyber threats evolve daily, security insights and integrations are your best allies. They provide threat monitoring and detection and cost-effective solutions. With Zenarmor’s third-party integrations, you gain an edge against evolving threats. And don’t forget to consider integrating your Active Directory. This integration empowers you to manage user identities and permissions seamlessly, enhancing overall security. Don’t wait; explore these integration options today, bolster your security, and protect your digital assets. Stay secure; stay ahead.

Watch Now

However, as enterprises expand and diversify their networks, the complexity of managing multiple firewalls grows exponentially. Configuring, updating, and monitoring these devices becomes a daunting task. This often results in:

• Operational Inefficiency: Manual configurations are time-consuming and error-prone.
• Inconsistencies: Managing numerous firewalls separately can lead to configuration inconsistencies.
• Limited Agility: Rapidly adapting to evolving threats becomes challenging.
• High Costs: Maintenance and management costs escalate with the number of firewalls.

To tackle these issues, modern enterprises turn to RESTful APIs, a technology that offers a solution to streamline firewall management, enhance security, and maximize operational efficiency. In the following sections, we will delve into the significance of RESTful APIs in enterprise software architecture and explore Zenarmor’s RESTful API as a robust tool for firewall management.

Figure 1: Zenarmor RESTful API

Understanding RESTful API

RESTful API Meaning: Representational State Transfer API (Application Programming Interface)

RESTful API Definition: RESTful API is an interface that two computer systems use to exchange information securely over the internet.

RESTful APIs excel due to their simplicity, scalability, and adaptability. They rely on HTTP requests for essential data operations - Create, Read, Update, Delete (CRUD), making them accessible and universally embraced.

RESTful APIs function as universal interpreters, enabling communication between diverse software systems:

• Client-Server Relationship: This clear division between clients and servers allows independent growth and scalability.

• Uniform Interface: RESTful APIs maintain consistent server responses, enhancing user-friendliness through hypermedia and eliminating the need for separate languages.

• Statelessness: These APIs don’t retain client session data, ensuring self-contained requests and lightening the server’s load.

• Cacheability: Caching data efficiently reduces server workload and boosts performance.

• Layered System: RESTful APIs organize complex systems into distinct layers, ensuring efficient interaction between them.

• Code-on-Demand (Optional): This feature allows clients to request executable code from the server, enhancing dynamic content execution.

Zenarmor’s RESTful API for Firewall Management

Zenarmor’s RESTful API emerges as a game-changing solution for enterprise firewall management. It is the key that unlocks unparalleled simplicity and efficiency in an otherwise complex landscape.

Configuring and managing multiple firewalls can be an arduous task. Zenarmor’s RESTful API simplifies these intricate processes. It transforms convoluted operations into straightforward commands, reducing the time and effort required. With intuitive endpoints and methods, you can easily create, read, update, and delete firewall rules, making it a breeze to adapt to evolving security needs.

Efficiency is the driving force behind Zenarmor’s RESTful API. Centralized management of multiple firewalls from a single location empowers administrators to exert control effortlessly. Bulk changes to firewall configurations can be executed seamlessly, saving precious time. Automated responses to security threats allow for rapid countermeasures, reinforcing your organization’s security posture.

Zenarmor’s RESTful API ensures that enterprise cybersecurity is no longer hindered by the complexities of firewall management. It offers an elegant solution that transforms your security infrastructure into a well-oiled machine. With time and effort savings, reduced risk of errors, enhanced scalability, and improved security, Zenarmor’s RESTful API is your key to mastering the art of firewall management. It’s time to elevate your enterprise security game with Zenarmor.

Key Use Cases

Zenarmor’s RESTful API isn’t just a concept; it’s a practical solution that transforms enterprise cybersecurity. Let’s explore real-world scenarios to understand how it can revolutionize your security management:

Automating Deployment and Configuration

Imagine onboarding new firewalls effortlessly. Zenarmor’s API allows you to automate the deployment and configuration of these security gateways. This saves time and guarantees consistent, error-free setups across your network. Whether you’re adding one or a dozen firewalls, the process remains streamlined and stress-free.

Centralized Management

In a sprawling enterprise network, managing multiple firewalls scattered across various locations can be a logistical nightmare. Zenarmor’s RESTful API simplifies this by providing centralized management. From a single control point, you can oversee and control all your firewalls, no matter where they’re deployed. This promotes efficiency and control in your security infrastructure.

Bulk Configuration Changes

Security needs to evolve, and so should your firewall configurations. With Zenarmor’s API, making bulk changes to firewall rules becomes straightforward. Whether it’s updating access policies, blocking threats, or adjusting traffic rules, you can enact these changes across multiple firewalls simultaneously, ensuring consistent and up-to-date security.

Programmatically Responding to Threats

Security threats don’t wait, and neither should your responses. Zenarmor’s RESTful API empowers your security team to respond programmatically. When a threat is detected, automated responses can be initiated instantly. It’s like having an army of digital guards ready to thwart intruders, minimizing response time and potential damage.

Zenarmor’s RESTful API isn’t just a tool; it’s a transformation. It streamlines complex security tasks, providing your enterprise with automation, centralized control, bulk configuration changes, and lightning-fast threat responses. It’s time to fortify your cybersecurity with Zenarmor’s API.

Benefits of Using Zenarmor’s RESTful API

Choosing Zenarmor offers you multiple benefits of the RESTful API for firewall management and configuration:

Time and Effort Savings

Zenarmor’s RESTful API simplifies the most intricate firewall management tasks. It automates processes that would otherwise demand extensive manual labor. This not only reduces workload but also accelerates critical operations. With Zenarmor, you’ll need mere minutes to accomplish something that would take hours otherwise.

Reduced Risk of Configuration Errors

Manual configurations are notorious for introducing errors, leaving vulnerabilities in your security infrastructure. Zenarmor’s RESTful API minimizes this risk by offering a structured and consistent approach to firewall management. The standardized process reduces the chances of human error, fortifying your defenses.

Enhanced Scalability and Flexibility

In the ever-evolving landscape of enterprise cybersecurity, the ability to scale and adapt swiftly is crucial. Zenarmor’s API centralizes the management of multiple firewalls, ensuring that your network can expand and adjust without complications. It’s a tool that grows with your needs, providing the flexibility essential for modern security.

Improved Security Posture

The ultimate goal of firewall management is to bolster security. Zenarmor’s RESTful API empowers your organization to respond rapidly to emerging threats. Automated threat responses, bulk configuration changes, and centralized control enhance your security posture. Your defenses become proactive, reducing vulnerabilities and ensuring that your network stays one step ahead of potential threats.

Zenarmor’s RESTful API is more than a tool; it’s a strategic advantage. It saves time and effort, mitigates risks, enhances flexibility, and fortifies your security posture. In an age where security is paramount, Zenarmor’s API is your ally in safeguarding your enterprise.

Getting Started with Zenarmor’s RESTful API

Embarking on your journey with Zenarmor’s RESTful API is seamless. Our comprehensive array of resources will provide a smooth on-ramp to harness the power of streamlined RESTful API firewall management. Coupled with our user-friendly interface and extensive documentation, you’ll find that integrating it into your firewall management processes is a breeze.

Also, you can watch our brief Zenarmor RESTful API video.

Zenarmor - Choose the right solution

The paramount importance of effective firewall management remains constant in the ever-evolving landscape of cybersecurity. Zenarmor’s RESTful API simplifies intricate tasks, reduces risks, and enhances your organization’s security posture. It’s a strategic ally, ensuring that your enterprise stays one step ahead of potential threats. Streamline your security management and embark on a journey of efficiency and control today.

To take full advantage of Zenarmor’s advanced firewall management capabilities and ensure comprehensive protection for your organization, we recommend upgrading to our paid subscription plans. Our premium offerings provide additional features and support to enhance your cybersecurity defenses. Don’t miss out on the next level of security – make the switch to a paid subscription today and safeguard your enterprise effectively.

Whether you’re new to APIs or a seasoned pro, our user-friendly documentation, other relevant resources, and support ensure you’re up and running in no time. Implement unmatched efficiency and control - get started with Zenarmor for free.

Here is where User-Based filtering and reporting come into play, a powerful feature of Zenarmor. In this blog, let’s understand how you can empower your network security with User-Based reporting. Whether you are a network administrator, a security analyst, or a business owner, User-Based reporting can help you achieve a higher level of security, compliance, and efficiency for your network.

Understanding User-Based Filtering

User-based filtering is a feature that allows you to create and enforce security policies based on the identity and role of each user in your network rather than just their IP address or device. User-based filtering is essential for network security. Because it enables you to:

• Block and control unauthorized or misbehaving applications and websites that may threaten your network or violate your organizational standards.

• Prevent data leakage and malware infections by restricting access to sensitive or malicious content based on the user’s clearance level and need-to-know basis.

• Optimize bandwidth usage and network performance by prioritizing or limiting the traffic of specific users, groups, or departments according to your business objectives and network capacity.

• Comply with regulatory and organizational standards by applying consistent and auditable security policies across your network, regardless of the user’s location, device, or connection type.

How does User-Based Filtering work?

Zenarmor’s user-based filter elevates network security with precision and transparency. User-based filtering integrates with popular user directory databases such as Microsoft Active Directory (MS AD). These databases store information about the users in your organization, such as their name, email, password, group membership, and role. Zenarmor can synchronize with these databases and use them as the source of truth for user authentication and authorization. Zenarmor can also integrate with OPNsense Captive Portal, a feature that lets you capture users’ credentials who connect to your network through a web browser. This way, you can identify and apply security policies to users not registered in your user directory database, such as guests or contractors.

Figure 1: Policy configuration for user-based filtering on Zenarmor

Benefits of Premium User-Based Filtering

You might be wondering what benefits you can get from upgrading to the premium version of Zenarmor. Premium user-based filtering offers you several advantages that can enhance your network security and efficiency. Here are some of the benefits offered to maximize the efficiency of your control over your network security:

1. Unlimited filtering capabilities: With Premium, you can create as many user-based security policies as you need without any limitations on the number of rules, criteria, or actions. You may also change the level of importance and sequence of the regulations depending on your unique requirements and preferences.

2. Enhanced reporting features: With premium user-based filtering, you can access more advanced and detailed reports and dashboards showing the network activity and security events of each user, group, or department in your organization. You can also schedule automatic reports and alerts for your email or other channels.

3. Improved network security: You can leverage the AI-based cloud threat intelligence of Zenarmor to protect your network from advanced zero-day attack campaigns that use encryption or other techniques to evade detection.

4. Better content control: You can block and control unauthorized or misbehaving applications and websites that may threaten your network or violate your organizational standards. You can also use application control and policy-based web filtering to manage the access and usage of various applications and websites.

5. Time-saving and efficiency: With Premium, you can save time and resources by automating and simplifying your network security management. You can easily integrate Zenarmor with your existing user directory database, such as MS AD, and use it as the source of truth for user authentication and authorization. You can also use the OPNsense Captive Portal to capture the credentials of users who connect to your network through a web browser.

It is vital that we equip ourselves with the latest network security measures to protect our digital environment from rapidly evolving threats. Premium user-based filtering can help you take your network security to the next level with granular control and visibility.

Exclusive Integration with MS AD and OPNsense

Zenarmor’s exclusive integration with MS AD and OPNsense is a game-changer for network security. It allows you to:

1. Identify and authenticate users across your network with ease and accuracy. You can use MS AD as the source of truth for user identity and role, and OPNsense Captive Portal to capture the credentials of web-based users.

2. Enforce consistent and auditable security policies across your network with flexibility and efficiency. You can create and apply user-based policies based on various criteria and actions and customize the priority and order of the policies.

3. Monitor and analyze each user’s network activity and security events with clarity and detail. You can generate user-based reports and dashboards that show you the data in various formats and schedule automatic reports and alerts.

This integration gives you a complete and comprehensive solution for user-based filtering and reporting that can enhance your network security and efficiency.

How to Get Started with User Based Filtering

To get started with user-based filtering, you need to upgrade to the premium version of Zenarmor.

Here are the steps to do that:

1. Choose the plan that best fits your needs and expenditure after comparing the features and plans. Three plans are available: Home, SOHO, and Business. You must select Business for MS Active Directory or Captive Portal integration to get the benefits of user-based filtering.

Figure 2: Zenarmor Plans Page

2. Under the plan you would like to invest in, click the Buy Now option. Once you submit the necessary billing information and payment approach, you will be taken to a safe checkout page.

3. Activate your license key by entering it in Zenarmor’s web interface. You will see a confirmation message that your license is valid and activated.

4. Also, you can upgrade your existing subscription via Zenconsole.

5. Enjoy the Business features of user-based filtering and reporting. You can access the user-based filter settings from the Policy Configuration menu in Zenarmor’s web interface.

Zenarmor - Network Security with Precision and Control

Zenarmor’s User-Based filtering and reporting offer an effective solution for network administrators and business owners seeking enhanced security, compliance, and efficiency. With its seamless integration with Microsoft Active Directory and OPNsense, as well as the option to upgrade to the premium version for advanced features, it empowers users to achieve granular control and comprehensive visibility over their network. This robust tool equips them with the tools necessary to tackle evolving cybersecurity challenges.

Watch Now

In this blog, we embark on a journey to explore the capabilities of advanced reporting with Zenarmor, shedding light on how they can empower organizations to bolster their cybersecurity strategies.

Our primary aim is to illuminate our advanced reporting features. We’ll delve into how these features can be harnessed to strengthen your organization’s cybersecurity posture. As we explore various aspects of our reporting capabilities, we’ll demonstrate how they enable proactive threat detection, efficient incident response, and compliance adherence.

The World of Custom Reports

In the ever-changing world of network security, having the right information is crucial. Custom reports are essential tools for network administrators and security experts. They give a personalized way to look at and understand data. These reports give a detailed view of network activity, threats, and user behavior. They help organizations get specific insights into their own security situation.

Custom reports let users sift through the data generated and extract the specific information that matters most to their operations.

The value of customized reports should not be overlooked. They are critical in making solid cybersecurity decisions. Premium users of Zenarmor are granted access to this powerful feature, enabling them to design reports that align with their organization’s specific needs and objectives. With custom reports, users can spot unusual patterns, see new threats, and check whether security rules work.

The benefits of custom reports extend beyond just data analysis. They help proactively mitigate threats with efficient incident response and optimizing security resources. With threats changing quickly and evolving daily, there are lots of risks. Custom reports provide the clarity and precision needed to navigate complex cybersecurity issues. Ultimately, they help organizations stay ahead of attackers, safeguard their assets, and protect their digital systems.

Data-driven decision-making is a crucial aspect of modern business and cybersecurity practices. It provides:

• Informed Decision-Making: Data-driven decisions are based on concrete facts and statistics rather than gut feelings or intuition. This leads to more informed and rational choices, reducing the risk of making costly mistakes.
• Optimized Resource Allocation: By analyzing data, organizations can identify patterns and trends in cyber threats and attacks. This allows them to allocate resources more efficiently, focusing on areas of higher vulnerability or potential impact, which can lead to cost savings.
• Proactive Threat Mitigation: Data-driven decision-making enables organizations to identify potential security threats and vulnerabilities before they are exploited by attackers. This proactive approach enhances cybersecurity by allowing for quicker response times and mitigation strategies.
• Continuous Improvement: Regular data analysis allows organizations to monitor the effectiveness of their cybersecurity measures. By identifying areas that need improvement, they can continuously enhance their security posture and adapt to evolving threats.
• Measurable Outcomes: Data-driven decisions can be quantified and measured, making it easier to track the effectiveness of security measures over time. This not only provides accountability but also helps in demonstrating ROI (Return on Investment) in cybersecurity initiatives.

In the context of Zenarmor’s advanced reporting capabilities, data-driven decision-making can be enhanced by providing clear and concise reports that offer insights into an organization’s cybersecurity landscape. These reports can help security professionals make more informed decisions to protect their digital assets effectively.

Revealing Insights with Reverse DNS Lookup

In the complex world of network security and management, understanding the origins of network traffic and the entities behind it is extremely important. This is where the reverse DNS lookup feature comes in handy. Essentially, a reverse DNS lookup maps an IP address to its corresponding domain name. This may sound technical, but it’s a big deal.

Zenarmor’s reverse DNS lookup feature provides a unique perspective on network users. It allows users to view both numerical IP addresses and their corresponding domain names. This seemingly minor shift in perspective yields valuable insights into the origins and activities of network users, offering a better understanding of their behavior and sources. This feature becomes a powerful tool for discerning where users originate and their online activities, enhancing network administrators’ ability to monitor and secure their network effectively.

Organizations can better understand who uses their network resources using a reverse DNS lookup. This tool allows network administrators to identify the traffic source, distinguish between trusted and untrusted domains, and keep an eye on what users are up to. This information is super useful for enhancing security measures, pinpointing potential threats, and ensuring that network resources are utilized efficiently.

A reverse DNS lookup helps organizations connect the dots between IP addresses and easy-to-read website names. It transforms raw data into actionable intelligence, empowering network professionals to make informed decisions. With a reverse DNS lookup, the hidden folks in the network background show who they are and what they’re doing, ultimately strengthening security and network management.

Sharing Success with Exportable Report Views

When it comes to network security and making decisions based on data, it’s crucial to share insights and data with the right people. Zenarmor’s exportable report views feature emerges as a powerful tool. It lets users take valuable information and present it in a way that’s informative and actionable for a better and more secure security infrastructure.

• Enhanced Data Sharing: The exportable report views offer a powerful solution for sharing critical insights and data within the organization. Users can effortlessly convert data into formats like PDF or CSV, facilitating seamless sharing with colleagues, supervisors, and external partners.

• Streamlined Collaboration: This feature simplifies the sharing of important information, promoting efficient collaboration and communication among stakeholders. Quick and informed decision-making is essential in an era of ever-evolving cybersecurity threats. Exportable report views enable users to present network activity, threats, and trends clearly and succinctly, fostering improved transparency and alignment in security strategy discussions.

• Facilitating Transparency: By making it easier to share data, exportable report views contribute to greater transparency in security operations. All parties involved can gain a shared understanding of security challenges and risk mitigation strategies. This alignment is crucial for effective security management and risk reduction.

• Demonstrating Effectiveness: Exportable report views play a pivotal role in demonstrating the effectiveness of security measures. Security professionals and administrators can effortlessly export and share reports showcasing security strategies’ success. This includes highlighting reductions in security incidents, achievements in compliance, and overall progress tracking.

• Celebrating Achievements: These views enable organizations to celebrate their security wins. Whether it’s acknowledging a decrease in security incidents or showcasing compliance milestones, exportable report views help in showcasing accomplishments, which can boost morale and encourage continuous improvement in security strategies.

Elevate Your Insights with Zenarmor Premium

Zenarmor Premium is not just a subscription; it’s an opportunity to take your network security and reporting capabilities to the next level. With advanced reporting, the Premium offers a suite of benefits that can truly transform the way you manage and safeguard your network.

The key benefits of advanced reporting are clear and compelling. From instantaneous traffic monitoring to trend data, users receive access to a multitude of data insights. You can detect risks ahead of time, optimize security measures, and maintain compliance with industry requirements. As data remains a critical component of good cybersecurity, exportable report views are a vital tool for enterprises looking to maximize the effectiveness of their security efforts. Zenarmor Premium empowers you to tailor your reports to your unique needs, providing granular control over the information you receive.

If you’re currently using the free version, it’s time to consider the advantages of upgrading to Zenarmor Premium. The enhanced reporting capabilities alone can significantly impact your network security strategy. With premium features, you can uncover hidden threats, make data-driven decisions, and efficiently manage your security resources.

