Fewer Unknown Devices
Devices that are not registered are denied by default.
Network access controlDevice admission
Let Only Known, Compliant Devices Onto the Office Network
Customer problem
Every Device Should Be Checked First
On many office networks, a device gets access the moment it connects. Nobody asks whether it belongs to the organisation, who is using it, or whether it is patched.
An unknown laptop, or a machine with antivirus switched off, can sit on the same network as finance systems and file servers.
Each one is a foothold, and from there the risk is lateral movement.
- Personal or contractor laptops on spare ports
- Corporate devices with antivirus or encryption off
- Machines that missed months of patches
- Third-party devices nobody has approved
- No record of which device joined and when
- Switch and VLAN projects that stall across branches
THE COSGRID SOLUTION
Check Every Device Before It Joins
ZT-NAC takes a host-based approach. A device is denied network access by default, its identity and posture are checked against policy, and it is then allowed, denied or quarantined. Enforcement runs on the device through its host firewall, with no switch or VLAN project.
With ZT-NAC, organisations can
- Deny devices network access by default
- Check patch level, antivirus and disk encryption
- Pre-register vendor and contractor devices
- Quarantine devices that fail policy
- Use one agent-based approach at every site
How It Works
Identify the Device
When a device connects, the ZT-NAC agent identifies it. Pre-registered devices, including third-party ones, are the only ones considered for admission.
Evaluate Posture
The agent checks configured requirements such as patch level, antivirus status and disk encryption.
Apply Admission Policy
Identity and posture results are compared with policy, which decides what a device in each state may do.
Allow, Deny or Quarantine
Registered, compliant devices are allowed, unregistered devices are denied, and non-compliant ones are quarantined through the host firewall.
Key Benefits
Weak Devices Caught Early
Missing patches, disabled antivirus or missing encryption are caught at admission.
Controlled Third-Party Access
Vendors and contractors connect only on pre-registered devices.
No Switch or VLAN Project
Host-firewall enforcement avoids network redesign and dependence on compatible switches.
Faster Branch Rollout
The same agent-based approach applies at head office and every branch.
Clear Admission Record
Each admission, denial and quarantine is tied to a device and a policy.
Traditional NAC vs Zero Trust Network Admission
Traditional NAC
- Enforced in switches and VLANs
- Needs compatible hardware at every site
- Devices get access first, then are checked
- Hard to scale to many branches
- Posture data and network policy in separate tools
- Can cover agentless devices through switch ports
Zero Trust Network Admission
- Enforced on each device through its host firewall
- No switch or VLAN changes
- Devices denied by default until checked
- Same agent-based approach at every site
- Identity and posture feed the admission decision directly
- Covers devices running the agent; agentless devices need separate controls
Use cases
Built for every access scenario
Admit only registered, healthy devices
Only registered, healthy corporate devices join the head office network. Devices that fail posture are quarantined rather than given full access.
Same admission control at every branch
Branches and regional offices get the same admission control without a local network redesign, which suits many similar sites with limited on-site IT.
Catch devices that drift out of compliance
Corporate laptops that drift out of compliance, for example with antivirus disabled or patches missed, are caught when they connect.
Admit vendor and contractor devices on your terms
Vendor and contractor laptops are admitted when pre-registered and running the agent. Guests, printers and IoT devices need separate controls, such as firewall segmentation.
Who Is This For
Need the same policy at home? See "Apply the same device and access policy in the office and at home"
- Network Teams
- CISOs
- IT Operations Teams
- Branch & Regional IT
- Third-Party-Heavy Organisations
FAQs
Have a question about network access control and ZT-NAC?
What is network access control?
Network access control decides which devices may join a network and what they can do once connected. It usually checks a device's identity and health before granting access.
How is ZT-NAC different from traditional NAC? Traditional NAC enforces in the network, using switches and VLANs. ZT-NAC enforces on the device through its host firewall, so it does not need switch reconfiguration or VLAN redesign.
What posture checks does ZT-NAC perform? Documented checks include patch level, antivirus status and disk encryption. The exact list depends on configuration and operating system.
