What is COSGrid MicroZ Client?
The COSGrid MicroZ Client is the on-device agent that makes Zero Trust real at the endpoint. It carries the device's identity, evaluates its security posture continuously, and enforces policy locally — before any traffic reaches a protected application. Policy is set centrally in COSGrid Guider; enforcement happens on the device.
BUILT IN
ENFORCES
Device identity, continuous posture checks (disk encryption, firewall, antivirus status), and policy — locally, before traffic reaches any application.
CONNECTS VIA
An encrypted mesh overlay. The control plane authorizes each connection; traffic then flows peer-to-peer, directly between device and workload — the cloud coordinates but is never in the data path.
How MicroZ Client Works
IT installs the client — silent/MSI on Windows, package on macOS — and the device registers with the control plane, receiving its unique certificate.
Sign in through the corporate IdP with SSO + MFA; the device presents its hardware-bound certificate.
The control plane sends the device its access policy, web-/DNS-filtering rules, and posture baseline.
The agent evaluates 14+ device signals on-device every ~20 seconds, keeping the verdict current — not just at login.
For an authorized app, a direct encrypted peer-to-peer path is established over the mesh overlay; web and DNS filtering apply locally. If posture fails at any point, access is withdrawn and the device can be quarantined.
How MicroZ Client Authenticates, Enforces, and Routes
Identity
Each device holds a unique, hardware-bound certificate. The key is delivered to the agent over a named pipe — never written to disk as plaintext — and local state is encrypted at rest. A device check-in is bound to a hardware fingerprint, so a copied certificate is useless on other hardware.
Authentication
The user authenticates through the org’s identity provider with SSO and MFA; the device authenticates with its certificate. The control plane distributes the policy profile and posture baseline, and decides whether the connection is allowed.
Enforcement
Access rules, web filtering, and DNS filtering all run in the agent. Posture is re-evaluated continuously — roughly every 20 seconds — not just at login. Because enforcement is local, a brief loss of connectivity does not open the door: established sessions keep working.
Routing
The data plane is an encrypted mesh overlay built on Nebula, using certificate-based identity and the Noise protocol framework for encryption. Once authorized, a lighthouse coordinates discovery and traffic flows directly, device to workload — the cloud coordinates, it never carries traffic.
What MicroZ Client Checks Before Granting Access
Technical specifications
Related components and products
COSGrid Guider
The orchestrator; it provisions ReFleX-Edge with zero touch and pushes its signed policy over the control channel.
COSGrid ZGrid
The SASE PoP fabric where ReFleX-Edge terminates its encrypted overlay to reach the Internet, SaaS, and other sites.
COSGrid ReFleX-Edge
ReFleX-Edge is its branch gateway; ReFleX-WAN is Guider + the ReFleX-Edge gateways + the ZGrid PoPs as one solution.
COSGrid MicroZAccess
The Mesh ZTNA service the client is the endpoint for; the client is how a user’s device joins the MicroZAccess overlay.
COSGrid ZT-NAC
Shares the client’s posture engine; the same device-hygiene checks gate both ZTNA access and NAC admission.