Don’t miss out on the opportunity to explore the full potential of our solutions. Upgrade to Zenarmor Premium today and unlock a range of insights to help you fortify your cybersecurity defenses, protect your digital assets, and stay one step ahead of evolving threats. Elevate your network security game with Zenarmor Premium and experience the difference. Your network’s security and performance are worth the investment.

To explore the full potential of Zenarmor Advanced Reporting capabilities, you can watch our Advanced Reporting video.

Watch Now

Key Presenters: The webinar was a collaboration between two experts in the field:

• Murat Balaban: CEO and founder of Zenarmor, joined from the United States.
• Thomas Niedermeier, Senior Solution Engineer, OPNsense, Thomas-Krenn joined from Germany

Webinar Highlights:

Zenarmor seamlessly integrates with OPNsense, enhancing its capabilities with features such as intrusion prevention, application-level control, cloud-based threat intelligence, and advanced reporting and analytics, providing comprehensive insights into network traffic and top talkers for effective network security management.

• Benefits of Open Source Firewalls: Open-source firewalls offer advanced capabilities in packet filtering, port inspection, and application layer 7 filtering, making them a powerful choice for network security.

• Single, Unified Application: Zenarmor is a comprehensive security solution in one package, unlike some competitors that rely on multiple separate software packages.

• TLS Decryption and Inspection: Zenarmor provides TLS decryption and inspection to detect encrypted threats, a crucial component of modern cybersecurity.

• Application Control: The tool allows the creation of policies for network traffic control and filtering based on applications, a feature vital for business productivity and security.

• Cloud Threat Intelligence: Zenarmor integrates seamlessly with cloud-based threat intelligence services to defend against zero-day attacks, emerging phishing campaigns, and evasive threats.

• Partnership with Thomas-Krenn: The strategic partnership aims to deliver a top-end firewall solution by combining Thomas-Krenn hardware, OPNsense, and Zenarmor for comprehensive network security.

• Licensing Options: Zenarmor licenses can be easily obtained through their online shop, offering various editions and configurations. Discounts are available for additional licenses, and customization options are accommodated.

• Hardware Sizing: To ensure stable system performance, sufficient RAM is essential. Three different hardware scenarios were presented, emphasizing the importance of adequate resources.

• Virtual Environment Compatibility: It’s entirely possible to install OPNsense and Zenarmor in a virtual environment. Popular hypervisors like KVM, VirtualBox, and Microsoft Hyper-V are supported. The hardware requirements include a minimum of two CPU cores and four gigabytes of RAM. For optimal performance, using an ElasticSearch database is recommended.

Watch Now

You can find detailed information on the Zenarmor 101: Komponenten und Vorteile (Components and Benefits) webinar video

Let’s understand the advanced security rules’ crucial role in fortifying your cybersecurity posture. We’ll explore how these rules go beyond conventional measures, enabling you to proactively detect, mitigate, and respond to emerging threats. Whether it’s zero-day vulnerabilities, evolving malware strains, or novel attack vectors, advanced security rules are your shield against the unknown.

To illustrate these concepts, we’ll spotlight Zenarmor’s advanced security features. We’ll take a closer look at Zenarmor’s paid plans, which provide access to cutting-edge security capabilities to keep your organization one step ahead of cyber adversaries. From real-time threat intelligence to deep packet inspection and AI-driven defenses, Zenarmor’s advanced security features are a force to be reckoned with. To learn more about how to fortify your cybersecurity space, visit Zenarmor today.

Exploring Zenarmor’s Advanced Security Rules

Zenarmor’s Advanced Security Rules, available in its premium paid plan, represent a formidable arsenal in the battle against cyber threats. These rules empower organizations to fortify their defenses with comprehensive security measures:

1. Real-Time Threat Intelligence: The Advanced Security Rules provide real-time threat intelligence, enabling automatic blocking of emerging threats. This proactive approach ensures that your network remains resilient and protected.

2. Malicious and Phishing Server Filtering: Zenarmor excels in filtering out malicious and phishing servers, offering protection against new malware, viruses, and phishing outbreaks. This vigilant stance ensures that even the latest threats are effectively mitigated.

3. Blocking Newly Registered, Recovered, or Dynamic DNS Sites: By blocking access to newly registered, recovered, or dynamic DNS sites, Zenarmor closes off potential entry points for cybercriminals, bolstering your defense against various attack vectors.

4. Preventing DNS Tunneling: The advanced security measures include the prevention of DNS tunneling, a sophisticated technique employed by threat actors to evade detection and infiltrate networks.

Figure 1: Zenarmor Advanced Security Options

Get started with Zenarmor for free by exploring our advanced security rules and comprehensive network security tutorials. Enhance your cybersecurity posture and protect your network against emerging threats. Visit our documentation page to get started today!

Cutting-Edge Zero-Day Attack Protection

Zero-day attacks are among the most insidious and unpredictable cybersecurity threats, exploiting unknown vulnerabilities to software developers and security experts. These attacks strike swiftly, taking advantage of this “zero-day” window before patches or fixes are available. Zenarmor’s paid plan stands as a bulwark against such threats. It employs cutting-edge zero-day attack protection mechanisms, harnessing real-time threat intelligence to identify and thwart these emerging dangers.

Zenarmor employs cutting-edge technology to meticulously analyze network traffic, dissecting files at the packet level as they traverse through your network infrastructure. By leveraging advanced algorithms and extensive data resources, Zenarmor can swiftly identify a wide range of threats, including polymorphic malware and zero-day exploits. This rapid detection capability allows Zenarmor to take immediate action, either blocking malicious files or flagging them for deeper scrutiny, providing you with real-time protection against evolving cyber threats. Unlike traditional sandboxing methods, Zenarmor’s use of machine learning and vast datasets enables it to make lightning-fast threat assessments in mere milliseconds, offering a level of security that far surpasses conventional approaches.

Having a strong defense like Zenarmor is crucial for protecting sensitive data, infrastructure, and business continuity in today’s digital landscape where cybercriminals are enamored with zero-day vulnerabilities.

Protection Against New Malware, Virus, and Phishing Outbreaks

Protection against new malware, viruses, and phishing outbreaks is a paramount concern in today’s digital landscape, where cyber threats continuously evolve in sophistication and scale. Zenarmor, within its premium-paid plan, offers a robust defense mechanism to shield organizations from these ever-emerging dangers. The significance of this proactive protection cannot be overstated. Zenarmor stays vigilant around the clock, leveraging real-time threat intelligence and advanced security rules to detect and block the latest malware strains, viruses, and phishing campaigns.

In a world where cybercriminals constantly devise new tactics to breach defenses, Zenarmor’s ability to swiftly adapt and defend against the freshest threats is invaluable. It ensures that your organization remains resilient and unyielding in the face of the most recent and potent cyberattacks. With Zenarmor’s proactive approach to security, you can fortify your digital defenses, reduce the risk of compromise, and maintain the trust of customers, partners, and stakeholders. In an era where the digital threat landscape is ever-evolving, Zenarmor’s commitment to blocking the latest outbreaks is a shield of assurance for your organization’s cybersecurity.

Automatic Botnet Filtering

Automatic Botnet Filtering is an essential component of modern cybersecurity, given botnets’ pervasive and nefarious nature. These networks of compromised devices, controlled by malicious actors, pose a severe threat to organizations by enabling various malicious activities, including DDoS attacks, data theft, and malware distribution. Zenarmor’s advanced security rules, available in its premium paid plan, include an automatic botnet filtering mechanism to thwart these threats.

Zenarmor leverages cutting-edge AI-based cloud threat intelligence to provide real-time protection against zero-day malware, phishing attacks, and the instantaneous detection and blocking of emerging botnets. In the ever-evolving landscape of cyber threats, Zenarmor’s advanced capabilities extend beyond traditional IP, port, and DNS-based filtering by incorporating deep content inspection to thwart evasive threats.

Botnets, formidable armies of compromised devices, present a grave threat to the digital realm, capable of executing devastating DDoS attacks, orchestrating data breaches, and propagating malware. Zenarmor recognizes the critical need to combat this menace and fortify network security. By automatically identifying and obstructing communication between your network and known botnet command and control servers, Zenarmor’s Botnet C&C feature acts as a stalwart guardian. This defensive layer shields your data, devices, and online operations, ensuring uninterrupted cybersecurity in an increasingly perilous digital landscape.

Benefits of Automatic Botnet filtering:

• Automatic botnet filtering offered by Zenarmor prevents your devices from being recruited into malicious botnets, thereby safeguarding the integrity of your network.

• This feature effectively mitigates the risks associated with botnet-driven attacks, including Distributed Denial of Service (DDoS) assaults that can severely disrupt your operations.

• Zenarmor’s proactive botnet filtering ensures business continuity by preventing disruptions caused by botnet attacks. It helps protect critical data and maintains the trust of customers and partners.

• By automatically blocking botnet threats, Zenarmor provides a robust layer of defense to protect your organization’s digital assets from compromise and unauthorized access.

• Botnets are a prevalent cybersecurity concern, but Zenarmor’s automatic botnet filtering strengthens your overall cybersecurity posture, reducing the likelihood of falling victim to botnet-related threats.

Blocking DNS Tunnels

Blocking DNS Tunnels is a crucial aspect of modern cybersecurity, given the stealthy and evasive nature of DNS tunneling. These tunnels are covert channels cybercriminals use to exfiltrate data or execute malicious commands, often bypassing traditional security measures. DNS tunneling involves embedding unauthorized data within DNS queries and responses, exploiting the inherently trusted nature of DNS traffic. The potential risks posed by DNS tunnels are significant, including data breaches, command and control for malware, and data exfiltration.

Zenarmor’s advanced security rules, available in its premium paid plan, incorporate robust DNS tunneling detection and prevention mechanisms. Zenarmor can identify and block illegitimate DNS tunneling attempts by scrutinizing DNS traffic in real time. This proactive approach ensures that DNS tunnels cannot be exploited as a covert communication channel for cyberattacks.

DNS tunneling attacks can have dire consequences, from enabling data theft to facilitating the stealthy operation of malware within a compromised network. By effectively blocking these tunnels, Zenarmor bolsters an organization’s security posture, reducing the risk of data breaches and other malicious activities. We live in a day and age where cyber threats are becoming increasingly sophisticated and evasive. However, Zenarmor’s capability to thwart DNS tunneling is critical to safeguarding sensitive data and network integrity.

Upgrade for Proactive Security

In cybersecurity, where threats evolve incessantly, the need for proactive security has never been more critical. As we conclude our exploration of the vital components that fortify your digital defenses, it’s clear that Zenarmor’s Premium plan emerges as a stalwart safeguard against emerging threats. Our journey has highlighted the importance of advanced security rules, zero-day attack protection, malware/virus/phishing outbreak prevention, automatic botnet filtering, and DNS tunnel blocking. These elements within Zenarmor’s Premium plan collectively form a formidable shield, keeping your organization one step ahead of cyber adversaries.

Figure 2: Comparison of Zenarmor Plans

To truly fortify your security posture and remain resilient in the face of the unknown, consider upgrading to Zenarmor’s Premium plan. Its advanced security features are your frontline defense against the ever-evolving threat landscape. The consequences of a breach can be devastating, encompassing data compromise, financial losses, and reputational damage. A proactive stance is non-negotiable when cyber threats are relentless.

So, take the next step in securing your digital assets and operations. Upgrade to Zenarmor’s Premium plan and empower your organization to tackle emerging threats. Stay protected, stay vigilant, and stay ahead of evolving cybersecurity challenges. Your digital future depends on it.

Watch Now

Web profiles are the linchpin between an organization’s overarching security strategy and the intricate web of online content and applications its users interact with daily. These profiles serve as the initial stage for access control, filtering, and monitoring, allowing network administrators to precisely set boundaries.

Zenarmor takes this concept of web profiles to new heights with its custom web profile feature. In a domain where one-size-fits-all security solutions fall short in the face of rapidly evolving threats, they offer a tailored approach that lets organizations customize security policies to their unique needs.

The core of this innovation lies in the ability to modify security measures that overcome generic frameworks. They help adapt to the nuances of an organization’s web traffic, user behavior, and security objectives. Whether the aim is to safeguard against malicious content, enforce strict access control, or monitor user activities, these custom profiles serve as the vanguards of digital fortresses.

From content filtering to access control, from real-time threat detection to comprehensive reporting, we unlock the benefits of custom web profiles in Zenarmor, equipping you with the knowledge and tools to secure your digital space.

Explore Zenarmor’s comprehensive solutions, unlock the power of data-driven security, and take your network security to the next level. Visit our website now to learn more and get started on your journey to a safer and more secure network environment!

Why you need Custom Web Profiles

While predefined web profiles serve as valuable templates in network security, it’s essential to acknowledge their limitations and recognize scenarios where their application might fall short.

Figure 1: Custom Web Profiles

The key to fine-grained web filtering and content security

Predefined web profiles provide a convenient starting point for web filtering and content security. However, their inherent limitation lies in their one-size-fits-all approach. These profiles broadly categorize websites that may not align with the specific and nuanced requirements of modern organizations. This lack of granularity can result in over-blocking or under-blocking, impacting productivity and security. To truly meet the diverse needs of today’s digital landscape, organizations must complement predefined profiles with custom web profiles in Zenarmor that align precisely with their unique security policies and objectives.

Zenarmor enables organizations to tailor web filtering

While effectively categorizing web content into broad categories like social media or gaming, predefined web profiles frequently fall short of accommodating individual organizations’ specific and nuanced needs. Consider the contrast between educational institutions and creative agencies: the former often necessitates stringent controls over social media access to maintain focus on learning, whereas the latter relies on these platforms for marketing. Such differences highlight the limitations of predefined profiles, underscoring the importance of custom web profiles in Zenarmor that allow organizations to tailor web filtering to their unique requirements.

To ensure robust protection in the ever-evolving digital landscape

Relying solely on predefined profiles can leave organizations vulnerable to evolving web threats and emerging content categories. Cybercriminals continually develop new strategies and create malicious websites that these static profiles may not cover. Organizations may inadvertently expose themselves to zero-day threats and evolving cyber risks without timely updates and adaptability. To maintain robust protection, it’s imperative to complement predefined profiles with proactive measures, such as custom web profiles in Zenarmor and timely updates, ensuring that security policies remain aligned with the ever-changing digital threat landscape.

Zenarmor offers tailored solutions to ensure strict adherence to sector-specific requirements.

Highly regulated sectors such as healthcare and finance operate under stringent compliance standards. They must also adhere to internal policies that demand precision in content filtering and data protection. Predefined profiles, designed for general use cases, often fall short of fully aligning with these sector-specific requirements. Consequently, organizations within these domains must implement customized content filtering and data protection measures tailored to their unique compliance needs. This custom web profile in Zenarmor ensures that every aspect of web access and content handling adheres meticulously to the specific rules and guidelines governing these heavily regulated industries.

Proactively customize and fine-tune to meet evolving threats and unique operational needs.

Predefined web profiles offer a solid foundation for web content filtering and security policies. However, customization is paramount in today’s dynamic digital landscape, where threats constantly evolve and organizations possess diverse security, compliance, and operational needs. Organizations must be proactive and ready to augment these profiles with finely tuned configurations and policies that align precisely with their unique requirements. This adaptability of custom web profiles in Zenarmor empowers organizations to stay ahead of emerging threats, ensure compliance, and maintain a secure and efficient digital environment for their users. While predefined web profiles offer convenience in the initial setup, they should be seen as a starting point rather than a comprehensive solution. To effectively secure their networks, organizations should supplement these profiles with customized configurations and policies that address their specific requirements and keep pace with evolving cyber threats.

Safe Search Enforcement

Safe Search Enforcement is vital to upholding online safety and protecting users. This is particularly true in environments where content filtering is a big concern, such as schools and households with children. In today’s digital age, where the internet offers plenty of information, images, and videos, it is paramount to ensure that users, especially minors, are protected from potentially harmful or explicit content.

Figure 2: Enabling Safe Search Enforcement on Zenarmor Web Controls

This is where Zenarmor, with its robust capabilities, plays a pivotal role. Zenarmor enables Safe Search Enforcement by implementing strict controls over popular search engines like Google, Bing, and Yahoo. This enforcement ensures that when users perform web searches, the results are filtered to display only safe and appropriate content, effectively blocking access to explicit or sensitive materials. Safe Search Enforcement feature becomes invaluable for schools as it helps maintain a secure online learning environment, shielding students from inappropriate content and preserving a focused and educational digital space.

Likewise, for parents, Zenarmor’s Safe Search Enforcement becomes a powerful tool for parental control, offering peace of mind by safeguarding their children from exposure to unsuitable material during online searches. The benefits extend beyond the educational realm, as organizations and households can use Zenarmor’s Safe Search Enforcement to promote a safer and more controlled online experience for users of all ages. By enabling this feature, Zenarmor empowers administrators and parents to proactively mitigate the risks associated with unrestricted web access, reinforcing their ability to protect users from objectionable content and fostering a secure digital environment.

Benefits of Custom Web Profiles

Adopting custom web profiles within a network security framework offers many advantages that empower organizations to tailor their web filtering and content security policies with precision:

• Custom web profiles empower organizations to create finely tuned security policies that align with their specific requirements. Unlike one-size-fits-all solutions, these profiles offer granular control over web content filtering, enabling precise enforcement of access policies tailored to organizational needs.

• They shine in real-world scenarios where predefined profiles fall short. For example, educational institutions can craft profiles that allow access to educational resources while blocking distracting content, ensuring an optimal learning environment.

• They provide the flexibility to align web filtering policies with industry-specific compliance standards. Healthcare organizations, for instance, can enforce strict content filtering to adhere to patient data privacy regulations.

• By crafting custom profiles, organizations can proactively address emerging threats and categories of malicious content. This agility is vital in countering evolving cyber risks that predefined profiles may not cover adequately.

• They optimize network resources by allowing administrators to prioritize traffic based on business-critical needs. This ensures that essential applications and services receive the bandwidth they require.

• Custom profiles help identify and curb Shadow IT activities within an organization. By monitoring web activity and enforcing policies, organizations can minimize the use of unapproved applications and services, enhancing security and compliance.

• With robust reporting and monitoring capabilities, these features provide insights into user activities, helping organizations make data-driven decisions, spot anomalies, and respond to security incidents promptly.

• They enable user-centric controls, allowing organizations to define policies based on user roles or groups. This ensures that different departments or teams have access to the web resources essential for their tasks, enhancing productivity and security.

Figure 3: Custom Web Profile on Zenarmor

Take Control of Your Web Filtering Experience

Custom web profiles within Zenarmor represent a potent tool for organizations aiming to fortify their web filtering and content security strategies. The ability to create, fine-tune, and adapt web filtering policies according to specific requirements is invaluable in the ever-evolving landscape of cybersecurity. As we’ve explored, custom web profiles offer precision that predefined profiles simply cannot match. From educational institutions to enterprises, from content control to compliance enforcement, it empowers administrators to exercise comprehensive control over web access while safeguarding users from online threats.

The key takeaway is clear: customization is the key to an efficient web filtering experience. It enables organizations to align their security measures with their unique needs, whether maintaining a focused learning environment in schools or ensuring compliance with industry regulations in businesses.

For those looking to take control of their web filtering experience and leverage the full potential of this solution, Zenarmor offers a seamless solution. By upgrading to advanced web filtering capabilities, users can unlock enhanced control, real-time threat protection, and comprehensive reporting. The journey to a safer, more productive online environment begins with custom web profiles, and Zenarmor is here to empower you every step of the way. It’s time to harness the full potential of web filtering, starting with us. Upgrade your Zenarmor plan today for a safer and more secure online experience.

