ControlIT Secure Access
Turn the internet into your secure enterprise network.
- Overlay Network
- Zero-Trust Access
- Site-to-Site and Cloud
- Application Access
- Connect
- Control
- Extend
Internet Is the New LAN
Secure access, controlled internet and IT operations, on infrastructure you choose.
Nothing Listens on the Internet
No inbound ports, no public IPs, no VPN concentrator. Every endpoint dials out.
ControlIT Secure Access
Branches, clouds and remote staff on one private network, over the internet you already have.
Controlled Internet, Everywhere
URL, category and application policy for every user and branch, logged by who asked.
Your Active Directory, Over the Internet
Domain logon, Group Policy and remote domain join from home, a branch or the plant floor. No Entra ID, no connector.
ControlIT Core
RMM and helpdesk, patch management and remote access, in one console.
ControlIT Identity
Single sign-on and MFA for every app, on the directory you already run.
User plus Device plus Identity plus Policy equals Corporate Network.
The enterprise network is no longer defined by a building. It is defined by secure connectivity, identity and policy.
What the architecture guarantees.
Nothing Exposed
No inbound ports. No public IPs. No VPN concentrator.
Endpoints dial out to the overlay. Nothing you run has to listen on the internet.
Same Directory
No hybrid join. No directory sync to a vendor cloud.
Your Active Directory stays where it is, and stays yours.
One Place to Run It
Access, identity and operations in one console.
Windows and Linux endpoints, reached and run from the same place.
1,000+Devices under one ControlIT implementation, for a major solar cell manufacturer. Client name withheld.
Five modules, one path in.
Secure Access connects, controls and extends your network over the internet. IT Management runs the endpoints and the sign-ins on the same outbound path.
Secure Access
Connect, control and extend your network over the internet you already have. No VPN concentrator, no Entra ID, no inbound ports.
ControlIT Web Gateway
Control and secure internet access for every user, branch and remote laptop.
- URL and Category Filtering
- Application Control
- Malware and Phishing Protection
- User and Group Policies
- Logging and Reporting
- Connect
- Control
- Extend
ControlIT AD Anywhere
Your existing Active Directory, over the internet.
- Remote Domain Access
- Remote Domain Join
- No Entra ID, No Connector
- Connect
- Control
- Extend
IT Management
Run the endpoints and the sign-ins on the same outbound path, from one console.
ControlIT Core
Run every endpoint from one console, and reach it without a VPN.
- RMM and Helpdesk: monitoring, alerting, inventory and a ticketed helpdesk for Windows and Linux.
- Patch Management: OS and third-party patching with schedules, reboots and exceptions.
- Remote Access: remote desktop and SSH to any laptop or server, with no port forward and no VPN client.
ControlIT Identity
One sign-on and MFA for every app, on the directory you already run.
- SSO and MFA: single sign-on over OpenID Connect, OAuth 2.0 and SAML 2.0, with time-based one-time passwords.
- Identity and Access Management: access by group, so a role change updates what a person can open, with an audit trail.
How the internet becomes your network.
Everything dials out to one private overlay. Private traffic reaches your directory and applications directly; internet traffic leaves through the Web Gateway, where policy decides.
Connect
ControlIT Secure AccessEvery remote user, branch and cloud workload dials out to one private overlay. No inbound ports, no public IPs, no VPN concentrator.
Control
ControlIT Web GatewayInternet traffic leaves through the Web Gateway, where user and group policy decides what is allowed, and every request is logged by who asked.
Extend
ControlIT AD AnywhereYour Domain Controllers answer across the overlay: domain logon, Group Policy and remote domain join, with no Entra ID and no connector.
Many vendors, or one.
Every row is a product somebody is already licensing. The right-hand column is what one deployment does instead.
| Module | Capability | What that usually means | ControlIT |
|---|---|---|---|
| ControlIT Secure AccessConnect | Overlay Network | A VPN concentrator on a public address, sized, licensed and patched | A private network over the internet links you already have, nothing published |
| Site-to-Site and Cloud | A tunnel per branch, and another for each cloud | Branches, data centres and cloud on one private network | |
| Application Access | Network-wide VPN access for vendors who need one application | Staff and vendors reach only the applications they are approved for | |
| ControlIT Web GatewayControl | URL and Category Filtering | A cloud web security subscription, or a filtering appliance at head office | URL and category policy for every user, branch and remote laptop |
| User and Group Policies | Separate rules on each branch firewall | One policy per group, applied wherever that group works | |
| Logging and Reporting | A separate reporting tool fed from firewall logs | Every request logged by user, category, policy and verdict | |
| ControlIT AD AnywhereExtend | Remote Domain Access | Hybrid join, or a VPN that has to be up before logon | Domain logon, Group Policy and file shares over the internet |
| Remote Domain Join | A trip to the office for every new laptop's first domain join | Joined to your domain over the internet, from wherever it is | |
| ControlIT Core | RMM and Helpdesk | A separate remote monitoring and management product, plus a separate service desk product | Same agent, same console, tickets beside the device they belong to |
| Patch Management | A dedicated patch management product | Scheduled OS and third-party patching from the same console | |
| Remote Access | A VPN concentrator, plus a remote access tool | Outbound session to the endpoint, nothing published | |
| ControlIT Identity | SSO and MFA | An identity vendor and a separate MFA vendor, each with its own per-user fee | Both on the same identity, no per-user identity fee |
| Identity and Access Management | A separate identity governance product | Group-based access with one audit trail |
Every row above is a renewal someone on your team is already managing.
