Skip to content
ControlIT

Vendor Access Without a VPN

Zero-trust access for vendors and contractors with ControlIT Secure Access & AD Anywhere: every connection decided by user, device and group, so a vendor reaches only what policy allows.

One private network, over the internet

Access architecture: remote users, branches and cloud workloads dial out to one private network over the internet, ControlIT Secure Access & AD Anywhere. Private traffic reaches Active Directory and internal applications directly. Internet traffic leaves through ControlIT Web Gateway, where policy allows it out to the internet or stops it at the gateway.

What this actually does

A vendor VPN account is usually a whole subnet handed to somebody outside the company. With zero-trust access the vendor reaches only what policy allows.

  • Zero-Trust for Vendors

    a zero-trust use of ControlIT Secure Access & AD Anywhere. Every connection is decided by user, device and group, so a vendor reaches only what policy allows, not the network it happens to sit on.

  • No Implicit Trust

    being on the network earns nothing, so a vendor account cannot reach anything outside policy by finding it on the subnet.

  • Nothing Published

    the vendor dials out. Nothing is published to the internet on your side, and no inbound port or public IP is opened to reach them.

  • Removed on the Day

    access can be removed the day the contract ends, without touching a firewall rule.

  • SaaS or On-Prem

    hosted by Computer Port, or on infrastructure you nominate.

What changes as a result

  • Vendors reach only what policy allows
  • No VPN client for a contractor to install and remove later
  • Access revoked the day the engagement ends
  • Nothing published to the internet

Scope vendor access for your next contractor

Bring us your directory, your remote access and your sites. We will map what the overlay changes before anyone signs anything.