Watch Now

With these platforms having reached their respective end-of-life statuses, we regret to announce that Zenarmor will consequently be withdrawing support for these platforms effective November 10, 2023 which marks both the Last Ship Date and the Last Support Date for them under the Zenarmor environment.

What Does This Mean For You?

Post November 10, 2023, there will be a termination of availability for new Zenarmor packages on these legacy platforms.

Users who are currently running Zenarmor on any of these listed platforms must proactively take steps to upgrade their systems to versions that are actively supported by Zenarmor.

You can find the list of supported versions here.

We highly recommend users of FreeBSD 11, Debian 9, and Ubuntu 18.04 to initiate planning for an upgrade of their operating platforms at the earliest opportunity to ensure alignment with Zenarmor’s best practices.

Should you have any questions or need assistance with upgrading your platforms, please do not hesitate to reach out to our support team at .

Figure 1: Zenarmor Policies Dashboard

In this discussion, we’ll talk about the idea of using multiple security policies to make your defense stronger. We will explore how this approach lets organizations customize their security to their needs, effectively mitigating risks and responding to emerging threats. By the end of this article, you’ll understand how strategic deployment of multiple policies can help your organization be more flexible, adapt to changes, and stay on top of cybersecurity initiatives.

Challenges of a Single Default Policy: Breaking Through Security Limitations

In cybersecurity, using a single default security policy is a common practice, often serving as a baseline for network protection. But this approach has its drawbacks. A single default policy typically covers the essentials of network protection, such as blocking known threats and adhering to compliance standards. While that’s important, it often can’t adapt to modern organizations’ unique and evolving security needs.

Imagine a company that relies only on one default rule for its network security. It might give reasonable protection against known threats, but it could unintentionally limit what users can do that’s legitimate. For instance, stringent web filtering might block access to essential resources or applications required for specific job functions, affecting productivity. Also, this one-size-fits-all approach might not work well against emerging threats or sophisticated attacks that bypass conventional security measures. The limitations of a single default policy become evident when organizations require tailored security measures to safeguard critical assets and adapt to the evolving threat landscape.

Empower Your Security: Advantages of Multiple Policies

Relying only on a single default security policy can pose challenges in today’s cybersecurity landscape. Fortunately, a flexible solution to overcome these limitations is to use multiple security policies. Moving from the constraints of a single policy to a more diverse approach opens up many possibilities to strengthen your organization’s security. Organizations can adjust their security to their needs and adapt swiftly to emerging threats. The benefits of adopting multiple security policies are numerous and will be discussed further in the upcoming sections.

Crafting Time-Based Policies: Flexibility Tailored to Needs

Time-based policies provide a level of flexibility tailored to specific organizational needs. This feature can adjust security rules based on different timeframes dynamically. Imagine a scenario where an organization needs to bolster security during non-business hours while allowing more relaxed access during the workday. Time-based policies enable this customization, allowing administrators to automatically tighten security measures during off-hours and ease restrictions during peak productivity periods. Implementing this feature typically involves defining and associating timeframes with corresponding security rules, ensuring that security adapts seamlessly to the organization’s operational schedule, and enhancing protection without sacrificing efficiency.

Varied Policies for Different Users: Security Tailored to Requirements

One of the key advantages of implementing multiple security policies is the ability to create distinct policies for different user groups, thus tailoring security measures to meet specific requirements. Organizations often consist of various departments and roles, each with unique responsibilities and access needs. Organizations can ensure that security protocols align with individual roles and responsibilities by crafting varied policies for different user groups. This approach allows for fine-tuning security levels, granting access to the right users while maintaining a robust overall security posture. Such customization enhances protection and minimizes the risk of over-restricting or under-protecting specific user segments.

Device-Specific Policies: Isolation and Enhanced Protection

Varied policies for device-specific security offer a significant advantage in cybersecurity. In today’s digital landscape, organizations often rely on many devices for their operations, each with unique security needs. A one-size-fits-all approach is ineffective in addressing these diverse requirements. Crafting device-specific policies enables organizations to isolate and enhance protection as needed. For instance, stricter controls can be placed on servers to safeguard data integrity while allowing more lenient smartphone access to maintain user flexibility. This approach ensures that each device receives tailored security measures, optimizing protection while accommodating diverse organizational roles. By embracing this level of customization, organizations can strengthen their defenses, ensuring that security aligns with the specific demands of each device in their network.

Create Your Own Security Policies: Step-by-Step Guide

Creating your own security policies empowers you to take control of your organization’s cybersecurity strategy. This step-by-step guide will walk you through crafting tailored security policies that align with your unique needs and priorities. By the end of this walkthrough, you will have the confidence and expertise to design security policies that bolster your defenses and adapt seamlessly to the evolving threat landscape.

Crafting Time-Based Policies: Policies Aligned with Specific Timeframes

Crafting time-based policies is crucial to aligning your security measures with specific timeframes and enhancing your organization’s cybersecurity strategy. These policies enable you to adjust your security rules dynamically based on different periods of the day or week. For instance, you can tighten security during non-business hours to ward off potential threats while easing restrictions during peak operational times.

For a practical example of implementing time-based policies, consider Zenarmor, a robust cybersecurity solution. Zenarmor allows you to create time schedules within your policies to control when those policies are active. Here’s how you can use time schedules with Zenarmor:

• Creating a New Schedule:
  • In the Zenarmor interface, click on the “+Add New Schedule” button in the Time Schedules pane.
  • A dialog box will open where you can name the schedule. For instance, you can name it “Non-Business Hours.”
  • Enter the name and click the “Add” button to add the new schedule to the Time Schedules list.
• Defining Active Days and Hours:
  • Select the specific days you want this schedule to apply to. Selected days will be displayed with a solid blue checkmark icon.
  • Specify the starting and stopping hours for which the policy will be effective. For example, you might set it to be active from 6:00 PM to 6:00 AM.
• Managing Schedules:
  • All added time schedules are listed in the Time Schedules pane for your reference.
  • You can easily update the existing time schedule by adjusting the start/stop hours and selecting deselecting the days as needed.
  • If you need to remove a schedule, simply click on the “Remove” button with a trash icon and confirm the removal when prompted.

Figure 2: Time Scheduled Policy configuration with on Zenarmor

By incorporating time schedules into your policies with Zenarmor, you can tailor your security rules to align with your organization’s operational schedule. For instance, you can apply stricter security measures during non-business hours when the network may be more vulnerable and relax these rules during peak operational times to ensure smooth workflow. This dynamic approach to cybersecurity helps keep your organization protected precisely when and where it’s needed most.

Designing Policies for Different Users: Customized User Groups

Designing policies for different users and user groups is a crucial aspect of customizing your organization’s cybersecurity strategy. Zenarmor offers user-based policy filtering, which allows you to create policies tailored to specific users or groups. This capability is essential because organizations often have diverse departments and roles, each with distinct responsibilities and access requirements.

Here’s how you can enhance your cybersecurity strategy using Zenarmor user-based policy features with MS Active Directory or OPNsense Captive Portal integration:

• User-Based Policies:
  • Navigate to the Configuration page of the policy you want to customize.
  • Click on the “+ Add user” button to associate a specific user with the policy.
  • Enter the username you wish to apply this policy to.
  • Click the “Add” button to confirm the association.

For example, for the finance department, you can create a policy that enforces stringent access controls for users handling sensitive financial data.

• Group-Based Policies:
  • Similarly, you can create policies based on user groups.
  • Click on the “+ Add group” button in the policy configuration.
  • Enter the group name you want to associate with the policy.
  • Click the “Add” button to confirm the group association.

For instance, marketing teams may require policies with more relaxed restrictions to encourage creativity and collaboration.

• Fine-Tuning Security:
  • Once you’ve associated users or groups with policies, these policies can have specific security rules that cater to their unique needs.

By implementing user and group-based policies, you can ensure that security measures are aligned with individual roles and responsibilities within your organization. This approach allows you to:

• Grant the appropriate level of access to users, ensuring that sensitive data remains protected.
• Customize security settings based on department requirements, promoting flexibility and productivity.
• Maintain a robust overall security infrastructure while accommodating the diverse needs of your organization.

Zenarmor’s user-based policy filtering empowers you to create a cybersecurity strategy that is not only effective but also tailored to the specific requirements of different users and user groups within your organization.

Tailoring Policies for Various Devices: Comprehensive and Adaptable Protection

In the ever-evolving landscape of technology, adapting security rules to cater to different devices is paramount to achieving comprehensive and flexible protection. Zenarmor, a software-based firewall, excels in this regard by offering device identification and asset discovery features. These capabilities enable Zenarmor to effectively block and filter devices based on their unique characteristics, including MAC addresses, IP addresses, and network attributes.

Here’s how Zenarmor enhances your cybersecurity strategy with its device-based blocking capabilities:

• IP / Networks Policies:
  • Zenarmor allows you to create policies that are specifically applied to IPv4/IPv6 addresses.
  • You can input single IP addresses.
  • Additionally, you have the flexibility to include descriptions for these entries, making it easier to recall the purpose of each IP address.
• MAC Addresses Policies:
  • Zenarmor empowers you to establish policies that target devices based on their MAC addresses.
  • You can assign descriptions to these entries, ensuring clarity about which device each MAC address belongs to.

We’re also excited to announce that Zenarmor is actively developing an advanced device identification feature that will soon be available to enhance your network security. Stay tuned for its upcoming release as we continue to prioritize your cybersecurity needs.

Figure 3: Zenarmor Device Identification Dashboard

By leveraging Zenarmor’s device identification and policy customization capabilities, organizations can effectively address the specific security needs and vulnerabilities of various devices within their network. This approach offers several advantages:

• Tailored Protection: Security rules can be fine-tuned to match the unique features and requirements of different devices, such as smartphones, laptops, and IoT devices.
• Threat Mitigation: Device-specific policies allow organizations to address vulnerabilities and weaknesses unique to each device type, bolstering defenses against potential threats.
• Resource Optimization: By customizing security rules, organizations can allocate security resources efficiently, ensuring that devices with higher security needs receive the appropriate level of protection.

Zenarmor’s device-based blocking capabilities enable organizations to craft a flexible and comprehensive cybersecurity strategy. This strategy ensures that security measures are precisely aligned with the characteristics and security needs of individual devices, ultimately enhancing the overall security posture of the organization.

Figure 4: Device-based filtering using MAC Address on Zenarmor

Understanding Policy Allocation: How Many Policies Does Each Plan Include?

We understand that as your digital infrastructure expands, the need for flexibility in policy allocation becomes crucial. In today’s dynamic landscape, organizations must tailor their security measures to meet evolving needs while staying within the bounds of their subscription plans. To clarify policy allocation, Zenarmor offers various subscription plans, each with a distinct policy allocation structure. These plans are designed to cater to different organizational sizes and requirements. By visiting the plans page, you can explore the detailed breakdown of policy allocation for each plan, making it easier to choose the one that best suits your organization’s needs. With this information at your fingertips, you can make informed decisions about policy allocation and ensure that your cybersecurity strategy aligns seamlessly with your evolving digital environment. Zenarmor’s commitment to transparency empowers you to optimize your security policies while staying within your chosen plan’s policy limits.

Transition Today for Enhanced Security and Freedom!

We emphasize the significance of transitioning today to embrace the power of multiple policies for enhanced security and freedom. By taking action and upgrading to a plan that aligns with your organization’s needs, you can empower yourself with a robust cybersecurity strategy that adapts to your unique requirements. This transition bolsters your defenses against evolving threats and affords you the flexibility to customize security measures to match your digital landscape. It’s a step towards a safer, more secure, and more agile future. So, don’t wait—make the transition today and experience the empowerment and peace of mind that come with knowing your organization is well-prepared to navigate the complex cybersecurity challenges of the modern world.

Watch Now

However, as the children navigate this space with youthful curiosity, they face a barrage of risks that can often be invisible to the untrained eye. From harmful content like racism and extremist ideologies to insidious threats like phishing scams and online gambling, the online world presents challenges that can impact their mental, emotional, and even physical well-being.

For IT professionals in the UK education sector, the imperative is clear: robust cybersecurity is not just about protecting data; it is about safeguarding the mental and emotional well-being of students.

In this article, we explore the capabilities of Zenarmor and how it supports the mission of providing children’s online safety in UK educational institutions.

Its sophisticated filtering, vigilant monitoring, and comprehensive reporting features are tailored to address the unique challenges these establishments encounter.

To ensure a solution that aligns seamlessly with the highest standards, we have thoroughly referenced authoritative national documents such as “Keeping Children Safe in Education” by the Department for Education as well as “NEN Tecnichal Standards for Multi-Academy Trusts” by the NEN, The Education Network.

It’s noteworthy that Zenarmor collaborates with Bright Cloud, a dedicated member of the Internet Watch Foundation (IWF). This partnership amplifies Zenarmor’s commitment to combating online child abuse, making it a reliable partner for educational institutes. By leveraging Bright Cloud’s extensive database of harmful websites, Zenarmor enhances its capability to provide a safe online experience for students.

Crafting Harmful Content-Free Digital Spaces: Proactive and Effective Content Filtering for Students

A pressing concern for educational institutions is the ease with which students can inadvertently stumble upon or be targeted with harmful content. These can range from inappropriate material such as pornography to alarming content that promotes racism, misogyny, or self-harm. Equally concerning is the rise of fake news, which can distort a child’s worldview, and extremist content that pushes radical ideologies.

As it was addressed in the statutory guidance on Keeping Children Safe in Education, the harmful content is categorized as one of four areas of risk:

content: being exposed to illegal, inappropriate, or harmful content, for example: pornography, fake news, racism, misogyny, self-harm, suicide, anti-Semitism, radicalization, and extremism.

Safeguarding children in schools from this vast and ever-evolving array of issues is a significant challenge, necessitating advanced technological solutions, including robust filtering mechanisms.

AI-Based Security Policies for 300 Million+ Web Sites

Filtering is akin to setting boundaries in the digital world. By curating the content that students can access, schools can effectively reduce exposure to harmful and inappropriate material. Not only does this provide a safer online environment, but it also aids in shaping a focused and distraction-free digital learning space. Furthermore, with the UK’s diverse cultural fabric, it’s essential that these filters are sensitive to the needs of all students, ensuring a digital experience that’s both inclusive and secure.

Integrated into this dynamic safety framework is Zenarmor’s standout feature: AI-based threat intelligence. This feature, included in all subscription levels from the Free to the Business Edition, affords robust safeguarding for your network against a vast digital frontier comprising over 300 million websites and domains. Such comprehensive coverage ensures a sophisticated layer of protection, diligently screening out harmful content falling under 60 distinct categories. This means that educational institutions can effortlessly implement security policies across a colossal array of websites, fortifying the digital boundaries for students.

With Zenarmor, the once formidable challenge of safeguarding students from harmful or inappropriate online content while delivering a top-tier internet experience is now seamlessly manageable. Zenarmor eliminates the need for additional software installations on individual devices, enabling you to swiftly establish detailed access policies. Its prowess is further underpinned by an AI-enhanced, cloud-based web categorization database, offering real-time classifications for hundreds of millions of sites. Impressively, even unknown sites get categorized in under five minutes. Zenarmor goes beyond simple categorization; it allows institutions to block or control unauthorized applications, regardless of their port numbers. Customizable web and application categories for blacklisting or whitelisting can be crafted effortlessly. All of this is bolstered by a comprehensive application database packed with signatures for thousands of applications, ensuring that educators wield a state-of-the-art defense mechanism.

The Silent Watchdog: Prioritizing Monitoring for a Secure Educational Cyberspace

The digital realm is not just laden with inappropriate or harmful content; it also harbors a myriad of more covert threats that can subtly entangle the unsuspecting. Among these are the lures of online gambling, designed to tempt students into a spiral of addictive behavior and potential financial ruin. But it does not end there. Inappropriate advertising can pop up without warning, pushing products or services that are unsuitable or even harmful for younger audiences.

More sinister still are phishing attempts and financial scams. Crafted to deceive, these threats prey on the inexperienced, seeking to extract personal and financial information for malicious ends. Phishing attacks represent a significant risk to UK educational establishments. A recent audit conducted by the National Cyber Security Center (NCSC) disclosed that an alarming 73% of UK schools have been targeted by phishing attempts.

In the face of these multifaceted threats, both filtering and monitoring stand as a school’s guardian duo. Filtering acts as the proactive gatekeeper, blocking access to gambling sites, screening out unsavoury ads, and thwarting malicious domains. Monitoring, on the other hand, serves as the vigilant watchdog, keeping a real-time eye on network activities. It not only detects potential threats and irregular behaviours but also raises timely alerts for swift intervention.

For UK educational IT professionals, integrating these two powerful tools is not just a technological tactic—it’s a comprehensive approach to digital safety, ensuring every student’s online experience remains secure, genuine, and educationally enriching.

As it is underlined in the relevant document by NEN

“All access to the internet should be filtered through an educationally relevant internet filtering system such that pupil access is filtered and monitored in accordance with the ‘Keeping Children Safe in Education’ document, paragraphs 140 – 147 (2022 document). This should be achieved using a product which meets the requirements and should ensure granular control of internet access for all users.”

In light of these stringent and necessary guidelines set forth by NEN, and in recognition of the paramount importance of each student’s online safety, Zenarmor emerges not merely as a tool but as an ally for UK educational IT professionals. Its advanced features offer not only adherence to the prescribed standards but go above and beyond, delivering a nuanced and secure digital experience tailored for both students and staff alike.

Zenarmor’s capability to implement user and group-specific access controls ensures a tailor-made online experience for every student and staff member. Through seamless integration with platforms like Microsoft Active Directory or OPNsense Captive Portal, Zenarmor provides granular filtering, striking the right balance between access and safety. Beyond mere access control, its advanced algorithms are adept at detecting any deviations from typical user behaviors, ensuring that potential threats or misuses are promptly identified and mitigated. For educational establishments striving for a secure and efficient digital environment, Zenarmor proves to be a cornerstone.

Zenarmor addresses also the risk of students inadvertently accessing unregulated content through proxy servers and anonymous browsing sites. These platforms often bypass established safeguards, exposing young users to potential online dangers. Our feature proactively blocks access to such sites and applications including those using circumvention tactics like web translation platforms to skirt filters or monitors.

In an evolving cyber threat landscape, Zenarmor stands as a reliable ally for UK schools, offering advanced, user-friendly cyber security solutions. Seize exclusive 50% discount on Zenarmor subscriptions to arm your institutions with AI-based threat intelligence, precise filtering, and vigilant monitoring, ensuring a safe, inclusive online learning environment for all students.

Unparalleled online safety for your students is just a click away at an unbeatable price.

A brief list of the updates included in this release are as follows:

• Full-featured role-based multi-tenancy support, including account and project sharing.
• An improved and more performant dashboard frontend built using the Vue.js 3 JavaScript framework.
• The addition of new web and application filtering categories.
• General bug fixes and minor UI improvements.

When you are ready, let’s unpack and talk about these new capabilities in a bit more detail.

Why is Zenarmor’s full-featured role-based multi-tenancy support advantageous in enterprise environments?

Multi-tenant architecture is prevalent across enterprise environments and is seen frequently in SaaS and other cloud-based applications. The implementation of a full-featured role-based multi-tenancy architecture into Zenarmor makes sense because it’s likely that in a large enterprise deployment, you will have multiple Zenarmor instances across multiple locations deployed, or in the case of an MSSP you may have multiple clients running Zenarmor instances that you are managing on their behalf, which all require varying levels of administrative user access.

