For telcos and ISPs, direct-routed ZTNA creates a path from commodity connectivity to higher-value managed security. (Image source: iStock)
Zero trust network access (ZTNA) is often delivered through vendor-operated cloud points of presence (POPs). That model can simplify deployment, but it may also add route distance, create dependency on the provider’s infrastructure and complicate decisions about where traffic, metadata and encryption controls are handled. These are design trade-offs – not universal flaws – and they should be tested against each organisation’s applications, geography and regulatory obligations.
For telecommunications companies and internet service providers (ISPs), the alternative is commercially significant. Appgate SDP uses a direct-routed model in which gateways can be deployed close to protected resources. An operator can therefore combine connectivity, local enforcement and managed security in one service, while keeping the data path under the customer’s or operator’s architectural control.
A brokered service remains appropriate for many organisations, but buyers should examine four issues:
- Routing and performance: Backhauling local traffic through a distant POP can add latency and jitter, especially for real-time services.
- Resilience: An outage or congestion at the broker can interrupt access even when the local network and application are healthy.
- Governance: Organisations need evidence of where traffic and metadata are processed, how keys are managed and which sub-processors are involved.
- Protocol fit: Web-first services may not cover every legacy, operational technology (OT), bidirectional or non-HTTP workflow.
VOIP and unified communications are highly sensitive to latency, jitter and packet loss. A cloud detour may degrade performance when the selected POP is far from the user or destination.
A gateway placed at an operator’s local edge shortens the route, but results depend on peering, gateway placement, capacity and correct configuration. Appgate supports TCP and UDP tunnelling; its guidance also describes specific routing and entitlement requirements for IP telephony. The credible promise is measurable improvement – not “near-zero” latency – which operators should prove with before-and-after tests.
Network operators already own edge locations, transport infrastructure, customer relationships and operations teams. A white-labelled managed ZTNA service turns those assets into five differentiated offers:
1. Faster third-party access
A browser-based portal can give suppliers and contractors narrowly scoped access without placing them broadly on the corporate network. Where the security controls support clientless access, this reduces endpoint roll-out and speeds onboarding, though complex protocols may still require an integration agent.
2. Coverage for IOT, OT and legacy systems
Many headless devices cannot run endpoint agents, and industrial environments use protocols beyond HTTP. Network-layer gateways and granular entitlements can restrict which resources those devices reach. This reduces exposure and lateral-movement opportunities, complementing core asset inventory, segmentation and monitoring.
3. Quicker M&A and multi-network integration
Identity- and context-based access connects users to approved applications before networks, directories and overlapping IP ranges are fully consolidated. This accelerates day-one access during acquisitions, though underlying routing, name resolution and identity integration still require proper design.
4. Stronger control of African data paths
Local gateways help organisations control and evidence where access traffic is routed. This helps navigate precise legal frameworks. South Africa’s POPIA permits cross-border transfers only under section 72 safeguards. In Nigeria, the Nigeria Data Protection Act 2023 is now the principal statute. Kenya (via Section 50 of the Data Protection Act 2019), Ghana, Uganda and other jurisdictions also apply strict transfer conditions. A locally operated service supports compliance by reducing unnecessary cross-border routing, though customers must still establish their own lawful processing mechanisms.
5. A broader security programme
Appgate’s model extends beyond VPN replacement. Single packet authorisation (SPA) conceals protected services from unauthorised connection attempts; per-user, context-aware entitlements limit access to specific resources; and network-layer support covers TCP and UDP applications across hybrid environments. These controls materially reduce attack surfaces when policies are correctly designed and monitored.
For pan-African telecommunications giants – such as MTN, Orange, Vodacom and Airtel – the shift towards direct-routed ZTNA represents a massive competitive advantage. While single-country ISPs benefit locally, multinational operators can leverage their expansive cross-border fibre backbones and regional data centres to reshape how enterprise security is delivered across the continent.
This white-labelled, direct-routed approach creates a powerful symmetry that directly benefits pan-African and multinational organisations in three distinct ways:
- Sovereignty compliance as a service: A multinational enterprise operating across multiple African borders faces a fragmented regulatory landscape. By partnering with a pan-African telco utilising white-labelled ZTNA, the enterprise signs a single master contract. The telco can dynamically spin up local gateways in its data centres across each respective nation, ensuring Kenya-bound traffic stays in Kenya, Nigerian traffic stays in Nigeria, and local residency laws are instantly satisfied under a single provider framework.
- Monetising private backbones for lower latency: Instead of forcing corporate application traffic to hair-pin through vendor-owned cloud brokers located in Europe, pan-African telcos can route secure enterprise traffic entirely over their own private, low-latency subsea and terrestrial fibre networks.
- Operational standardisation: Multinational organisations can eliminate the complexity of managing disparate security vendors in every country of operation. The white-labelled model allows the telco to offer a unified policy control plane across the entire continent, while enforcing security at the absolute local edge of each branch office.
For telcos and ISPs, direct-routed ZTNA creates a path from commodity connectivity to higher-value managed security. Operators can bundle business fibre, local transport, gateway hosting, policy operations and service assurance under one commercial relationship. Their differentiator is that they can engineer and support the access path end to end.
The proposition should be evidence-led: map each customer’s traffic path, test latency and failover, document data handling and define shared operational responsibilities. Where those results outperform a brokered alternative, a white-labelled Appgate service gives regional operators a credible way to reclaim the edge – and gives enterprises greater choice over how zero trust access is delivered.