Antara Secure Access: one client, two protected paths.

Start with the application, then choose the path

Antara Secure Access is the one managed client for VPN, ZTNA, RBI, PQC, and the platform’s endpoint-facing protections. Antara Admin controls its capabilities and the connected enforcement services. The access decision combines the user, device, destination, and current policy. A private application needs an authorized network path. A web destination selected for isolation needs its code to execute in a remote browser. Both begin with the same identity context, but they protect different boundaries.

PQC protects negotiated session secrets against the cryptanalytic risks that motivate the post-quantum transition. Remote browser isolation moves untrusted web execution away from the endpoint. ZTNA restricts the resources a session may reach. Deploying these together means choosing the appropriate protection for each resource rather than assuming that an encrypted tunnel makes every website safe.

Bring existing identity and device management

Begin with the identity provider and device-management systems already responsible for the workforce. Enrollment associates the client with its tenant and device identity. User authentication supplies a separate user context. Managed configuration distributes the intended gateway, certificate, and application policies. Keeping device and user identity separate makes shared machines, contractors, and device replacement easier to reason about.

The enterprise PKI establishes the trust roots and issuance process. A certificate contains a public key and identity binding; its private key remains under the endpoint’s credential protection. Inventory actual key-storage and algorithm support on each operating system before selecting an ML-DSA profile. An existing hardware key store that protects classical keys does not automatically support every post-quantum key type.

Pilot one device group and one private application first. Validate enrollment, certificate renewal, sign-in recovery, offboarding, and the response to a revoked credential. Roll out destination policy only after the organization can reliably establish and retire an endpoint identity.

PQC and mTLS: protect the route and authenticate its ends

The client validates the gateway’s certificate identity and chain. The gateway validates the client certificate, proof of private-key possession, and the mapping into enterprise identity. Hybrid ML-KEM key agreement then contributes to the session secret according to the negotiated protocol. Signature algorithms, certificate-chain algorithms, and key-exchange groups are separate policy choices. A successful connection must expose what was actually negotiated. NIST FIPS 203 ↗NIST FIPS 204 ↗ML-DSA in X.509: RFC 9881 ↗Hybrid TLS: RFC 10024 ↗

In a controlled native-client deployment, administrators can coordinate endpoint and gateway versions. Browser-originated connections require a separate compatibility assessment. A PQC-protected access tunnel also does not make every downstream application connection post-quantum: identify each termination point, including the gateway-to-connector and connector-to-application segments, and configure those boundaries deliberately.

Certificate exchange remains part of operations after the first handshake. Renewal, issuer rotation, revocation, and authentication age have to interact with reconnect behavior. The certificate-exchange research in the Journal explains a proposed full ML-DSA bootstrap followed by policy-bound resumption. Resumption inherits authentication context; it is not a fresh ML-DSA signature on every reconnect.

RBI: move execution, preserve the workflow

For destinations governed by isolation policy, the website runs inside a remote browser session. Antara uses Network Vector Rendering with Skia to deliver the application’s visual representation. User input returns to that session. The native client supplies the managed entry and access context; it does not need to execute the untrusted website locally to establish a protected browsing workflow. NVR industry background ↗CanvasKit and WebAssembly ↗

The isolation service must treat rendering messages and input as a security boundary. File transfer, clipboard movement, printing, and downloads require their own controls. A clear page image is not evidence that the entire application workflow works correctly: include international text input, keyboard navigation, accessibility, authentication redirects, and large documents in the acceptance plan. RBI compatibility considerations ↗

Place isolation capacity with both users and application origins in mind. Local presentation can make interaction responsive, but server-dependent work still follows a network path. Measure input-to-presentation and task completion, including tail latency under congestion. The objective is a natural browsing experience backed by observable execution and data boundaries.

One access context across both paths

Device posture, user entitlement, and application policy can change during a session. Bluetooth proximity adds the presence of a registered companion as another condition where the organization requires it. A nearby phone does not override an unhealthy device or a revoked user. Define how presence loss restricts the application, how the user recovers, and how radio uncertainty is handled without constant interruptions.

The agentic packet auditor connects network and policy events to the investigation. Useful evidence includes the identity, endpoint, destination, selected route, negotiated cryptography, isolation decision, and policy version. Encryption limits payload visibility: correlate authorized endpoint and gateway telemetry rather than claiming an auditor can read arbitrary encrypted traffic.

A deployment plan your network team can evaluate

Inventory identity providers, UEM policies, certificate authorities, private DNS, routing overlaps, proxies, and application dependencies. Map each application to a private, isolated, or explicitly permitted direct path. Identify the team that owns every decision. Keep existing endpoint security and corporate authentication active through the pilot so integration issues appear before broad adoption.

Use a staged rollout: observe intended routes first, enable a small private application group, add a defined isolation policy, then introduce continuous posture and presence conditions. Verify that the user can explain a denied request and support can trace it. Test Wi-Fi-to-cellular transitions, sleep and wake, expired certificates, unavailable connectors, and isolation-session recovery.

A successful pilot leaves the buyer with a route map, a trust map, and an evidence trail. Those three artifacts explain how Antara fits the existing network, where protection begins and ends, and how the organization will operate it after deployment.