As of this release, managing multiple administrative users and their roles is a simple task. Zenconsole now supports role-based sharing for projects, enabling users to control and customize project access and collaboration based on specific roles and permissions. A project in terms of Zenconsole, is basically a container or folder in the platform that allows you to group Zenarmor firewall instances. If you are an enterprise, you could create a project for each branch site or office, whereas an MSSP could create a project for each of their clients, the choice is yours.

Users can now be assigned the roles of owner, admin, operator, and viewer with an account session and full audit log feature, empowering administrators to view and manage active sessions with ease while monitoring all session information about the user, including platform, browser, IP address, location, login, last seen, and remotely terminating sessions.

In addition to this, should a user make changes to a Zenarmor instance or policy setting, the changes are reflected in real-time across all active user sessions, which mitigates any potential configuration inconsistencies if multiple administrators or operators are present.

Why making use of the Vue.js 3 frontend framework in the Zenconsole dashboard UI is beneficial

Vue.js is a popular JavaScript development framework used for frontend web development that is not only lightweight but also offers incredible speed and performance, which is made possible by the framework’s ability to make use of virtual document object models (DOM) and two-way bindings, which eliminates the need to keep re-rendering the entire DOM, perhaps better understood as the components or objects that make up the web application that you interact with, like text, buttons, tables, etc., every time there is an update. This makes Vue.js ideal for applications that need to display real-time data and updates, like in the case of the Zenconsole dashboard.

To avoid diving too deep into the world of frontend web development, these combined Vue.js capabilities basically allow the Zenconsole frontend development team to give you the best possible dashboard experience by making sure that all real-time data like live connection sessions, informational graphs, etc. are updated and displayed as quickly as possible while maintaining a snappy user experience navigating between dashboard menus and settings overall.

Some new web and application categories included in this release.

Several new web and application filtering categories have been introduced that are fairly self-explanatory including:

• THC/Cannabis Products
• Generative AI

In addition to this, you can now seamlessly import and export custom web category lists, making it easier to maintain and share custom web category configurations. Further enhancement ensures that custom web category content is accurately displayed in the exclusion list, allowing for better overall control and customization.

Other noteworthy additions in this release

• Zenconsole reporting capabilities are enhanced by adding new chart types that are already available on OPNsense web UI, like Top Destination Locations Heatmap, Table of Local Assets, Table of Remote Hosts, TLS/DNS/Web-Top Egress/Ingress Users, providing improved visualization options for a richer monitoring experience.

• Zenarmor’s Web UI menu has been seamlessly integrated into the OPNsense user privilege system.

• Improved subscription management and other minor UI improvements.

Are you ready to try Zenarmor 1.15 for yourself?

If you answered yes to this question, and you are an existing Zenarmor customer, head over to either Zenconsole or your OPNSense dashboard and apply the 1.15 update.

Alternatively, If you are new to Zenarmor and would like to explore the great capabilities that Zenarmor has to offer, you can simply sign-up and start your Zenarmor Business Edition 15-day trial, with no credit cards required.

Alternatively, feel free to contact Zenarmor at and ask for assistance getting your free trial setup and started today. We’d love to hear from you!

Watch Now

In this article, we will be discussing why this change was necessary and we will also take a quick look at what the new interface has to offer, we do however encourage you to download Zenamor 1.14 and experience it for yourself.

Why did Zenarmor make this change?

Over the past few months, there have been a number of improvements and some changes at Zenarmor including the recent rebranding and official name change from Sunny Valley Networks to Zenarmor. In order to continue with this momentum, it was decided to do away with the dated OPNsense Zenarmor interface and was totally rewritten to share some design and functional elements of its more modern and intuitive counterpart the Zenconsole dashboard part of Zenarmor’s free-to-use cloud-based firewall management platform that some of you may already be familiar with. These changes now provide an identical experience to Zenconsole, giving administrators options as to how they would like to manage Zenarmor on their OPNSense firewalls.

Putting modernism and aesthetics aside, the interface changes introduced in Zenarmor 1.14 also offer some functional advantages. By creating a unified user experience across both OPNsense and Zenconsole, a sense of consistency and standardization across the software ecosystem is now established, which means regardless of what platform you are on, OPNsense or Zenconsole, you will have a familiar workflow experience. This in itself is advantageous to you as the end-user, meaning a reduced learning curve between different platforms, but also advantageous to the Zenarmor development team, as only one user interface will need to be developed and maintained. This in turn will allow the development team to refocus the resources that would otherwise be spent on maintaining the old OPNsense dashboard to other more important functional improvements to the Zenarmor product as a whole.

How do the changes look?

We have mentioned it before and will mention it again, we highly encourage you to download or update to Zenarmor 1.14 to explore this new interface for yourself, however, if you are slightly impatient like me or hesitant, whatever the case, and would like a sneak peek of the new interface before you fully commit to it, we have included a few screenshots below to get your feet wet.

Figure 1: Main dashboard view of Zenarmor within OPNSense with identical layout, styling, and functionality as seen in Zenconsole

Figure 2: The reporting dashboard included more modern and intuitive graphs giving you complete visibility as to what is happening in your network

Figure 3: The live session view, this part of the dashboard is incredibly useful when it comes to exploring the live traffic traversing your network

Figure 4: The activities explorer is a new addition to the dashboard that allows you to quickly view the Applications and Web Traffic traversing your network and totals the number of sessions observed allowing you to easily identify the top-talkers on your network

Figure 5: The policy configuration menu now has the same clean look as what is seen in Zenconsole

Figure 6: The settings menu shows all of Zenarmor’s settings accessible from one intuitive menu

Figure 7: The all-new built-in notifications dashboard, now included on OPNsense

Change summary and some noteworthy mentions

Below we have included a few changes that we have cherry-picked and feel are noteworthy, however, for a more comprehensive list please refer to the changelogs for this release:

1. The Zenarmor status panel has now moved to the main dashboard giving you a single pane of glass to view your Zenarmor installation, including health status, NICs, engine status, etc, you will be familiar with this if you have used Zenconsole, see figure 1 above.

2. The default deployment mode is now set to Routed L3 mode with emulated netmap drivers. If you have followed recent articles published in this blog, you may have seen an article titled, Towards a device-agnostic netmap in the FreeBSD kernel which explains Zenarmor’s financial contribution and involvement in developing an emulated netmap driver to overcome hardware support limitations. We suggest that If you have not already read that article you go check it out as it details the reasons for the much-needed move to the emulated netmap driver.

3. New notification features have been built into OPNsense as well as the ability to provide feedback and submit log files easily through a dedicated feedback section.
   
   

4. All of the Zenarmor settings options have been moved to the OPNSense sidebar to provide the user with a quick means to access them following a typical OPNsense style workflow instead of having these options buried deep in the dashboard.

Final thoughts…

So are you ready for Zenarmor 1.14? If you would like to get your feet wet and explore the new and improved Zenarmor and OPNsense dashboard, simply update your Zenarmor installation, it will only take a few minutes. If you are new to Zenarmor, head over to your plugins and install the Zenarmor plugin and try Zenarmor for free on a 15-day trial, with no credit cards required, and give your security posture a boost.

Alternatively, feel free to contact Zenamor at and ask for assistance getting your free trial set up and started today. We’d love to hear from you!

Watch Now

Zenarmor v1.14 is a significant upgrade. This is why we’ve prepared this guide to help you navigate this upgrade smoothly.

Figure 1: Zenarmor 1.14 Dashboard on OPNsense

Even though it has been rigorously tested by the Zenarmor team and upgrading to Zenarmor is a simple procedure that allows you to upgrade your system without incident, it is best to be prepared for Murphy. It is crucial to proceed with caution to avoid disruptions and data loss.

Sometimes unfortunate events occur when we least expect them or are least prepared for them. With each software update, there is a small chance of data loss. Software upgrades can be difficult, time-consuming, and hazardous if not performed correctly. Occasionally, significant feature changes necessitate the reorganization of data during the revision procedure. Upgrade flaws, process interruptions, and unique use cases can all lead to software update corruption. Worse still, entire sections of the software may become corrupted. In uncommon but not unheard-of instances, the entire installation may become corrupt.

In this post, we will give you a hand in upgrading your Zenarmor NGFW smoothly.

What are the Tips for Zenarmor Upgrade?

Software upgrades can be challenging, but if you follow the advice below, the process can be relatively straightforward and have minimal impact on your business. Here are the best practices that you may follow to upgrade your Zenarmor safely:

1. Create Snapshot: Before beginning the upgrade procedure, create a snapshot of your virtual machine if you are operating your firewall in a virtual environment, such as Proxmox VE. So that you can rapidly deploy and operate your firewall system by minimizing downtime in the event of a problem.

2. Backup Zenarmor: To be prepared for the worst-case scenario, backup your Zenarmor configuration and policies. If you do have to roll back with a fresh installation of Zenarmor, you may rapidly recover from the failure by restoring your next-generation firewall.

3. Note License Key: If you need a fresh installation of Zenarmor, you may be required to activate your subscription key. For expedited subscription activation, note your Zenarmor license key in a safe place. Navigate to Zenarmor > Configuration > About > View Subscription to access the license key. Additionally, you can view your license key through your Zenconsole account.

4. Test in a Staging Environment: Whenever possible, test the upgrade in a staging or test environment that closely mimics your production setup. This allows you to identify and resolve any compatibility or performance issues before deploying the upgrade in the production environment.

5. Ensure Your Connection is Reliable: Ensure that you have a secure and reliable network connection to download the firmware update.

6. Schedule Appropriate Time: To reduce service interruption and cybersecurity risks, schedule an appropriate time for your business. Establish a maintenance window that does not interfere with prime operation hours or periods of heavy network traffic. Weekend or nighttime hours are typically optimal for significant system upgrade operations. Do not enhance your system during office hours; instead, conduct a thorough analysis to determine when an upgrade or prospective rollback will have the least impact on your business.

7. Get Approval: It is essential to understand who has the authority to make upgrade decisions and who makes the final “Go” or “No-Go” determination. Share your plan for an upgrade with your manager or approval committee and obtain their approval. Maintain an open line of communication with your manager regarding why you’re upgrading, what you’re upgrading, and when. Open channels of communication contribute significantly to the success of an upgrade: between departments impacted by the upgrade, between front-line staff and decision-making management, and, if necessary, between your organization and external partners and visitors.

8. Prefer Zenarmor UI: It may be better to use Zenarmor > Status page to update your Zenarmor in a more controlled and safe way.

9. Fresh Install and Restore Backup: If you are unable to upgrade Zenarmor NGFW and cannot resolve the issue, you can attempt a fresh installation and restore from your most recent backup.

10. Test: Create a test scenario and verify that everything is functioning as anticipated. If a problematic update must be reinstalled, testing will save you a tremendous amount of time and effort. You must examine the firewall’s functionality, efficacy, stability, and compatibility. Check the Zenarmor notification page. Notifications enable you to be notified of critical Zenarmor firewall events. If you encounter any problems or errors, you must promptly identify and correct them, or revert to the previous state if necessary.

11. Document and Review: It is essential to document the entire process of the upgrade. You must document the update’s specifics and procedures, including the date, time, source, version, and modifications made. You must also document any problems or errors that arose, as well as how they were resolved or avoided. You must assess the efficacy, efficiency, and customer contentment of the update or revision, as well as review the process and the outcomes. In addition to sharing your findings and lessons learned with your stakeholders, you must also provide feedback and recommendations for future updates or enhancements. This information should be recorded in a readily accessible location so that you can enhance your process next time.

12. Contact Zenarmor Team: Never forget that Zenarmor is always by your side. You can communicate with them at any time. If you are experiencing issues with your next-generation firewall, do not hesitate to contact the support team.

The History of Our Company

Sunny Valley Networks was founded in 2017 with a mission to provide enterprise-quality network security solutions to home users and small to medium-sized businesses. Our initial product, Sensei, provided home and small business users with an intuitive and easy-to-use software platform that helped protect their networks from cyber threats.

As our company grew, we realized that our original product name, Sensei, no longer fully captured the essence of our mission and values. After careful consideration, we decided to rebrand our product as Zenarmor, which better reflects our focus on providing holistic, balanced, and robust security solutions to our customers of all sizes.

The Meaning Behind Zenarmor

Zenarmor represents the combination of two powerful concepts: “zen” and “armor.” Zen is a practice that promotes balance, focus, and calmness, while armor represents protection, strength, and resilience. These two concepts perfectly capture the essence of our product and new company name, and the values we strive to embody in everything we do.

Our New Company Identity

Along with the new name comes a new company identity. We’ve updated our logo, color palette, and visual language to better reflect our brand identity and values. Our new logo features a simple, yet powerful, design that incorporates both the “zen” and “armor” concepts. The new color palette represents the balance between calmness and protection, while the visual language reflects the strength and resilience of our products.

The Benefits of Rebranding

We believe rebranding our company name from Sunny Valley Networks to Zenarmor will help us better communicate our focused mission, values, and product offering to our customers globally. By aligning our company and product names, we hope to increase market awareness and improve brand recognition. Our new identity will help us differentiate ourselves from our competitors and establish ourselves as a leader in the network security industry.

Delivering on the Promise of SASE

At Zenarmor, we are committed to delivering the latest innovations in network security to our customers. One of the most promising trends in the industry is the emergence of Secure Access Service Edge (SASE), a cloud-native approach to network security that consolidates and simplifies networking and security functions. With SASE, businesses can provide secure access to their networks from any location or device, while also reducing complexity and improving performance.

We believe that SASE represents the future of network security, and we are committed to delivering on its promise to our customers. Our Zenarmor product has been designed from the ground up to support SASE, with a software only cloud-native architecture that enables us to deliver network security solutions that are uniquely agile, scalable, and highly effective.

Moving Forward

We are excited to embark on this new chapter in our company’s history. While the company name may have changed in our marketing, our commitment to providing innovative network security solutions remains the same since the business was founded. With our new company identity and our continued commitment to delivering on the promise of SASE, we believe that Zenarmor is well-positioned to help businesses and academic institutions of all sizes protect both their networks and users.

Thank you for your continued support as we transition from doing business as Sunny Valley Networks to Zenarmor. We can’t wait to see what the future holds!

Watch Now

From OPNsense 23.1.6 Release Notes:

The other honorable mention is the netmap work we have been doing with Zenarmor and Klara on the FreeBSD kernel side which brings bridge device support as well as a considerable improvement to the emulated mode where several packet stalls and mbuf leaks have been identified and subsequently fixed. This should have an operational impact on Suricata (IPS mode) and Zenarmor. The state is much better now but please do not hesitate to contact us about issues that you might still be having with netmap-based packet flows as the topic is a rather complex one.

The goal of this blog post is to provide some insights into what we’ve been up to and what we’re planning to do in the future in the context of improving device driver support for the netmap subsystem in the FreeBSD kernel.

Background

As the Zenarmor team, in the past, we sponsored several development efforts for the netmap project. The goal of those projects was to improve the stability of the netmap support for some specific drivers. Although the work was limited to a few widely used drivers, those developments have proved to be helpful for both Zenarmor users and Suricata and Snort IPS user community who had been using that software on the FreeBSD operating system.

Problem

Although the developments were a huge step forward for some specific ethernet adapters, the netmap and ethernet driver compatibility still continued to be an issue for the majority of the ethernet drivers.

Since Zenarmor, Suricata (IPS mode), and Snort (IPS mode) rely heavily on the netmap subsystem to function properly, any issues related to this netmap driver compatibility continued to cause issues in certain configurations, impacting the user experience for the aforementioned user community at large.

The underlying reason is that netmap mangles heavily with device drivers to be able to make maximum use of their capabilities and speed. This totally makes sense from a performance perspective; and for the original use-cases netmap has been developed for in the first place. However, this approach is very hard to maintain for use cases where portability is more important than attaining the best possible wire-speed packet performance. The reason is any single driver-specific update requires a review/update on the netmap side. Additionally, any newly introduced ethernet adapter or chipset could not be used with the IPS tools unless proper netmap support is specifically developed for the driver.

Having sponsored two netmap projects prior, it became apparent to us that trying to maintain netmap compatibility on an individual driver basis was not a sustainable solution for use-cases where portability is more important than attaining best possible packet per second performance.

Possible Solutions

We needed a mechanism that would work driver-agnostic and would perform reasonably equally well for all the ethernet drivers.

We have entertained several ideas to see if we can extend the functionality of an existing kernel mechanism to achieve what we want:

1. Improve the performance of divert sockets
2. Improve and extend packet filter hooks
3. Improve the stability and performance of the netmap-emulated driver
4. Implement a brand new kernel mechanism for this goal (BSD version of eBPF)

Teaming up for the optimal solution: netmap emulated driver

We’ve discussed these ideas with the OPNsense (Deciso) team and have decided to team up with Klara Systems to assess the situation and decide on and implement the best solution together.

After evaluating the options with Allan Jude and Tom Jones of Klara Systems, netmap emulated driver stood out as the best foundation to move forward. Netmap’s emulated driver was already driver-agnostic and we would not need any additional developments on the application side of things (Zenarmor, Suricata, Snort) since these security tools already had the netmap support built in.

On the other hand, people were reporting packet stalls or performance issues related to the emulated driver. These need to be addressed.

So it was decided that we would go with the netmap-emulated driver and the project.

The Project

After some discussion, we’ve decided to approach the project in two phases and improve the netmap emulated driver in two phases and have the below deliverables:

1. Phase 1:
   • Improving the reliability and stability of the emulated mode for all ethernet devices
   • Add emulated mode support for bridge(4), VLAN(4), lagg(4) and tun(4) pseudo interfaces
2. Phase 2:
   • Improving the performance so that its performance compares reasonably well when compared to native netmap drivers.

The project has been financially sponsored by Zenarmor and OPNsense; and the technical analysis and implementation have been done by Mark Johnson, Tom Jones, and Allan Jude of Klara Systems.

In the first phase of the project, a performance and functional analysis of netmap interfaces in emulated mode (also referred to as generic mode interfaces) revealed some functional issues which could lead to failure to complete transmission of packets, leaked memory, or complete stalls of network interfaces when using certain devices.

Buffer recycling stall

Emulated mode interfaces attempt to perform zero-copy transmission when sending packets. An in-kernel ring buffer is populated with mbuf headers to which netmap buffers are attached. When transmitting the mbuf reference count is set to 2, once this has been decremented to 1 netmap infers that the driver has freed the mbuf as part of a transmission and the transmission can be considered to be complete allowing the memory backing the mbufs to be released back to the pool. This scheme fails when software pseudo interfaces are used with netmap (such as if_lagg or if_bridge). With software interfaces the underlying hardware interface is relied on to free the mbuf during transmission completion, however, drivers are allowed to hold a small number of mbufs indefinitely. If such a buffer ends up at the tail of a netmap transmit ring further transmissions can be blocked indefinitely leading to a stall to all traffic for that netmap software interface.

To resolve this problem, a change was upstreamed to FreeBSD which removes the attempted zero-copy behavior (commit ce12afaa6fff).

As part of this change, an issue where the pkthdr field was not correctly cleared when a mbuf is released for reuse was also addressed. Before this change, some software interfaces such as if_vlan could set fields in the mbuf header which persisted when the mbuf was reused.

Leaking Packets

The networking layer is able to send packets to interfaces in batches of multiple packets by linking them together through the m_nextpkt pointer. netmap interfaces in generic mode do not handle this and when linked batches of packets were sent only the first packet from the batch would be transmitted. The remaining packets from the batch would be leaked triggering a memory leak when using interfaces in generic mode. This issue was fixed by walking the mbuf chain during transmission (commit 5f6d37787f1e).

Phase I Results:

Problems with these scenarios have been fixed. Emulated support for the mentioned pseudo ethernet adapters has been implemented.