Internet Is the New LAN
Hosted by us, or on your infrastructure.
The same product either way. Computer Port configures the deployment around your sites, your directory and your access rules, and nothing about your network has to be published for it to work.
- Hosted by Computer Port
- We run and maintain the control plane. Your team gets the console.
- On your infrastructure
- The control plane is stood up on infrastructure you nominate, and stays inside your estate.
ControlIT Ops 24/7
Hand the monitoring, the patching and the first response to the Computer Port operations team.
24/7Every hour of the day, covered
What changes on Monday morning.
| Situation | With a VPN and a separate stack | With ControlIT |
|---|---|---|
| A laptop at home | Logon fails before the tunnel is up. | Domain logon from home, with no tunnel to wait for. |
| A laptop in a plant | Group Policy applies only when someone remembers to connect. | Group Policy on a laptop in a plant, on the same outbound path. |
| Reaching a server | RDP behind a port forward, or a jump host on a public IP. | RDP with no port forward, and nothing published. |
| Signing in to applications | An identity vendor, kept fed by a directory sync. | Single sign-on on the directory you already run. No hybrid join. |
| Proving what happened | Access logs collected from four consoles at audit time. | Access, session and admin events in one place, aligned to CERT-In reporting. |
| Internet access for remote staff | Filtered at the office, unfiltered once the laptop leaves it. | The same URL and category policy, wherever the laptop connects from. |
| A vendor who needs one application | A VPN account, and a whole subnet to trust them on. | Access to the one application, with everything else out of reach. |
Four consoles, four vendors, four attack surfaces, or one.
Your Active Directory Doesn't Need Azure to Leave the Building.
Head office, home, a branch or a plant. One outbound path, the directory you already run, and nothing published to the internet.
Is ControlIT a Fit?
Five questions that actually disqualify. Your answers stay in this browser.
Answer all five to see where to start.
You run Active Directory on your own servers today.
Remote or multi-site users need domain resources, not just email.
You rely on a VPN, a port forward or a jump host to reach machines.
You own the IT or the security decision.
You can run a pilot on real endpoints, not a lab.
Start Here
Three ways in. Each one ends with something written down.
No per-user identity fee. Priced per deployment, so the teardown below is the fastest way to a number.
See It on Your Endpoints
A pilot with the success criteria agreed first: domain logon from home, Group Policy applied on a remote laptop, a file share that works, RDP with no public port, and MFA on the same identity.
14 days
Count What the Stack Costs
We add up the VPN, the identity vendor, the MFA vendor and the remote access tool you run today, against one deployment. Your figures, not ours.
60 min
Review Your Directory
We look at Active Directory, remote access and the branch links, and you leave with a one page verdict: keep the VPN, move to Entra, or run the overlay.
45 min
The questions that decide it.
01Kerberos and LDAP over the overlay
Kerberos, LDAP and SMB travel from the client to your Domain Controller inside the encrypted overlay, as if both were on the same LAN. Nothing is published, and nothing is handed to a cloud identity provider.
02Do we need Entra ID or Microsoft 365?
No. ControlIT does not require hybrid join or a directory sync, and it does not replace the directory you run. If you already use Microsoft 365, nothing about that changes.
03Where does ControlIT run
Wherever you want it to. Computer Port can host the control plane and hand your team the console, or stand it up on infrastructure you nominate so it never leaves your estate. The product and the architecture are the same either way; only the hosting decision changes.
04What happens when the internet drops
Local users keep local Active Directory, local shares and cached logon. Remote access over the overlay waits for the path to return: the same failure domain as a WAN link today, without a concentrator to fail first.
05What gets logged for an audit
Access events, admin actions, sessions and configuration changes are recorded against your deployment, with retention you agree, and reporting aligned to CERT-In requirements.
Close the ports.Keep the directory.
Tell us what your endpoints, sites and directory look like today. We will tell you what the overlay would change, and what it would not.