In short: TrendAI Vision One Zero Trust Secure Access (ZTSA) is Trend Micro's security service edge. Private Access provides ZTNA to internal applications, Internet Access provides a secure web gateway with CASB controls, and AI Secure Access governs staff use of generative AI. Each is licensed per user, alone or combined.
What ZTSA is
Zero Trust Secure Access (ZTSA) is the access-control part of TrendAI Vision One, within Trend Micro's network security range. It provides the main security service edge (SSE) functions: zero trust network access (ZTNA), a secure web gateway (SWG) and cloud access security broker (CASB) controls, plus an option for generative AI services.
What sets it apart is that access decisions can use risk data from the rest of Vision One. Risk control rules score users and devices on their behaviour and can block private or internet access for an individual user when conditions you set are met, so a compromised laptop flagged by CREM or XDR loses access without anyone having to intervene.
Access options
| Option | What it does |
|---|---|
| Private Access | ZTNA to internal and private cloud applications through connectors, so users reach only the applications you publish rather than the network behind them |
| Internet Access | Secure web gateway with web reputation, URL filtering and CASB controls for SaaS applications, enforced through Trend Micro's internet access gateway |
| AI Secure Access | Rules for staff use of generative AI services, with visibility of prompts and uploads to stop sensitive data leaking and detect malicious prompts |
| Internet Access + AI Secure Access | Web protection and AI governance together for the same users |
| Send to Sandbox add-on | Internet Access sends suspicious downloads to Trend Micro's cloud sandbox; see Threat Intelligence |
| Outbound Static IP add-on | Fixed outbound addresses so SaaS providers can allow-list your web and AI traffic |
Trend Micro also refers to AI Secure Access as AI Service Access. Private Access and Internet Access can be used together for the same users.
How it is licensed
ZTSA options are licensed per user under TrendAI Flex, and when Internet Access and AI Secure Access are both used they are bundled as one offering. The sandbox add-on is per user and the static IP add-on is sized by bandwidth.
Through Forever Systems, Trend Micro is billed monthly in arrears for what you actually used in the month, measured the way Trend Micro measures it, rather than as a credit pool you pay for up front. Ask us for a quote based on the number of users and the applications they need.
Requirements and deployment
Private Access uses connectors deployed close to your applications, in your data centre or cloud environment, and every private application is registered against a connector. Users then reach applications in one of two ways: client access through a secure access module installed on their device, or browser access through a user portal generated by Vision One, with nothing installed, which suits contractors and unmanaged devices.
Access rules can take account of the user, the device, the time of day and location, and identity comes from your directory, such as Microsoft Entra ID. Policies for private, internet and AI access are all built in the Vision One console.
Who it suits and how we help
ZTSA suits organisations replacing an ageing VPN, giving contractors access to one or two applications without network-wide access, or wanting control over which AI tools staff use and what data goes into them. It fits best where Vision One already protects the endpoints, because the risk signals are already there.
Forever Systems maps which users need which applications, deploys connectors and the access module, builds web and AI policies and moves users across from VPN in stages. Compare other options under SASE, ZTNA and business VPN.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can ZTSA replace our VPN?
For most application access, yes. Private Access gives users access to specific applications rather than the whole network, and risk control rules can cut access for a user whose risk rises.
What is ZTSA AI Secure Access?
It controls staff use of generative AI services, with visibility of prompts and uploads so sensitive data is not sent to AI tools and malicious prompts are detected. Trend Micro also calls it AI Service Access.
Do users need an agent?
Not always. Client access uses a secure access module on the device, but browser access through the Vision One user portal needs nothing installed, which suits unmanaged or personal devices.
How is ZTSA licensed?
Per user. You can license Private Access, Internet Access or AI Secure Access on their own or together, with sandbox and static IP add-ons.