OPNsense shipped all of these improvements with its 23.1.6 Release.

In the meantime, all of the work has been upstreamed to FreeBSD in an effort to make all of these improvements available to the wider FreeBSD community:

Future Work for Phase II: Improve emulated netmap performance

Further analysis has identified a couple of areas for future work to improve the performance of netmap and generic mode interfaces.

Following areas have been identified for future exploration. Work in these areas may be able to lead to higher performance for netmap in FreeBSD, however, higher performance might only show for certain types of network workloads or patterns of traffic.

Memory Allocation

One area to explore to improve netmap performance potentially is memory allocation. netmap offers two interfaces for memory allocation for applications:

1. The application can mmap /dev/netmap
2. The application can provide pages for netmap to use which it has allocated already using a sparsely documented feature called extmem

In the first case, netmap handles memory allocation for the buffers used to pass packets between the kernel and userspace. In this situation, it appears that netmap will always use 4KB mappings while aiming to always make mappings physically contiguous. This mechanism should enable the kernel to promote mappings to superpages when it can.

In the second case, the application has control over how the pages are allocated. This can potentially enable an application to use superpages for mappings, but the application has to be modified to support this.

Netmap’s allocator could be modified to be aware of superpages, enabling it to better size allocations to the available page sizes on a system. In certain workloads, it is possible for superpage aware handling of network data to offer a significant performance benefit. However, this benefit is highly dependent on the network traffic workload.

Buffer Management

Another area for exploration related to Netmap’s memory management is its use of buffers for storing packets. Currently, netmap takes control of an interface by hooking the ifnet’s if_input routine with generic_rx_handler. Generic_rx_handler puts received packets into a linked list which is then processed by the application when it makes a rxsync call. It is possible that this linked list isn’t cache-friendly and there could be performance advantages to moving to other data structures such as a ring buffer.

Next Steps

Memory allocation and buffer management changes are likely to offer a benefit to netmap applications.

Taking the feedback of the community into consideration; we’ll continue to monitor the performance of Zenarmor and Suricata applications with the emulated driver and assess whether the current state of the netmap emulated mode meets the reliability and performance requirements of the deployment scenarios.

Zenarmor will enable netmap Emulated Mode as the default deployment mode in one of the upcoming Zenarmor releases (Most likely 1.15; but a small probability exists that it can be shipped with 1.13.2).

Thanks

As Zenarmor and OPNsense teams, we would like to extend our special thanks and gratitudes to the OPNsense community and the wider FreeBSD community at large for testing the patches and providing feedback.

Additionally, special thanks goes to Mark Johnson, Tom Jones, Allan Jude of Klara Systems for their technical guidance and implementation; Vincenzo Maffione from the Netmap team for providing precious feedback, code review and guidance; and for and to Sabina Anja for her ongoing support during the course of the project.

Watch Now

The greatly anticipated release of Zenarmor 1.13 has just arrived and offers important new and improved capabilities that both technical and business decision-makers will find helpful when implementing security solutions to strengthen their overall enterprise cyber security posture.

A brief overview of the updates included in this release are:

• User PIN codes to bypass blocked content via the blocked content landing page
• Policy-based SafeSearch enforcement
• Scheduled advanced reporting
• BrightCloud® Threat Intelligence Integration
• Enhanced RESTful API and improved API endpoints
• General bug fixes and performance improvements

So when you are ready, let’s dive in and take a closer look at these new capabilities.

User and Admin PIN codes to bypass and whitelist blocked websites.

In the previous release of Zenarmor, the ability to create custom blocked landing pages was implemented. These landing pages are presented to users explaining why access to a website has been restricted either as part of a corporate internet usage policy or when protecting a user from a threat detected by Zenarmor’s real-time monitoring.

Zenarmor 1.13 enhances this capability by giving your security team the ability to create and issue PIN codes that end-users can input on the custom blocked landing page to bypass and whitelist the webpage. This provides an alternative, yet still controlled method of whitelisting websites, without having a member of the security team manually modify the whitelist using Zenconsole.

Two types of PIN codes can be issued, the first being a global admin PIN code, which when used, whitelists the blocked website for all users and endpoints on the network. The second bypass PIN code type is a user specific code, that is issued to a single user allowing only that single endpoint access to the restricted website.

Both bypass PIN code types can be set up to expire after a certain amount of time. This capability can be useful to end-users and IT security team members alike, by providing a quick and controlled means to whitelist websites on the fly, which reduces end-user frustration typically associated with users waiting for IT to manually whitelist the website. At the same time, IT helpdesk staff can offer quick turnaround times by simply providing a PIN code, alleviating the cybersecurity technical staff responsible for managing the organization’s firewall, while still maintaining control.

Policy-based SafeSearch enforcement

SafeSearch functionality provides a means to filter out offensive or inappropriate content from presented search engine results and is available for most of the popular search engines including Google, Bing, Duckduckgo, Yahoo, and Yandex. Usually, this feature is activated on a per-user/endpoint basis. However, with Zenarmor 1.13 you can activate SafeSearch enforcement on a per-policy basis for all users on your network. This capability is perfect for use in school networks where students can have SafeSearch activated by default, whereas teachers and other staff don’t have SafeSearch enabled. This feature provides IT departments with a convenient and efficient means to control SafeSearch globally throughout the network.

Just as a side note, if you are interested in how Zenarmor can be used to secure and filter content in an educational environment, please check out my previous article:
Why is Zenarmor the perfect content-filtering solution for educational institutions?

Customizable, scheduled advanced reports for all audiences

Comprehensive and customizable advanced reporting has always been one of the great capabilities offered by Zenarmor. With Zenarmor 1.13, reporting functionally gets an upgrade allowing security teams to automate the scheduled sending of reports. This functionality is useful when it comes to creating and sending reports to multiple recipients at the frequency they need. For example, one way to use this feature is to send management and business decision-makers more high-level business-oriented reports monthly.Alternatively, you could send daily technical reports to your cyber security team, the choice is yours. Regardless of your reporting requirements, Zenarmor now ensures your reports are delivered on time, in PDF format, to their exact audiences with no fuss.

To make this service even better, you don’t have to waste time setting up your own email service and settings to deliver reports, Zenarmor includes a built-in email delivery service with this release.

Increased threat coverage by leveraging BrightCloud® Threat Intelligence

Zenarmor’s existing AI-based threat intelligence protecting your network against over 300M+ websites and domains is without a doubt an impressive standard capability giving you advanced protection and is included in all Zenarmor subscriptions ranging from the Free to Business Edition of Zenarmor.

As of the release of Zenarmor 1.13, through Zenarmor’s partnership with BrightCloud®, Business Edition, users will benefit from extended protection that includes an additional 1+ billion categorized domains and 4+ billion recorded IPv4/6 addresses. In addition to this, you will also benefit from being a part of a global threat intelligence network made up of over 140 top cyber security vendors using BrightCloud® Threat Intelligence to enrich and extend their threat detection solutions. So rest assured, knowing you have access to the very best threat intelligence available. To date, BrightCloud® has evaluated over 48+ billion domains and adds to this database by analyzing roughly 25,000 threats and URLs daily.

If you are already a Zenarmor Business Edition subscriber, you will automatically benefit from the BrightCloud® Threat Intelligence database powered by sixth-generation machine learning, which provides your business maximum protection at all times. If you are on a Free, Home, or SOHO subscription, don’t worry, you can still depend on the great threat intelligence that you know and love provided by Zenarmor as standard.

If you are interested in learning more about BrightCloud® please check out the official partnership announcement, or alternatively head over to https://www.brightcloud.com/

Enhanced RESTful API

Zenarmor has included RESTful API functionality in previous Zenarmor releases for some time already. However, as of Zenarmor 1.13, the RESTful API has been enhanced by providing developers and integrators with more API endpoints so that they can leverage more of Zenarmor’s functionality, similar to the functionality already provided in Zenconsole.

The API allows for improved integrations with popular MSSP automation platforms like ConnectWise and Kaseya or even existing SIEM and XDR solutions that you may already have deployed in your environment.

Are you ready to experience Zenarmor 1.13 for yourself?

If you answered yes to this question, and you are an existing Zenarmor customer, head over to either Zenconsole or your OPNSense dashboard and apply the 1.13 update. If you are new to Zenarmor and would like to explore the great capabilities that Zenarmor has to offer, you can simply sign-up and start your Zenarmor Business Edition 15-day trial, with no credit cards required.

Alternatively, feel free to contact Zenarmor at and ask for assistance getting your free trial setup and started today. We’d love to hear from you!

Watch Now

We’re excited to announce that our Zenconsole firewall management console has a new domain, https://dash.zenarmor.com/. Plus, for a limited time, you can still access and manage your Zenarmor nodes via the old domain, https://sunnyvalley.cloud/. In the future, all access requests to the former domain will be redirected to the new domain, https://dash.zenarmor.com/. Rest assured that all user accounts, data, and settings have been smoothly transferred to the new site, so you can keep using our services without any interruptions.

We understand that change can sometimes be daunting, but we’re here to make this transition as seamless as possible for you. Additionally, we’ve made significant improvements to the Zenconsole, including enhanced security features and improved user interface, to ensure that your experience with our platform is better than ever before. If you have any questions or concerns, our support team is available to assist you at https://help.zenarmor.com/hc/en-us or via support -at- sunnyvalley.io email.

Thank you for your continued trust and support. We couldn’t have done this without you!

Best regards, Your friends at Zenarmor

It is no secret that the internet is a dangerous place filled with all kinds of threats ranging from malware to phishing attacks, to inappropriate content or themes that enterprises go to great lengths to defend against daily.

But what about educational institutions like schools, universities, and other public places like libraries where minors and young adults have internet access? Are these environments truly as safe as they can be? Too often they’re not. Educational institutions, small businesses and even large enterprises do share many technical similarities. They all rely on networks connecting desktop and laptop computers, and wireless mobile devices including smartphones, tablets, and smart boards used in the classroom, all with access to the Internet. And let’s not forget the various servers used by the academic organization which are also connected to the same network. Unlike large enterprises, academic institutions have a different and some might argue more important imperative. It’s a necessity that educational institutions implement proper cyber security and access control measures, not only to protect their systems, teachers and administrators, but most importantly, the bright and impressionable minds accessing these systems and internet services.

Zenarmor understands the importance and unique security needs of educational institutions. Today, throughout the world, hundreds of academic institutions depend on Zenarmor and the enterprise-grade security it provides. For the remainder of this article, we are going to unpack the benefits and capabilities of Zenarmor and look at how it provides a formidable content filter, protecting minors and students alike from inappropriate online content and online threats. We’ll also cover how Zenarmor helps to satisfy governmental regulatory compliance requirements such as the Children’s Internet Protection Act (CIPA) and supports educational institutions that want to qualify for the E-Program financial programs offered by the US Government.

A brief background about content filtering, and why using Zenarmor is a superior solution.

Content filtering, in a nutshell, is the process of screening or completely blocking objectionable websites, emails, applications, or links that may be inappropriate, offensive, or even outright malicious to the user or system accessing the content. The main goal of implementing content filtering controls in your network is to prevent the users and systems from accessing this questionable content, which could jeopardize your overall network security or expose the users to inappropriate or productivity-hindering websites that go against network usage or school’s policies.

Generally, content filtering is deployed on the perimeter firewall which monitors all outbound internet traffic against a predefined Access Control List (ACL) or policy. Popular ways of implementing ALC’s often involve the usage of a Squid proxy server integrated with the SquidGuard extension or in other cases DansGuardian which intercepts the outgoing traffic and checks it against the ACLs. This popular approach is effective and has been used to filter content over the years. However, it comes with some challenges that are often difficult for academic institutions to address: it requires the network administrator to create all the ACLs rules manually, and periodically perform manual updates, which becomes very time-consuming to maintain. This is especially true if the network is large, or complex or has changing policy requirements.

Zenarmor, on the other hand, addresses these administration issues by providing network administrators an intuitive web-based management dashboard called Zenconsole. Policy management is made easy with 60+ predefined web and application categories, covering thousands of application signatures that can enforce policy requirements without requiring client-based agents or proxy configurations. Furthermore, Zenarmor operates in a fully transparent mode, meaning that unlike proxy based security approaches which require altering the network traffic flow, Zenarmor does not require any changes to the network content or architecture to provide its protection, making deployment straightforward.

Importantly, Zenarmor utilizes AI-powered cloud-based web categorization that provides real-time classifications covering over 1 billion domains. This approach not only eliminates the time-consuming process of manually creating and updating ACLs, but is far more comprehensive than what network administrators can ever achieve on their own, no matter how motivated they are.

Figure 1: Zenconsole includes 60+ predefined web and application categories

More reasons why Zenarmor is the most complete content filtering solution.

Using Zenarmor certainly makes content filtering much easier compared with traditional approaches. However, its capabilities in protecting the organization don’t end there. Unlike other approaches, Zenarmor also provides advanced security features by combining AI-based cloud threat intelligence with deep packet inspection. The result is that Zenarmor is also able to block botnets, prevent sophisticated zero-day malware campaigns and phishing attacks, all in real-time. By comparison, these attacks can otherwise easily bypass traditional IP address, port number, or DNS based filtering techniques.

Figure 2: Zenconsole Essential and Advanced security options

But my organization consists of Administrators, Teachers and Students. How can I manage the policies for all of these groups independently to deliver human-centric security?

To efficiently manage users, groups, and resources accessing the network, most educational institutions already have directory services deployed like Microsoft Active Directory. Zenarmor is easily integrated with Active Directory. This allows network administrators to associate content filter policies with established users or groups, regardless of the device or IP address they are using.

This is a tremendously powerful combination because often in an educational environment, you will find that there is a need for varying levels of access. For example; perhaps one class group is doing a study about drugs. The network administrator could easily relax restrictions to this otherwise prohibited category for a particular class group only for the duration of their research. At the same time, all other users remain protected from this content. A similar approach could apply to a staff group; they could have more relaxed policies in comparison to the student population.

How does Zenarmor support compliance reporting?

Zenarmor’s policies are both powerful and flexible. They can also be set up to operate on a schedule. With little effort, a network administrator can allow a different social media or recreational internet access after school hours while automatically resuming restrictions during daytime classes. Zenconsole also makes the management of these policies very easy through the automatic synchronization across all Zenarmor firewalls protecting the school’s network.

No great content filtering solutions would be complete without analytics and reporting. Zenarmor offers best-in-class analytics and reporting. This provides network administrators complete visibility of their network traffic including real-time connection information and access to 60+ predefined reports. Importantly, these reports also provides school administrators with the documentation they need to substantiate their efforts to protect their students and organization.

Figure 3: Zenconsole predefined reporting view

I am interested in deploying Zenarmor to protect my school network. So how do I get started?

Because Zenarmor is a software-defined solution with zero hardware dependency it provides network administrators multiple cost effective deployment options to consider. Zenarmor can easily be deployed on most off-the-shelf hardware or virtualized environments. It supports all the most popular Unix/Linux-based operating systems like Ubuntu, RedHat, and FreeBSD to name a few. Perhaps your institution has already invested in a firewall solution like pfSense or OPNsense. If so, you are already more than halfway to completing your Zenarmor deployment! Both pfSense and OPNsense make it incredibly easy to install Zenarmor through a plugin. If you are building your firewall and Zenarmor deployment from scratch using one of the many other supported operating systems, the installation is equally as easy. In most cases, you can have Zenarmor deployed in under 10 minutes using a simple CURL command.

How affordable is a content filtering solution like this?

Compared to commercial enterprises, educational institutions often have a smaller IT budget which may restrict these institutions’ access to the more sophisticated enterprise-grade content-filtering products on the market. To address this constraint, Zenarmor offers special pricing for educational institutions, allowing them to provide enterprise-grade security at a price they can afford.

A side note for MSSPs reading this article.

If you are an MSSP who has found this article informative and is looking to create new services or improve your offering for educational institutions, bundling Zenarmor into your current solution is an excellent way to provide immediate value to your clients. If you are interested in learning more about this, check out my previous article: How MSSPs can leverage Zenarmor combined with open-source firewalls to increase the value of their offered services

Next Steps…

If you would like to get your feet wet and explore the many great capabilities of Zenarmor and how it can be used to protect your students, staff, and network, try Zenarmor on a 15-day trial, no credit cards required. Visit Zenarmor Education page to learn more about how Zenarmor will upgrade your institution’s network security.

Or…

Contact Zenarmor at and ask for assistance getting your free trial setup and started today

Watch Now

Today, in our quest to provide the best network security for MSSPs, businesses and enterprises anywhere and anytime, we’re pleased to announce that we are teaming up with BrightCloud® - the world’s leading cyber threat intelligence gathering / sharing community consisting of the industry’s top cybersecurity vendors.

Starting March 20, 2023, Zenarmor’ customers using Zenarmor Business Edition will receive enhanced cyber protection for their multi-branch organization networks. BrightCloud® will extend Zenarmor’s existing AI-based Threat Intelligence that covers more than 300M+ sites instantly by an additional 1+ Billion domains, and support the evaluation of 43+ Billion URLs to recognize and block malicious URLs and IPs. With the introduction of Zenarmor’s TLS inspection capability, we’re looking forward to introducing real-time scanning of malicious activity inside files and mobile apps by incorporating BrightCloud’s near-real-time threat intelligence source.

The BrightCloud threat Intelligence service is integrated into many of the industry’s top firewall vendors, providing them with real-time web intelligence to block access to malicious URLs, IPs, files and mobile apps. This integration allows for a seamless and effective way for organizations to secure their network and protect against cyber threats.

As a respected leader in their field, Zenarmor joins over 140 other top cybersecurity vendors using BrightCloud Threat Intelligence to enrich their solutions,” said Dena Buckman, VP Product Engineering, OpenText Cybersecurity. “Integration of BrightCloud Threat Intelligence Services with Zenarmor enables Zenarmor to provide a proactive, automated security solution to their customers for even greater threat protection.

How will this benefit your organization’s network security?

Zenarmor Business Edition, like the rest of our products, has been developed by keeping the best interests of our partners and customers in mind. If you’re a Business Edition user, in addition to RESTful API integration, cloud-central firewall management through Zenconsole, and advanced reporting capabilities, you now have access to the world’s leading threat intelligence database powered by sixth-generation Machine Learning to keep your organization’s network protected at maximum capacity at all times.

Zenarmor customers using Business Edition will automatically start benefiting from the additional layer of security provided with the integration. You do not need to do anything at all. It’s fully automatic.

Zenarmor customers who are using Free Edition or Home/SOHO subscription tiers will continue to be protected against malicious attacks by Zenarmor’s existing Threat Intelligence (excluding the BrightCloud Database) covering 300+ Million active and 200+ Million passive domains.

We are very excited to welcome PicoPC to our Global Partners Network as our new Hardware Partners.

UK based tech company PicoPC is one of the technology leaders in the server, small firewalls, embedded industrial PCs, HPC, storage and memory markets. They are best known for their 1U, desktop mini firewalls and embedded solutions that offer high-performance computing at affordable prices to their customers. PicoPC provides its customers with devices that serve end-to-end green computing solutions to the Cloud Computing, Telecom, Datacentres, AI (High Performance Computing) COM-HPC, Industrial Automation, In-Vehicle Systems Edge Computing, Cyber Security, IOT and IIOT markets.

This brand new partnership between Zenarmor and Picopc will allow users to get the best of both worlds by using the advanced cyber protection features of Zenarmor NGFW on top of PicoPc’s high-tech devices.

To celebrate the partnership, all Zenarmor customers will get a 10% discount on all PicoPC appliances!

