Operational consequence
One compromised account or endpoint can discover and reach more infrastructure than the user needs, while troubleshooting and revocation span several consoles.
REPLACE LEGACY VPN
Give users the application they need, not a place on the network.
Move from broad, location-based reachability to resource-scoped access that keeps user identity, device evidence, policy, path, and enforcement outcome connected.
System role: Customer solution owner + Oten solution architecture
Evaluation depends on: Requires a bounded component, platform, protocol, integration, migration, rollback, and evidence scope.
IDENTITYOten or enterprise IdPUser assurance
PDPAccess Control PlaneDecision + desired state
SOURCE PEPOten EndpointDevice evidence
DESTINATION PEPOten GatewayResource policy
RESOURCEPrivate applications & servicesScoped access
Start with the operating failure, not a feature list.
Who this is for
Network, security, and IT teams reducing subnet-level remote access without interrupting critical application and infrastructure workflows.
The problem today
A legacy VPN authenticates once, assigns network reachability, and leaves segmentation, device risk, and active-session response to separate systems.
Desired outcome
Users discover only authorized resources, connect by direct or encrypted relay path after policy, and receive resource-specific denial and remediation.
Decision boundary
Define the subject, device, resource, protocol, policy version, enforcement points, confirmation requirement, and recovery owner.
The Oten journey stays connected from evidence to outcome.
Inventory
Map users, devices, applications, routes, protocols, DNS, dependencies, and exception paths from the existing VPN.
Enroll
Establish separate user and device identity with qualified posture evidence.
Scope
Define named resources and exact routes before retaining bounded subnet access where migration requires it.
Connect
Evaluate policy, select a direct or encrypted relay path, and enforce at the Endpoint and resource boundary.
Confirm
Correlate decision, path, policy generation, and required enforcement acknowledgement.
Components and integrations retain distinct authority.
Required Oten components
Oten Endpoint, Access Control Plane, connectivity services, Oten Gateway where resource-side policy is required, and approved identity integration.
Required integrations
Identity provider, endpoint management, DNS, network routing, protected applications, SIEM, and the existing VPN during staged migration.
Known limitation
Direct path, relay fallback, DNS, route, platform, headless-node, and active-session behavior must be verified for each network and protocol mode.
Migration preserves a tested way back.
Observe
Collect resource and route usage without changing access.
Pilot named resources
Move a low-risk user and application cohort while retaining the old path.
Constrain routes
Reduce broad subnet access only after dependency and denial evidence is complete.
Retire by cohort
Remove VPN authority after resource, failure, and rollback tests pass.
Use the evaluation to collect proof, not impressions.
- Authorized and unauthorized resource discovery.
- Direct and relayed path behavior.
- DNS and route failure explanation.
- Posture-change decision and protocol-specific result.
- Offline and last-known-good expiry.
- Rollback to the existing VPN for an unaffected cohort.
Next in Oten Access
Continue the technical evaluation.
Turn this journey into a bounded proof of concept.
Define success, limitation, failure, recovery, and rollback evidence before changing the production access boundary.