If you are aspiring to run your own managed security services provider (MSSP) business or already operate one, there has never been a more exciting time for MSSPs than present. With more businesses adopting the cloud and staff working remotely from anywhere, it can be challenging for organizations to navigate this new territory, especially when it comes to providing and managing their cybersecurity requirements. Naturally, businesses are going to seek reliable and knowledgeable partners to help them navigate the challenging path of constantly fending off phishing and ransomware attacks, blocking malware, dealing with other nasty online threats in their efforts to remain compliant and keep their staff productive. This is where your services come in.

While MSSPs generally offer a number of bundled services to their clients, in this article we are going to focus on security services and how Zenarmor combined with well-known open-source firewalls such as OPNsense or pfSense software can help MSSPs differentiate and increase the value of their bundled services.

Why is using Zenarmor with your open-source firewall a good idea?

If you’ve been in the IT industry for a while, you have likely already come across or even deployed open-source firewalls such as pfSense and OPNsense for your clients, which is great. These firewalls provide many standard features businesses require to maintain their ongoing operations like VPN capabilities, IDS/IPS services, web filtering, etc. so you may be thinking; What more do I need? Well, by simply installing the Zenarmor plugin, you have now unlocked next-generation firewall (NGFW) capabilities such as real-time deep-packet inspection, AI-powered Threat Intelligence, application/web controls and reporting which is typically only available with expensive enterprise firewall appliances. With Zenarmor, you can immediately offer these features and increase value and security to your clients with little additional effort.

Why zero hardware dependency is a game changer for MSSPs?

Because Zenarmor is totally software-defined, there is zero hardware dependency, meaning that you can essentially deploy Zenarmor on most off-the-shelf hardware or in the cloud across a wide choice of supported operating systems, not only limited to OPNsense or pfSense. You can also install Zenarmor on popular Unix/Linux-based operating systems like Ubuntu, RedHat, FreeBSD, and even Amazon Linux to name a few. There is no need for expensive hardware appliances and with Zenarmor’s software-defined architecture you can rapidly spin-up security services in under 10 minutes, anywhere you may need it, on-prem or in the cloud to provide immediate value to your clients. With this hardware-independent solution, even small or resource-constrained businesses can now benefit from enterprise-grade security without the need to pay high upfront costs for security appliances or commit to pricy maintenance contracts.

How does an MSSP manage its clients’ Zenarmor deployments?

So you may be thinking this sounds great! Providing almost instant security wherever it’s needed, and unlocking additional value from my pre-existing OPNSense or PfSense deployments all makes perfect sense, but how do I efficiently manage all these firewalls? The short answers by using Zenconsole. Zenconsole is a cloud based manager that allows MSSPs to govern all aspects of administering their clients’ Zenarmor firewall deployments including; subscriptions, upgrades, activations, and removals. Additionally, all firewall policies and configurations are managed on the clients behalf using a cloud based, single-pane of glass approach. Role-based, granular access controls are included so that you can assign individual members of your network management team the appropriate permissions needed to efficiently manage all your clients’ firewalls. Best of all, this functionally comes at no additional cost.

Can Zenarmor be integrated with existing MSSP platforms and systems?

Speed and efficiency of service delivery are key for any MSSP’s success and are most often achieved through the automation of tasks and workflows. Zenarmor’s RESTful API provides the ability to integrate with popular MSSP automation platforms like ConnectWise or Kaseya, allowing you to optimize billing, monitoring, and policy management via these familiar platforms. Some MSSPs may already be offering monitoring and logging services to their clients. The good news is that Zenarmor is also capable of easily integrating with existing SIEMs, syslog, and XDR solutions by allowing all log data collected by the firewall to be streamed to these services. Zenarmor is also capable of integrating with Microsoft Active Directory and 3rd party captive portals (such as the one included in OPNsense) which allows MSSPs to define firewall policies around individual users and groups that already exist within your organization, regardless of the IP address or device they are using to access the network. Through these integrations, MSSPs can almost instantly unlock additional value for their clients with minimal effort.

What other features does Zenarmor have that allow MSSP to create value?

Because some of the day-to-day services offered by MSSPs are carried out in the background, the real value of the services provided may go unnoticed by the client. With Zenarmor, MSSPs have the ability to highlight their value-add by providing their customers with intuitive, easy-to-read reports that can be quickly customized depending on the targeted audience, so that no matter who is reading the report, anyone can understand why certain types of content were restricted or blocked entirely. The reports can also be helpful in identifying user patterns and can be used as a means to identify unwanted applications being used on the network, helping the MSSP take control over shadow IT. Automated reporting can be scheduled daily, weekly, or monthly helping MSSPs to communicate the ongoing value provided to their clients.

Another means of reinforcing the value the MSSP provides to its clients’ customers is through Zenarmor’s ability to create and share custom blocked landing pages. These web pages are presented to a user whenever they access a website or app that is restricted due to threats or business policies via an easy to understand landing page. The page is presented to the end user explaining why the service or content that they are attempting to access is being blocked, including an explanation of why it is a potential cyber security threat to the organization. This approach not only helps to educate the end user about potential threats but also reduces the number of support tickets created by end users querying these issues, freeing up technical help desk staff so they can focus on important tasks and requests.

What does all this cost and how do MSSPs bundle these services into existing packages?

So if you have made it this far, the extra value MSSPs are able to provide to their clients using Zenarmor should be pretty clear. But what does all this cost, and how does an MSSP charge its clients for these services? Fortunately, with Zenarmor this is very straightforward. Zenarmor offers a subscription-based pricing model, where an MSSP can purchase individual firewalls, each with a pool of licenses covering the number of devices connected to the network that requires Zenarmor’s protection. These licenses can be dynamically allocated throughout the organization where they are needed. Because the licenses are offered on a per-user device model, MSSPs can easily factor in these costs when creating service packages for their clients with no unexpected hidden costs or fluctuations. Licenses are offered as an annual or multi-year subscription which helps to make the ROI calculations straightforward. As an added benefit, should an MSSP unfortunately lose a client for unforeseen reasons, licenses can easily be reallocated to another customer minimizing the financial impact to the MSSP.

Some final thoughts…

Zenarmor truly provides one of the most feature-rich firewall solutions for the MSSP market. With enterprise class security, zero hardware dependency, cloud-based, single pane of glass management, API integrations, and reporting, all made available through an easy to use and cost effective subscription-based model, it’s difficult not to recognize the significant value an MSSP is able to create by utilizing Zenarmor. Don’t leave your clients unprotected. After all, they are looking to your organization to ensure the efficient and uninterrupted IT operations their business depends on.

Try Zenarmor on a 15-day trial, no credit cards required, and enjoy all the Business Edition features on offer, set up in 10 minutes or less. You’ll be glad you did.

Visit this page to learn more about how Zenarmor will empower MSSPs

Watch Now

We, at Sunny Valley Cyber Security, Inc. (dba Zenarmor) have made changes to our Privacy Policy, Terms of Use, and Terms of Conditions and wanted to share the update with you.

Here is a summary of our key changes:

For Privacy Policy:

These changes were made to comply with the latest requirements under the General Data Protection Regulation (GDPR) regarding Standard Contractual Clauses for transfer of Personal Data. We also have updated our business information such as our physical and email addresses for receiving notices including for DMCA, and third-party service providers list, have more clearly defined personal information, and how we notify you of changes to the policy.

For Terms of Use:

These changes were made to update our business information such as our physical and email addresses for receiving notices including for DMCA and how we notify you of changes to the terms.

For Terms of Service:

These changes were made to update our business information such as our physical and email addresses for receiving notices including for DMCA and how we notify you of changes to the Terms.

The updated Privacy Policy, Terms of Use, and Terms of Service become effective on March 9, 2023. You can access the updated documents here:

• Privacy Policy: https://www.zenarmor.com/legal/privacy-policy
• Terms of Service: https://www.zenarmor.com/legal/terms-of-service
• Terms of Use: https://www.zenarmor.com/legal/terms-of-use

We encourage you to visit the links and review the new Privacy Policy, Terms of Use, and Terms of Service.

Notwithstanding if you continue to use our services, you are bound by these new changes to the Privacy Policy, Terms of Use, and Terms of Service.

If you have any questions, please do not hesitate to contact us by sending an email to

Thank you for being part of our team.

In a previous article, I introduced Zenarmor SWG as part of a Secure Access Service Edge (SASE) architecture and we briefly discussed how Zenarmor SWG can be used to filter and control the traffic originating from cloud assets destined for the internet. In this article, we are going to drill down into this topic, and explore why Zenarmor SWG should be the first product to come to mind, when looking for a rapid-to-deploy, low-cost, cloud egress traffic filtering and control solution, with the ability to control all Zenarmor SWG deployments from a centralized control panel.

Why do we need egress traffic filtering and control for cloud-based assets?

Simply put, cloud assets with unrestricted internet access can potentially put your environment at risk of being attacked by opening the environment to:

1. Easily enabling threat actors, that potentially gain a foothold on one of your cloud assets, to establish reverse shells or to call home to their remote command-and-control infrastructure.
2. Potentially enabling the exfiltration of precious and confidential company data.
3. Not being able to satisfy organizational and regulatory compliance requirements such as PCI-DSS, HIPPA, and SOC2.
4. Potentially allowing unknown or unapproved cloud applications originating from the cloud assets access to the internet, is known as shadow IT and is undesirable in most cases.
5. Not having proper visibility of egress network connections or the ability to easily monitor and log cloud egress traffic.

To add further complications to this scenario, most cloud service providers, out of the box, don’t offer a comprehensive or granular means to manage and control traffic leaving the VPC or VNET via their internet gateways. Usually, these gateways filter on an IP address basis only, not being aware of FQDNs. If you have multiple VPCs or VNETS across your environment or even as part of a multi-cloud provider deployment, these filter policies will need to be replicated across all these environments which could open security gaps in your infrastructure, due to human error or negligence, and in general, could become a management nightmare for security and operations teams.

How can Zenarmor SWG combined with the Zenconsole dashboard secure your cloud environment by filtering and controlling cloud egress traffic?

The Zenarmor Secure Web Gateway (SWG) was specifically designed to provide an almost instant means to deploy and provide security against zero-day web-based threats, filter web content, and block ransomware, social engineering threats, and malware, wherever you may need it.

Through Zenarmor’ agile software-driven approach to cybersecurity, Zenarmor can easily be installed on most of the popular Unix-based operating systems, including Amazon Linux with a simple CURL command. All Zenarmor SWG instances are managed through Zenconsole, a single pane of glass dashboard, allowing for easy centralized policy management and synchronization between all your deployments. Reporting and seamless integration with SIEMs and Active Directory come standard with the business plan. Speaking about subscription plans, there is one for everyone, ranging from Free to Business, and there are no complex licenses or activations.

Let’s consider the below multi-cloud network architecture, and see how Zenarmor SWG can be used to secure this environment:

The architecture consists of three different cloud service providers, Azure, AWS, and DigitalOcean. Each VPC/VNET has Zenarmor SWG at the edge filtering cloud egress traffic originating from each respective network. Because Zenarmor has zero dependencies on vendor-specific hardware and is totally software-based, I have decided to show its versatility by installing an instance on Ubuntu Server, Amazon Linux, and lastly on FreeBSD.

All the Zenarmor SWG instances are managed through the Zenconsole dashboard which is free to use regardless of which subscription plan you are on. Zenconsole makes policy management across all Zenarmor instances easy.

Figure 1: Zenconsole dashboard - Home default view

You have the choice of creating unique policies on an instance-by-instance basis or you can deploy centralized policies that synchronize to all Zenarmor SWG instances in your network, a blanket type policy essentially. Zenconsole also gives you the ability to clone policies and export/import them for reuse with other secure web gateways in your network. Another great feature is the ability to create restore points for your policies, allowing you to easily revert to a previous version of the policy if you run into any issues. All policies are synchronized in real-time.

Figure 2: Policy configuration view

In this multi-cloud architecture, I have chosen to assign a unique egress policy to each Zenarmor SWG instance because each network has its own unique filtering requirements based on the APIs and update servers that require access, everything that is not explicitly allowed will be blocked by Zenarmor.

Now that you have a better understanding of the above network architecture, let’s readdress the security issues I described at the beginning of the article, and how we can mitigate these issues by deploying Zenarmor SWG into our network.

1. By making use of the security and app controls built into Zenarmor, we can disable the threat actors’ ability to communicate with their command-and-control infrastructure by denying remote access like secure shell or telnet.
   
   

   

   Figure 3: Egress Policy view - App Controls - blocking remote access services
   
   

2. The threat of data exfiltration can be minimized by denying access to popular file transfer applications and services using similar app controls targeting those categories.

3. Organizational and regulatory compliance can now be satisfied by safeguarding your cloud assets using Zenarmor SWG.

4. We now have ultimate control over shadow IT, by once again using the built-in app controls in Zenarmor we can block any unauthorized application traffic from leaving our network, rendering them useless.
   
   

   

   Figure 4: Egress Policy view - App Controls - Categories View
   
   

5. While Zenarmor has a very comprehensive list of already builtin app and web control categories, there may come a time when you need to create your own exclusions or inclusions in your policy, for this, Zenarmor allows you to create black and white lists, where you can filter by an FQDN or IP address.
   
   

   

   Figure 5: Egress Policy view - Exclusions - White/Black List
   
   

6. Finally, not having proper visibility of your network traffic is now a thing of the past, with Zenarmor, you have the ability to view all live network sessions traversing the network. There are also comprehensive reporting features included, giving you app breakdowns, threat detections, and top blocked connections to name a few.
   
   

   

   Figure 6: Live sessions view - active traffic traversing the network

   
   
   

   

   Figure 7: Reporting view - Blocked Traffic over time

With many enterprises relying on the cloud to remain competitive, threat actors are increasingly ready to take advantage of security gaps in this modern business landscape. Zenarmor offers a zero CAPEX subscription model, with no upfront capital expenses or exorbitant hardware or annual maintenance contracts. Simply get up and running in minutes by deploying Zenarmor on the UNIX platform of your choice, and benefit immediately from the cybersecurity on offer.

Can you really afford to not secure your cloud workloads using Zenarmor SWG? Try Zenarmor SWG for free for 15 days, with full access to the business plan, sign up today!

Watch Now

With the official announcement of Zenarmor 1.12 came a few exciting and important new capabilities for MSSP’s and Enterprise, including the ability to easily and quickly deploy Zenarmor as a Secure Web Gateway (SWG) with support for multiple unix platforms including FreeBSD, Amazon Linux, Ubuntu, CentOS and not to forget the all to familiar OPNsense firewall.

If you have been part of the OPNsense firewall community, it is likely that you have already come across Zenarmor, the next-generation firewall (NGFW) plugin, and its ability to inspect and control applications and web traffic traversing your network, while offering real-time protection against threats. So you may be asking yourself, how does a Secure Web Gateway (SWG) deployment differ from this? The simple answer being: it depends on where Zenarmor is deployed in your network.

In a traditional on-premise deployment, Zenarmor lives on your OPNSense or similar firewall, and all traffic originating from your LAN heading towards the internet is inspected and filtered. On the other hand, when we use Zenarmor as a Secure Web Gateway (SWG) we are moving our security stack away from the on-premises data center into the cloud edge, allowing us to inspect and filter egress cloud traffic as it leaves our virtual cloud network towards the internet.

Secure Web Gateway (SWG) solutions like Zenarmor, are described by Gartner as a solution that “filters unwanted software/malware from user-initiated Web/Internet traffic and enforces corporate and regulatory policy compliance. These gateways must, at a minimum, include URL filtering, malicious-code detection and filtering, and application controls for popular Web-based applications.” Generally, SWG solutions forms a part of the Secure Access Service Edge (SASE) network architecture, a concept also coined by Gartner in 2019, in response to the work-from-anywhere approach a lot of organization began to adopt, which unexpectedly became the new norm for a lot of organizations when the world was hit by the COVID-19 pandemic.

In a traditional work environment, users would be based in an office space and connect to the LAN where they can enjoy the benefits of the on-premises security stack. On the other hand, in a work-from-anywhere or work-from-home remote environment, users have little to no security as they access various SaaS services or online resources which could potentially expose the organization to unwanted cybersecurity threats.

You could argue, what if I gave my remote workers VPN access to the HQ data center? The image above is a depiction of a typical solution that some organizations may have adopted, where they force all their branch network and remote worker traffic via the HQ’s data center, essentially backhauling or hairpinning traffic via the security stack implemented in the DC. This can work, however, the overall user experience can become degraded, introducing latency issues and can become a manageability and security nightmare for network administrators. This poor user experience may tempt remote workers to circumvent the VPN rather connecting directly to the SaaS services, in turn, leaving those users and your enterprise unknowingly vulnerable to cybersecurity threats as they go about their day-to-day business.

So this is where SASE comes in, as depicted in the diagram above. All the security stack and services are moved to the cloud edge. Instead of a traditional VPN, a zero trust access network or ZTNA is used to give users limited access to the resources they need to carry out their jobs, based on least privileged principles. There are also other elements to a SASE architecture like cloud access service brokers (CASB), Data Loss Prevention etc., however, in this article our primary focus is going to be on the Secure Web Gateway and the benefits of using Zenarmor to filter egress cloud based traffic as part of the SASE architecture.

Now that you have a better idea of where Zenarmor SWG fits in, let’s talk about why we need to use egress filtering in our cloud environment to secure and monitor our cloud resources when they access the internet.

To make this concept easier to visualize, I have created the below cloud topology, which includes Zenarmor SWG on the cloud edge. In addition to this I have included some internal virtual machines simulating some workloads, and to provide identity and access management, I am using Azure AD with Azure Active Directory Domain Services to provide single-sign on (SSO). Zenarmor has also been integrated with Azure AD so that we can assign users and groups to our policies created in Zenconsole. This allows us to filter and control traffic uniquely on a per user or group basis.

To bring the Zero Trust Network Access element into the solution, I have used Zerotier to build a private overlay network which has also been integrated with Azure AD to provide SSO. When a user connects to the network they will need to provide their Azure AD username and password and go through the multi-factor authentication (MFA) process to join the Zerotier overlay network. Zerotier also provides a rule engine which allows us to control traffic flow within the overlay network, so for each connected device we could use a policy to only provide access to resources that individual users need to carry out their job, which further satisfies least privilege principles.

I designed this to be simple and easy enough for anyone to replicate with limited resources. All of the Azure services are covered by the $200 credit you receive when signing up an account. Zenarmor has a 15-day Business Edition trial and Zerotier charges $5 per user per month for the SSO integration.

So let’s consider the following scenario based on the above network, and the benefits of using Zenarmor SWG to filter the cloud egress traffic destined for the internet. We have virtual servers running our internal accounting and engineering departments workloads, however, these servers don’t need to access any internet resources other than the update servers to download periodic updates.

1. The first benefit of using Zenarmor SWG in this case, is we can easily create a policy in Zenconsole to control this process, by essentially blocking all traffic except traffic to the approved update servers.

2. The second benefit of this approach is, let’s imagine these servers were compromised by a threat actor, because we are blocking all other traffic, the threat actor won’t be able to leave the network, set up a reverse shell, or call home to their C2 infrastructure or even exfiltrate data.

3. The third benefit, by using least privilege and zero-trust principles in this network architecture, is we are able to limit the threat actors ability to move laterally through the network and we can minimize the impact or ‘blast radius’ of any damages caused.

4. The fourth benefit of this approach is that Zenarmor SWG has comprehensive reporting features and the ability to view real-time connections. In this case we would be able to easily observe the egress traffic, helping us to identify any unexpected traffic trying to leave the network, giving us some insight that the server may have been compromised.

Let’s consider an alternative scenario, we have remote workers accessing the cloud network resources using the Zerotier overlay network. Once they have signed in using their Azure AD accounts, each user can access the internal cloud resources needed to carry out their work based on least privileged access principles. All the users’ egress internet traffic will also be routed via the overlay network through Zenarmor SWG. The benefits of this are:

1. All cloud egress traffic coming from the users devices can now be inspected by Zenarmor SWG, and users can benefit from the real-time threat protection against zero-day malware, ransomware, phishing attacks and botnets while leveraging Zenarmors deep packet inspection and AI-driven cloud threat intelligence. This is a far superior means of providing security to remote users in comparison to them connecting directly from their home, mobile or public networks, which in most cases has little to no security.

2. Like in the previous scenario, we can easily create policies for user groups based on their AD credentials, group or IP address and control their egress traffic using the granular web and application controls offered by Zenarmor, ultimately eliminating websites and apps that are deemed inappropriate for the workplace or are against company policy.

3. In addition to this, by leveraging Zenarmor SWG’s comprehensive reporting and real-time connection viewing capabilities, we could easily identify the applications leaving the gateway, and use this feature as a means to identify any unapproved or untrustworthy applications the users may be accessing, this is known as Shadow IT, and from the users perspective may seem innocent, however, from a security point of view ideally we don’t want users utilizing apps and services that have not been vetted and pre-approved by IT.

Zenarmor SWG, is an agile software-driven approach, perfectly fulfilling the Secure Web Gateway (SWG) component of the Gartner described Secure Access Service Edge (SASE) framework, giving you the ability to easily and quickly deploy enterprise grade security anywhere in your network or cloud without the burden of managing complex licensing or expensive network appliances. Easily manage all your Zenarmor SWG deployments through a single Zenconsole dashboard, synchronizing all your policies regardless of where your Zenarmor SWG deployments are located.

With remote working becoming the new norm and threat actors taking advantage of your staff, often the weakest link in your cybersecurity architecture, can you truly afford not to give them the best cybersecurity possible?

Try Zenarmor SWG on the platform of your choice with a 15-day business trial, sign up today!

Watch Now

Since its announcement by Gartner in late 2019, SASE has been the focus of attention, and there needs to be more clarity around the term. To shed light on the current and future state of SASE, the Telecom Council of Silicon Valley, a telecoms think-tank whose members represent the majority of the telecoms industry, is organizing a 'Roundtable on SASE .’ SRI Headquarters in Menlo Park will host the gathering.

In a post-pandemic ‘borderless’ business landscape, where remote work is the new norm, organizations must take necessary measures to ensure their company network is protected at maximum capacity at all times, even with the various and sometimes unknown devices that have access to the company cloud.

The modern workforce is scattered, almost solely digital patterns pave the way for critical cyber-attacks and create huge security vulnerabilities in enterprise networks. The need for state-of-the-art network security has gone beyond the office buildings and has become a matter of 'anywhere, anything, anytime.

With organizations’ ever-growing need for advanced network security, SASE (Secure Access Service Edge) has been introduced by Gartner and is considered, by many, the future of cyber security.

SASE is a cloud-based network security solution that integrates networking functions and security to secure mobile and remote access, defend against threats, and ensure secure connections for users and devices.

Telecom Council Roundtable will welcome major players from the technology community including Verizon, Ericsson, Orange Telecom, and Deutsche Telekom. Presentation on the future of SASE and the opportunities for innovation will be presented by Zenarmor’s Founder & CEO Murat Balaban.

Murat will discuss the confusion around the term, which he believes is created by the incumbent network and cloud security vendors. He will try to demystify the original promise of SASE, the need to deliver enterprise network security anywhere, anytime.

The following panel will discuss how SASE should be enhancing cyber protection for enterprises through an integrated technology suite like Zero Trust, Identity Driven protection mechanisms and significantly lower costs for a high-quality service. Ways organizations can improve agility with SASE technology will also be among the discussion topics with industry-specific tips and best practices.

Last but not least, Murat will also talk about the company vision and the future of Zenarmor SASE, as well as some key features of the product, such as instant deployments, fast updates, and cloud-based easy management that will eventually take any organization’s network security to the next level.

Transparent Policy Enforcement for your Employees:
Customizable Landing Pages for HTTPS Blocked Responses

With Zenarmor 1.12, whenever content is blocked the user is presented with a landing page explaining why access to certain HTTPS encrypted websites has been restricted, either by policy or Threat Intelligence.

For cyber security programs to be effective, it is essential for employers to limit or block access to certain HTTPS websites while also protecting the organization’s and individual employee’ confidentiality at the highest level possible. Zenarmor’s Custom Landing Pages (CLP) helps make everyone more knowledgeable about potential threats to their organization, and at the same time reassures them that they are protected.

As the Zenarmor NGFW owner you now have the ability to create Custom Landing Pages, helping employees to understand why certain HTTPS pages are blocked because they do not comply with company policies, how they could be potentially harmful, or unintentionally introduce cyber risks to your organization. This feature also has the benefits of eliminating related calls to the helpdesk and user frustration in not understanding why they cannot access certain web content.

With Zenarmor1.12’s new Customizable Landing Pages, organizations can now be fully transparent about organizational policies, while delivering a safe and protected environment for everyone on your network.

Secure Web Gateway (SWG) Solution For Enterprises

If you’re an enterprise network administrator, you can now deploy Zenarmor as a Secure Web Gateway on supported Linux platforms including OPNsense, FreeBSD, Amazon Linux, Ubuntu and CentOS to establish secure connections between any two devices to protect both your company and your employees against online threats.

Since the solution utilizes the same product infrastructure, by deploying Zenarmor Secure Web Gateway, you will have the unmatched agility and flexibility to instantly provide secure service edge (SSE) connectivity for wherever you might have any network access.

For Cloud workloads, the ability to instantly deploy Zenarmor’s SWG on the platform of your choice and start enjoying Outbound or Egress controls, preventing unauthorized access by internal resources to possibly dangerous endpoints out there in the wilds of the internet.

Zenarmor’s NGFW and SWG solutions deliver using a zero CAPEX subscription model, resulting in significant savings by eliminating capital expenditures related to purchasing combined software and hardware firewalls with expensive annual maintenance contracts.

Having zero dependency on vendor specific hardware is not just beneficial during the initial deployment, but also extremely efficient and flexible for future updates. Zenarmor gives you complete control over the timeline and the costs associated with updating your firewall hardware to improve performance without additional licensing costs for your NGFW. Need to move your subscription to take advantage of faster hardware? Simply contact us and we’ll issue a new key.

Need faster throughput? Reallocate your platform resources, and off you go! No changes to software licenses or subscriptions required!

Why are SWGs crucial for multibranch enterprises?

As your workforce grows, the more your organization becomes exposed to dangerous cyber activity. Increasing the number of employees connecting to the internet accessing cloud based servers increases the number of potential security gaps that can be reached through multiple devices. Zenarmor SWG lets you easily apply company policies across all connected devices to protect your servers against online attacks in real-time.

To remain competitive, business landscapes are changing at an ever increasing rate, with borders being removed or redefined to take advantage of the latest technology or online services. To keep pace with these changes, leading companies are already taking the actions necessary to secure their resources and support this new and flexible way of working by deploying Zenarmor’ Secure Web Gateways.

More Good News for MSSPs: Role-based, Granular Access Controls for Managing Customer Firewalls as a Team

Zenarmor is, without a doubt, the most flexible and cost effective solution for MSSPs of any size to provide next generation firewall services to their customers. Zenconsole allows you to manage all your firewall instances through a single pane of glass and save you the time and effort of going back and forth between multiple systems, logins and building scripts in an attempt to manage firewall policies across your customer’s networks.

Zenarmor 1.12 now offers role-based, granular access controls for firewall management. This allows you to not only share different firewalls with particular customers but also provides the ability to assign individuals with permissions for specific roles aligned with their specific needs and level of authorization.

Through Role-based Firewall Sharing, different customer’s employees (or partners) can now have the delegated ability to create policies, rulesets, schedule reports and manage firewall instances as they please without having to request permissions or ask for the changes to be made, resulting in the MSSP saving significant operational costs.

If you’re an MSSP interested in Zenarmor, please visit our Managed Security Service Providers page to learn more about how our solutions support MSSPs businesses and how MSSPs can extend their service offering to their customers with a cybersecurity solution provided by Sunny Valley Network. Or better yet, contact sales-at-zenarmor.com to discuss how we can help your business grow!

Concerned about Privacy of your Zenarmor NGFW Deployment?
Easily Manage your Privacy Settings

Everyone from Home to Government users has the ability to manage all aspects of their Zenarmor firewall deployments. Zenconsole’s cloud based management privacy settings allows users to restrict or share information about their deployment.

Working with Amazon Web Services (AWS)?
Zenarmor has you covered, as well!

If you’re a network administrator working with Amazon Web Services, we have very good news for you! You can now install Zenarmor on Amazon Linux to benefit from advanced NGFW features for your organization.

The installation is as simple as it gets and takes less than a minute to deploy. With Zenarmor NGFW running on Amazon Linux you can ensure your delivering the best possible cyber security for your organization by utilizing Zenarmor’s NGFW features or utilizing our SWG solution to make sure the online presence of your company and workforce is protected at all times.

If you are looking for Egress / Outbound filtering for your AWS VPC assets, you can now deploy industry’s best and most efficient solution in minutes. Instantly deploy Zenarmor on your VPC gateway and you’re all set.

Experience the Best: 15-Day Zenarmor Business Edition Free Trial

Everyone who deploys Zenarmor and logs into their Zenconsole can now experience all the features Zenarmor has to offer via a 15-Day Free Trial of Zenarmor Business Edition, without having to fill in credit card details.

Once your initial configuration of Zenarmor is completed, you will be offered a free trial key to experience all the great features included in Zenarmor Business Edition that are loved by small offices to multi-branch enterprises, including:

• Protection against Malware, Phishing and Virus outbreaks
• Advanced Analytics,
• Automated Botnet Filtering
• Centralized Reporting and so much more

If you haven’t done so already, why not get going right away by simply logging into your Zenconsole or create an account to start your 15-day Business Edition Free Trial today!.

Watch Now

Based on customer input, we’re very pleased to announce the release of Zenarmor 1.11. This release includes great new features that benefit all Zenarmor users, no matter how large or small the network they’re protecting.

Let’s take a quick look at the new features included in Zenarmor 1.11.

Install Zenarmor on your Operating System of choice!

Building on our tradition of providing Network Administrators with the ability to deploy our Next Generation Firewall (NGFW) on their preferred OS, wherever and whenever it is needed, the latest release of Zenarmor offers users even more deployment options. This latest Zenarmor release now includes support for Ubuntu 21, world’s most popular open-source desktop operating system and the Debian 11 “bullseye” operating system which is suitable for many different use cases from netbooks to cluster systems.

Most firewall providers require expensive proprietary hardware that is costly to purchase and maintain. As a software provider, Zenarmor gives you the freedom of choice to deploy on the latest hardware available, or repurpose your existing servers to create high performance NGFWs. By providing support for multiple ethernet interfaces in this release, Zenarmor’s Linux OS based NGFWs delivers state of the art network security utilizing the distribution preferred by your organization. We’ve delivered that functionality to our customers who have deployed Zenarmor with OPNsense for some time and are very pleased to provide the same capabilities to our customers running Linux.

Set it and Forget it: Real-time Policy Synchronization from the Cloud

Enterprise customers, as well as home and business users can now easily implement changes to their security policies from the cloud. Zenarmor 1.11 now automatically synchronizes policy changes across all Zenarmor NGFW instances deployed on your networks. Simply enable the real-time sync option from your Zenconsole (formerly Cloud Portal) and avoid spending time manually updating and syncing policy changes ever again!!

Faster, Easier and More Efficient NGFW Management For Partners

No matter which open source firewall or OS you’ve made the decision to deploy, eg. OPNSense, FreeBSD, Debian, etc., Managed Security Service Providers (MSSP’s) can now administer Zenarmor on behalf of their customers without having to interact with individual Zenarmor instances deployed across their network. Simply login to the cloud based Zenconsole and easily deliver the latest and consistent set of security policies across the network you manage for your customer.

Real-time Botnet Command and Control (C&C) Blocking

The increased popularity of IoT devices used in both home and corporate networks present a new set of Cybersecurity challenges. Any IoT device connected to the internet is exposed to Botnet attacks, which in turn puts all your online assets at risk.

With our latest release, Botnet Detection, auto-blocking is now available to help secure your network utilizing the latest cloud-based real-time Threat Intelligence database covering more than 300M sites. Zenarmor 1.11 instantly detects malicious Botnet activity and blocks them instantly across all ports and devices.

To enable this feature, simply head to Advanced Security, and toggle the “Botnet C&C” button. It’s that easy!

Smart IP Detection

With the 1.11 release, Zenarmor can now detect, sort, analyze and block IP sources utilizing threat intelligence. We now cover both domains and the IP addresses that are linked to them as well to identify potential malicious activity.

Unlike DNS based firewalls, Zenarmor effectively protects your network against encrypted DNS traffic hiding behind HTTPS encryption at the domain level. With this newly improved network security, you can easily block specific IP addresses to minimize your organizations cybersecurity risks.

We have more Good News for SoHo and Home Users!

Less is More, especially if you’re an OPNSense user: the SQLite relational database backend is now supported!

The development team at Zenarmor is in a constant quest to provide Enterprise grade network security capabilities even to the most resource constrained environments. Zenarmor 1.11 now provides users an option to deploy utilizing Sqlite as the relational database backend!

By supporting SQLite (the most widely used database engine in the world) on OPNSense, Zenarmor now delivers enterprise-grade network security for smaller environments, including home or small office networks, by eliminating the need for expensive hardware typically associated with network security.

SQLite provides all of the advanced analytics and reporting functionalities needed in a home or small office environment, while at the same time providing all the advantages of being a light-weight database compared to the alternative Mongodb backend.

If you are a home or small business with less than 100 devices we think you’ll really appreciate this option.

For a deeper dive into all the new functionality included in this release, please take a look at our New Release Notes. While you’re at it, please be sure to follow us on linkedin and stay up to date on the latest developments at Zenarmor!

Give Zenarmor 1.11 a try and let us know what you think! We’d love to hear from you.

If you’re not yet a Zenarmor customer, you can start your 15-day free trial with all the Business Features by clicking below.

Watch Now

“Will has a successful track record of accelerating enterprise sales growth based on delivering positive customer outcomes. He will be instrumental in leading the development of our Sales organization, while also ensuring alignment with the Marketing and Technology teams in support of Sunny Valley’s growth initiatives,” said Murat Balaban, CEO of Sunny Valley Cyber Security, Inc.

I’m excited to join Sunny Valley Cyber Security and contribute to the growth of the company. Organizations need the ability to digitally transform business operations without compromising their cyber security. Traditional approaches to enterprise network security are not keeping pace with today’s rate of change in cloud-based services and supply chains. Sunny Valley’s Zenarmor® enables organizations to meet these complex challenges while also supporting the employee’s ability to work securely from any location or any device.

Extending product range for OPNsense® based firewall deployments – an essential mission for Landitec® as official OPNsense® Platinum Partner

Recent observations and statistics of IT technology developments clearly show that security threats and potential attacks on digital networks increase continuously with the global growth of IT infrastructures. Considering this fact, providing reliable, contemporary as well as user-friendly network security solutions is a persistent challenge Landitec® has been solving conscientiously and professionally for over fifteen years now and will continue to do so. By being official OPNsense® Platinum Partner and now also officially cooperating with Zenarmor, customers profit on demand from exclusive features and services such as: preinstalled software installation including one year OPNsense® Business Edition license without additional charge, all features of Zenarmor’ NGFW Plug-In – containing, among others, L2-L7 packet filtering, application control, user/device-based filtering, policy-based filtering, web filtering and DNS security – enabling companies to deploy firewalls on demand and secure their networks quick and easily.

The collaboration of Landitec® and Zenarmor is further evidence for the increasing importance and demand of secure, convenient and highly efficient firewall solutions. The long-term experience of both companies in the IT security field is going to ensure an overall satisfying product and service experience all customers can look forward to.

Murat Balaban, founder and CEO of Zenarmor, said “Built upon the open source heritage; and its field-proven reliability and stability, OPNsense® is a very powerful enterprise-grade firewall already offering many features available in commercial counterparts. Our idea to integrate Zenarmor™ with OPNsense® was to join two huge forces: fueling the open source legacy with the advantages of the commercial world. With such a powerful distributor like Landitec®, this will be a nuclear fusion, creating tremendous synergy. We firmly believe this partnership will disrupt the European UTM market.”

About Zenarmor

Actively backed by Arché Assets International, Zenarmor is a leading Secure Access Service Edge (SASE) vendor, poised to radically change how network security is being delivered. It’s all-software, lightweight and powerful packet inspection technology is an industry-first. The company boasts to provide “instant network security” for today’s perimeter-less, hyper-distributed, post-Covid world.

https://www.zenarmor.com

About Zenarmor

Zenarmor is a versatile NGFW Plug-In solution developed by Zenarmor. Zenarmor’s lightweight and powerful technology allows organizations to launch instant firewalls on demand and easily secure environments as small as home networks or scale to multi-cloud deployments. Packet inspection core is powerful enough to protect against encrypted threats while also being so lightweight and nimble that it can even fit in very resource-constrained environments. Zenarmor is software-defined and is compatible with various applications as a Plug-In solution.

https://www.zenarmor.com/zenarmor-next-generation-firewall

About Landitec Distribution GmbH

Landitec® Distribution GmbH is a specialized distributor for network equipments located in Kamen, Germany. Landitec’s product portfolio consists of hardware solutions which are designed for purposes such as digital signage, industrial solutions, In-Vehicle appliances and embedded boxes with wide temperature range. In addition, Landitec® cooperates with well-known software companies with focus on firewall, NG firewalls, network monitoring, NAC, SD-WAN, SDN, load-balancing and more. Furthermore, supporting open source software projects is a part of Landitec’s business philosophy. The combination of high-performance hardware and open source software is enriched by Landitec’s quality management, extensive service and deep engineering experience.

https://www.landitec.com

Last Update: December 19 1:00pm Pacific Time

This advisory addresses the Zenarmor on OPNsense firewall. For other platforms, Zenarmor does not directly manage the installation of Elasticsearch. Please consult with your database administrators on how to take proper actions.

TLDR;

If you’re using Zenarmor with the Elasticsearch Reporting Backend (other reporting backends are not affected) on OPNsense firewall, please update your Elasticsearch packages to the 5.6.8_7 release. The new package updates the log4j library with the fixed, recommended version (2.17.0), providing the final solution.

Just head to System -> Firmware -> Updates. Click on Check Updates. You’ll see an elasticsearch update reported (From 5.6.8_5 to 5.6.8_7). Run the update and restart the Elasticsearch service from Zenarmor -> Status.

Please read on below if you would like to learn more details.

Background

Several vulnerabilities (CVE-2021-44228, CVE-2021-45046,CVE-2021-45105 ) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly on December 9 through December19, 2021. Log4j is a standard logging library used by many Java applications.

Is Zenarmor Affected?

Core Product: Not affected
Not employing Java

Reporting Backends:

Mongodb Backend: Not affected
Not employing Java

Sqlite Backend: Not affected
Not employing Java

Elasticsearch Backend: Affected, Elasticsearch package update recommended.
Since Elasticsearch is coded in Java and utilizing the aforementioned log4j library, we’re closely monitoring the official updates from the Elastic.co.

Update: December 19 1:00pm PT

Another DoS vulnerability was discovered in log4j library. We’ve updated the Elasticsearch package to 5.6.8_7 handling all these reported CVEs. Please read below to learn how to update your Elasticsearch Reporting Backend.

Update: December 16 8:00am PT

Elasticsearch updated its advisory, citing Elasticsearch 5.x as also vulnerable. Please read below to learn how to update your Elasticsearch Reporting Backend.

Update: December 13 2:00pm PT

As of now (December 13, 2021), the official announcement is as such:

“Elasticsearch is not susceptible to remote code execution with this vulnerability due to our use of the Java Security Manager, however we are making a fix available for an information leakage attack also associated with this vulnerability.”

Source: https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476

Final Solution:

We advise the following course of action.

We’ve shipped an updated build of Elasticsearch. Please update your Elasticsearch packages to the 5.6.8_7 release. The new package updates the log4j library with the fixed, recommended version (2.17.0), providing the final solution.

This update handles all three reported CVEs. (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)

Steps to update (on OPNsense):

1. Head to System -> Firmware -> Updates. Click on Check Updates. You’ll see an elasticsearch update reported (From 5.6.8_5 to 5.6.8_7). Run the update.
2. Restart the Elasticsearch service from Zenarmor -> Status

You’re done.

FAQ:

Does this update handle all three CVEs?

Yes. This update handles all three reported CVEs. (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)

Are you going to switch to Elasticsearch 7.x?

Starting with OPNsense 22.1 and/or Zenarmor 1.11, new installations will automatically default to installing Elasticsearch 7.x. For those who have data on Elasticsearh 5.x, we’re planning to maintain the Elasticsearch 5.6.x release series for shipping security updates for a year more (till January 2023). Please stay in touch for updates.

After a four-month marathon, we’re super excited to announce the public availability of Zenarmor 1.10 release. Managing your Zenarmor instances becomes a lot easier thanks to the new capabilities introduced with the Cloud Management Portal.

Also important to note, you are now able to deploy Zenarmor as an L2 Filtering Bridge. Please read on to learn more about all the new exciting features 1.10 is bringing to you.

Cloud Central Management

With Zenarmor, our mission is to "bring network security closer to wherever you have networking”. In accomplishing this goal, central management is a key piece. With this release, we’ve taken a huge step to provide the foundation for managing hundreds and even thousands of firewalls from a single pane of glass.

Cloud Agent has been re-written from scratch. Long live Golang!

The new cloud agent is now benefitting from the unmatched performance, concurrent processing, and resource-preserving capabilities of the Golang programming language. Golang supports a long list of platforms, which makes it a lot easier for us to be able to support additional platforms in the future. With 1.10, you’ll notice that the cloud agent is consuming a lot less CPU and memory.

Cloud Alerts & Notifications

Customizable notifications allow you to be notified of important Zenarmor events on your firewalls. Central notifications can be delivered through the Portal UI and/or via e-mail.

Figure 1. Zenarmor Notifications

All Firewalls Dashboard

This is a bird’s eye view of all your connected firewalls displaying their system statuses, threat levels, and top bandwidth consumer hosts and applications.

Subscriptions are now available for the new platforms

If you are on one of the newly introduced platforms (FreeBSD, Linux) and want to use Zenarmor’s advanced paid features on them, you can do it now through the Cloud Portal. Just head to My Firewalls -> Select your firewall -> Settings -> Subscriptions. Enter your activation key and you’ll be done in seconds. You can move your key between firewalls on different platforms. Just make sure a single key is only activated on a single firewall.

Transparent Filtering Bridge (L2 Deployment Mode)

Deploy your Zenarmor as a Secure Web Gateway alongside another firewall (L2 Bridge)

Manage it either through the OPNsense Web UI or centrally through the Zenarmor Cloud Portal.

MAC Address based policies

Device-based filtering is now possible with MAC Address based policies. This allows you to filter devices independent of their IPv4 / IPv6 addresses. Reports also display the device hardware addresses. Drill down to filter reports and view them with per-device granularity.

NFQUEUE deployment mode (Linux-only)

If you’re on a Linux system and do not want to use netmap for the packet I/O interface, you can now select NFQUEUE as the deployment mode. Since NFQUEUE is pretty standard in all Linux systems, it’s a very convenient way to do filtering & reporting.

Lots of more features on the Release Notes

Feel free to have a look at 1.10 Release Notes which discusses all the new features, improvements and bug-fixes that are shipping with 1.10.

Let’s keep in touch

Follow us on social media and join the conversation in Zenarmor’s Reddit channel and OPNsense forums:

• Twitter
• Reddit
• OPNsense forums

All the best from your Zenarmor team

Enjoy!

Watch Now

You’ve known and loved Sensei as the popular Next Generation Firewall plug-in for the OPNsense open source firewall. As the creators of Sensei, we’ve been fortunate enough to have been providing the product to the elite OPNsense community. Working with you, we’ve received tons of precious feedback which eventually helped Sensei grow as one of the most promising solutions in the world today.

Over the last few months, we have poured our hearts and souls into creating a new name that would more accurately depict who we are and what we are born to accomplish:

“Delivering enterprise-grade network security at agile speeds. Anywhere and Anytime.”

With the new name, we wanted to convey that the product you’ve been using with love is a peaceful, light-weight, agile and yet powerful protector of your digital assets.

Choosing a name that can tell all about this with a single word was not an easy task. It was as hard as creating the product itself!

We were lucky. Zenarmor stood out as the perfect match with our mission!

New name, new logo – same product you know and love

The product has a new name and logo. The rest stays the same, even better. Most of the changes you’ll notice are cosmetic, including

• A new logo

• New brand name

• Some updates on our website, subscription plans, documents and communication tools

In the spirit of rebranding, we will continue to commit to our customers and provide the same, or better, level of professionalism you have experienced. We’d like to take the opportunity to thank our loyal customers and business partners for your trust and friendship in business.

Next Episode

With Zenarmor® 1.10 (ex. Sensei), you’l notice that OPNsense menu bar displays both names as “Sensei (Zenarmor)”, and all the other Sensei name references have been replaced with the new brand name.

All functional parts stay the same (including the os-sensei-* packages).

We want to hear from you

As stated, changes have been kept at the cosmetic level so that while you are enjoying Zenarmor, your experience will be staying the same if not better. For now, all you need to do is to stay in touch :)

As you notice changes in our branding, signs, and promotions, we would certainly love to connect with you. Feel free to reach out with any thoughts, requests, or compliments. If you enjoy social media, please connect with us.

You can follow our announcements through our Blog, social channels; or just feel free to shoot an email to with your comments and suggestions. Your opinion means a lot to us.

• Sunny Valley Blog
• Sunny Valley Twitter
• Zenarmor Board at OPNsense Forums
• ^NEW Zenarmor Twitter
• ^NEW Zenarmor Reddit

Enjoy!.

Best

Your Zenarmor team at Zenarmor!

_{^{Photo by Shikha Majhi on Unsplash}}

The internet has not only significantly changed communication styles, but it has also redefined the entire education system. Students and learners do not have to get lost in encyclopedias any longer, instead, they have a new way of doing research, the ability to think critically to compare resources of information and the opportunity to come up with authentic ways to express themselves.

Unfortunately, the internet can also be a gateway to harmful and inappropriate content, especially for young people. School safeguarding policies are crucial to keep students safe both online and offline. Most countries enforce legislations which require schools to have an appropriate content filtering and monitoring service that controls what kind of websites students can access through the schools’ networks.

Safer Internet Section of the Communications Regulatory Authority of the Republic of Lithuania (RRT), conducts a strict evaluation system to decide which content filtering services are suitable to be officially recommended for educational institutions within the Republic of Lithuania.

The RRT starts by identifying potentially appropriate content filtering providers, and performing virtual tests that focus on crucial aspects for school network protection such as Web Based Proxy sites, Application Control, and Web Categorization.

A powerful content filtering system applies specific parameters to content that is being received through the internet, and makes the decision to restrict or allow access to certain materials on websites or in emails. It is usually a part of a firewall.

During the evaluation of Zenarmor, virtual machines were put to use. Two virtual clients were connected to the virtual OPNsense Firewall / Router with Zenarmor to assess the content filtering and web categorization functionalities of the product.

After a thorough analysis, RRT now officially recommends Zenarmor as a suitable content filtering provider for all nationwide academic institutions like schools, colleges, universities and libraries.

Find the official statement from Communications Regulatory Authority of the Republic of Lithuania approving Zenarmor here.

Looking to secure your school network? Find out more about what Zenarmor has to offer for the EDU landscape here.

Latest Update: July 31, 2020 12.10 pm

TL;DR – Qstrong textuick Answer

Unfortunately not yet.

So, what’s the netmap status with OPNsense 20.7 stock kernel?

OPNsense 20.7 is based on HardenedBSD/FreeBSD 12.1. In the overall, we saw improvements with some drivers while experiencing regressions with some. For some drivers, the situation seems to be the same. See below table for a detailed overview. If you’re using Zenarmor and/or Suricata with any of the problematic drivers, you should be careful:

OPNsense 20.7 (FreeBSD 12.1) netmap status

So, where are we now? When can we expect improvements with regard to problematic/unsopported drivers?

We’ve already started the work on the upstream project side: netmap. The project has two main objectives:

1. Quickly fixing reported bugs in such a manner that they are quickly made available for FreeBSD -> HardenedBSD -> OPNsense.

2. Improving device-driver support for netmap. We’ll be focusing on providing netmap support for tun, lagg and bridge interfaces.

The former will increase netmap stability and reliability to a great deal, while the latter will provide the long-awaited capability to be able to protect VPN (OpenVPN, Zerotier, Wireguard etc), Bridge and LAGG interfaces.

Thanks to netmap maintainers being fast to respond and fix, our first two reported problems are now fixed in the upstream project. vtnet crash fix has already been integrated into FreeBSD 12-STABLE. em VLAN patch is awaiting review and it’s highly likely that it’ll land on 12-STABLE soon.

You can view the current project status here: Google Docs – Netmap status as of OPNsense 20.7 RC1

When can we test / use the enhanced netmap support?

We hope to provide a netmap test kernel around late August / September this year. But it’s highly likely that OPNsense will start landing them on the project starting with OPNsense 20.7.1 or 20.7.2.

How can I help?

Testing the stock / test netmap kernel with different drivers and providing feedback through either:

1. OPNsense Forum

2. Google Docs Worksheet – Netmap status as of OPNsense 20.7 RC1

3. Sunny Valley Support Portal: Zenarmor Support Portal

This would be of great help since we need to spot problems to be able to start fixing them. Your help is much appreciated.

Watch Now

1. Routing and Firewalls
2. Traffic Shaping and Bandwidth Quotas
3. Virtual Private Network (VPN)
4. Captive Portal
5. IPS-based protection
6. Realtime protection against emerging threats
7. Active Directory or LDAP Integration
8. Web content filtering
9. Url filtering
10. High Availability

Schools however have additional internet security needs and legal liabilities that include the Children’s Internet Protection Act (CIPA), enacted by Congress in 2000 to address concerns about children’s access to obscene or harmful content over the Internet. CIPA requires that Internet safety policies are in place that includes technology protection measures that must block or filter Internet access to pictures including: (a) obscene; (b) child pornography; or © harmful to minors (for computers that are accessed by minors).

And although the technology requirements are similar between enterprises and schools, the budgets are not. With OPNsense and Zenarmor, however, school districts and colleges now have a solution that can meet all of these requirements yet still have the protection of a Next Generation Firewalls at under $1 per device.

Solution: OPNsense + Zenarmor

OPNsense is one of the best open-source firewalls out. It is an easy-to-use HardenedBSD-based firewall and routing platform that includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources. The operating system is based on HardenedBSD, which is a security-hardened version of FreeBSD. FreeBSD is the operating system that you’ll find lying under the hood for companies such as Netflix and Yahoo!

The Firewall implementation for FreeBSD is pf and IPFW packet filters, both are considered two of the most mature packet filtering systems. OPNsense also provides its users with a powerful packet shaping and bandwidth management system called ALTQ, which is again courtesy of the strong underlying operating system.

OPNSense has an IDS/IPS capability fused into the product. The underlying technology is Suricata, which is what you’ll see if you unbox many commercial products that are on the market today. They even offer free and paid versions of the Emerging Threats ruleset.

With OPNsense, you’re also not limited to one solution for VPN access. You have several options like IPSec, OpenVPN, and the newly introduced Wireguard without user limits.

Installing, configuring, and using OPNsense is a no-brainer thanks to its intuitive interface. You will never need to access the “black console” to do maintenance or operation. Everything can be done over the beautifully designed web interface.

Finally, OPNsense is a live project that ships two major updates as well as a dozen minor updates every year. Because of its security-centric approach, critical security vulnerabilities also get patched within a very short time.

What about Next Generation Firewalls (NGFW)?

OPNsense also has a very flexible plugin architecture that makes it easy for developers to add new functionality to the firewall. Leveraging OPNsense’s architecture, Zenarmor has developed an easy-to-install plug-in that empowers OPNsense with Next Generation Firewalls features.

Zenarmor Free Edition is made available at no cost to OPNsense users. The Premium Subscription offers more advanced features and can be purchased through the Zenarmor web user interface.

Because the Premium Subscription is not priced as a complete firewall, the OPNsense + Zenarmor combination is the best solution on the market in terms of price and value.

The technology behind Zenarmor is a very powerful packet analysis engine that can also provide protection against encrypted cyber-attacks.

Key Zenarmor features include:

• Commercial grade web/content filtering and ad blocking for 140+ million sites
• Auto-filtering against emerging malware, virus, and phishing attacks
• User/Group based security with Microsoft Active Directory or OPNsense LDAP integration.
• User access control with Captive Portal
• Application-based filtering
• Best-in-class network reporting and analytics
• Policy-based filtering
• Encrypted attacks protection

What Our Customers Have to Say:

We have been using Sunny Valley’s Zenarmor with our OPNsense Firewall Cluster for 3 months now and are very excited about the performance. Thanks to the additional features such as “Web Security & Cloud App Controls” or “User-based filtering”, our firewall now acts as a complete Next Generation Firewall. Thanks to the fair price model, a professional solution like the Zenarmor Plugin is now also accessible to schools with a limited budget. The professional team at Sunny Valley knows how to help at any time.

“Kantonsschule Frauenfeld (Cantonal School Frauenfeld)”

Conclusion

While firewall technology requirements for educational institutions are similar to enterprises, school budgets are not. With OPNsense and Zenarmor, school districts and colleges now have a solution that can not only meet all of an educational institution’s requirements but also have the protection of a Next Generation Firewall with amazing filtering capabilities like content filtering etc. all at under $1 per device.

More information about SunnyValley Networks and Zenarmor can be found here:

Web: Zenarmor Apply for Edu Discount: Zenarmor Edu Discounts

Watch Now

The complete guide can be found on the Zenarmor Premium Features Guide.

Security

Advanced Threat Protection

Zenarmor Premium provides Advanced Threat Protection against the latest malware, viruses and phishing attacks by blocking websites that are known to host malware and viruses and launch phishing attacks. With SunnyValley’s Advanced Threat Protection feed, users are provided with near-real-time commercial-grade threat tracking and protection.

Suspicious Domain Blocking

Zenarmor Premium blocks suspicious domains including expired domains, hacked and newly registered domains (NRDs) favored by threat actors for launching malicious campaigns. Research shows that NRDs, for example, are risky, revealing malicious usage of NRDs for phishing, malware, and online scams. In addition, Sense Premium also blocks any expired DynDNS sites.

Reporting

Customized Reporting

Zenarmor Premium provides you with the capabilities to create your own reporting views.

PDF Export

With a single click, you can export reports and charts as PDF files.

Filtering & Compliance

Customized Landing Pages for Blocked Sessions

With Zenarmor Premium, IT administrators can create custom response web pages that are displayed when a user tries to access a blocked URL. With custom HTML pages, messages are displayed when a user requests a web page or file.

Web and URL Filtering

Zenarmor Premium lets administrators create customizable web filtering profiles and policies based on a cloud-based web categorization of 140+ Million web sites under 60+ categories.

Policy-based Filtering

Policy-based controls let users create an unlimited number of policies to customize filtering and controls for different groups of users. With Zenarmor Premium, an unlimited number of policies can be created based on Network Interfaces, VLANs, Subnet / IP addresses and users/groups. All policies are controlled via the Policy Wizard.Filtering Policies by Interface/VLAN and IP/Network Address.

Enter the VLAN number and IP/Network Address.Users and Groups and Schedule Filtering

By enabling Captive Portal or installing the Zenarmor Active Directory Agent on an Active Directory server, users can be added to OPNsense for user-based filtering.

Integrations

Zenarmor Premium can stream data to external, remote Elasticsearch or MongoDB servers for log parsing and Security Information and Event Management (SIEM) system integration. In the Configuration section of the Zenarmor OPNsense portal select the Reporting and Data tab.

API Access

Zenarmor Premium provides API access for Zenarmor engine configuration and management. Rest API Security Tokens can be created by navigating to Configuration and scrolling down to REST API Security Tokens.

Support

Premium Support provides access to the Zenarmor Help Desk. Through the Help Desk, users can access configuration and access information, create high-priority support tickets for SVN engineers that are available 24/7.

Zenarmor Home Subscription

Priced $9.99/month or $99/year, Zenarmor Home Subscription is available for OPNsense Home users. Until December 31, 2019, Zenarmor Home will be available for up to 50 devices.

With in-app purchase option, you can now purchase Zenarmor Home easily through Zenarmor User Interface:

Performance:

• UI responsiveness has been increased considerably

Reporting:

• Fully Customizable Dashboard. You can now choose which Charts gets displayed in your Zenarmor Dashboard

• Scheduled Reports are now available for Mongodb backend

• Security Reports: “Block Message” added as a filter for Security Reports

• Bug-fix: Mongodb auto start problem resolved

• Bug-fix: Mongodb backend: Top Destinations Heatmap

• Bug-fix: OPNsense Zenarmor Dashboard Widget fixed to handle an error condition

Other:

• Shortcut to Contact Zenarmor Team directly and easily from Zenarmor User Interface

• A better and user friendly notification and warning interface

• Bug-fix: Handle Hardware Check falsely reporting a low-device in some cases

• Other performance and reliability improvements support

Updating:

Zenarmor automatically gets updated to the recent release when you do a OPNsense update. If you want to update Zenarmor only, you can do that. Just navigate to status page. Click on “Check for Updates” for the engine. You’ll be guided for the rest.

Installing Zenarmor:

You can install Zenarmor via OPNsense Plugins page (System > Firmware > Plugins). You need to install os-sunnyvalley and afterwards os-sensei plugins. Check below links for more details:

• Zenarmor installation

• OPNsense download

Enjoy 🙂

Your Zenarmor team

It’s a pleasure to share this news: Zenarmor has been selected for the SpiceWorld Startup Zone, featuring top ten hot startups from the tech scene.

Selected startups span the IT spectrum – from hardware & software management and storage/backup to cyber security and messaging/chat.

SpiceWorld is “the most happenin’ tech conference in North America”. This event brings together thousands of IT pros and vendors and hundreds of tech marketers for 3 jam-packed days of learning and networking.

Conference will be held on October 8-10 at Austin Convention Center, Austin, TX. More information from the SpiceWorks web site: The Spiceworld Startup Zone

There, we’ll be doing our official launch for Zenarmor, our next generation plugin for firewalls.

Zenarmor empowers your existing firewall with state of the art features like Application Control, Drill-down network visibility, Web Security, Encrypted Threats Prevention and Cloud Threat Intelligence.

Come join us at SpiceWorld; and see how Zenarmor turns your L4 firewall into a next generation one in just minutes! Meet us around the Startup Zone.