Name: Modern Access for a Modern Workforce: Secure, Seamless, and Clientless
Uploaded: 2025-12-11T06:16:06.517Z
Duration: 54 min 12 s
Description: Modern Access for a Modern Workforce: Secure, Seamless, and Clientless

Transcript for "Modern Access for a Modern Workforce: Secure, Seamless, and Clientless": Hi, everyone. Welcome. Thanks for joining us for, this new webinar, on Clafly r zero just. As usual, we're gonna give a bit more time for people to join, so, please stay around. We're gonna start in, like, two to three minutes. Yeah. We're gonna wait, one or two more minutes before we start. Thanks, for joining us. I think there are still people coming in. It's lunchtime for some of you. Hopefully, you can listen to Zero Trust while having some food. Okay. I think we're gonna start now. Hopefully, people will continue joining us, but let's not wait too long. Thanks again for joining, Lila and myself, Jeremy, today for this new webinar. The topic today is about zero trust. Of course, as soon as you see myself and Lila, you will know it's about zero trust. And, specifically, today, we're talking a bit more about clientless, which is a different way of accessing or or developing a zero trust transformation journey. And you will see that there are some some benefits of doing it this way. Just a quick, introduction. I've been in CloudFlare for almost three four years now, looking after the zero trust portfolio as a senior product specialist. So I've been, working with our clients, working with our our sales team, and the whole zero trust, I would say, community to bring more of this technology in a in a market and helping our client to achieve, better zero trust strategy, better implementation, and, of course, always with one of our technical or solution specialist engineer. Sometimes it's Edwin. Today, it's Lila with us. And, Lila, you wanna say a few words to introduce yourself as well? Hey, Yuan. Hey, everyone. Thanks for taking time to join us, during this lunch session. Yes. I'll be supporting Jeremy with the demo session, taking you through the technical aspects of, the clientless access. Yeah. But predominantly, my role has been, supporting customers in adopting zero trust solutions or SASE. So I've been in the cybersecurity space, last seven years. Thank you. I'll leave the floor to Jeremy. Thanks, Lila. Okay. Let's get started then. Quinda. So today, we're gonna talk about a few things. We're gonna talk about, some of the trends that we we have seen in in the past few years because Zero Trust has been around for a while and some of the lessons we learned from previous implementation conversation with clients. And then we're gonna focus a bit more on why Clientless and why Cloudflare for Clientless, specifically, what are the benefits of that. And we're gonna leave some time to go into the actual, setup and show you what outcome you can achieve, how easy, it is, and just simple user experience, across different scenario. So Leila will show you that during the demo. If you have questions, if you wanna ask anything, please feel free to use the chat box or the q and a box. If you have specific question, it's better to use the q and a, and we're gonna answer that straight away or maybe towards the end of the presentation. But please go ahead. It's always, good for us when we are, presenters to receive questions, makes us feel, like, more engaged, and we like to answer this kind of thing. So please go ahead. So let's with, the trends and the past lesson of, Xero. So the thing I wanna highlight, and I'm sure most of you should be aware of that, is that the largest trend in the industry right now is to replace VPN. And that's something that everyone acknowledge, almost everyone acknowledge for three main reasons. The first one is we had vulnerabilities exposed all the time. VPN is a very, old software, and it has been coded by humans. So by default, it has vulnerabilities. And the longer we wait, the longer we discover vulnerabilities, and it's not very easy to to patch, actually. It takes some time. You need sometimes to, do a lot of hardware, reboots, interrupt the business, all these kind of things. So this is definitely one angle of the VPN replacement rationale that is on top of mind for everyone. The other part is what we mean by, being too complex, is that with time, when you have a VPN setup, it starts to grow to accommodate additional users, additional use cases, and because of different procurement cycles, different reasons, you might have one, two, three, four different VPN solution. And it's very complicated for the end user at the end to work with all these different solutions and for you to manage as well. The last portion is about performance. When you talk about VPN, it's a more traditional solution when you have appliances on premise and the traffic has to always go back to on prem even though sometimes you are trying to access a SaaS application or a software or website. But because your VPN is on, it has to go all the way back to the corporate network and then exit via maybe the Internet connectivity there or the proxy. So overall, the user experience is way too slow. So people acknowledge all of this and starting to move. But I wanna understand from the people today in, that session, how far are you in that journey? Is it something that, yes, you you look at, you identified some of the use cases where potentially it could be replaced, but you won't totally change the VPN. Maybe you already isolated some of this use case and you're gonna start with the end game of replacing the VPN, or maybe you're gonna say, no, I'm not gonna replace the VPN, or it's already done. So we'd be interested to hear from you via the poll. So, I hope you can see the poll right now in your, interface and maybe start voting. So, yeah, I think you should be able to see the poll right now. So please go ahead and select, what makes sense for your, organizations today. So I'm gonna give a few more seconds for people to vote. Okay. I start to see some votes coming in. Okay. So more or less, it looks like, people are saying that they have identified some use cases and the endgame is really to replace VPN. And if we if we look at kind of the, survey that we did, actually, we started looking at this across the whole region, and we, we actually asked more than 200 people what they were thinking about these same questions. And you can see over here that more than, 50% have exactly the same view on replacing VPN, but more than that, 76% already decided that they're going to reduce their hardware and move to a more ZTNA approach. Only 25% very specifically said that they're going to stick to VPN. So this is a key initiative in most of the organizations. You can see that only 9% already replaced the VPN, so there's still a bit of work to do, here and there. So what does that mean, moving away from VPN and moving to, ZTNA? So moving to ZTNA means that you have to transform the architecture. You have to change the way, things are operating to, as I said, reduce the risk, enable more performance. This change is sometimes not as straightforward, a bit of planning. Some of the plannings that you can think about, are what types of application are being used, right, because VPN is usually based on a network or a subnet. But when you talk about application, this is way more granular. If you want to put a specific security controls on application, you have to know first what type of application you have to build that on top of. Where are they located? Who has access? So all these question will come, when you start looking at this replacement initiative. And it's something like this. Right? Some of these answers should be over there. So who will be, accessing this application? And you have different groups. Usually, you might have the sales team, the IT team, the research and development team, and they might have very different needs from the marketing or the legal and compliance, different types of, application. So on the other side, that's where you will start grouping the different applications together in terms of what are the application for development and collaboration that usually almost everyone will need access to. But financial management financial management is something that maybe only finance will need. And then we we see that, in most of the organization, you you doing, software development. You also have what we call the DevOps or the CICD workflow, and this is a very specific type of application, with very specific processes and workflows. So identifying this is really key at the beginning of a Zero Trust transformation project to identify what we're gonna do first in what we call the initial rollout, where we're gonna expand, and where we're gonna usually, we use this word advancement, or total expansion, you know, if you want for the last phase to really address the last few use cases. And I would like to ask, another question here. I would like to understand also, replacing a VPN is considered a digital transformation project. Do you have any idea on how much percentage of this project actually failing to deliver on their goals? And we're gonna share the poll with you right now about this. So you should be able to see that in your interface right now. So what percentage of the digital transformation project, including VPN, of course, are failing to meet the stated goal, what they are supposed to achieve? If you don't see the poll, it should come up right away. Yeah. Nothing. It should be there. So please go ahead and cast your votes. It's a simple question, but the result might be, surprising to some of you. It was to me, at least. Okay. We see some votes coming in. Okay. You guys are much better than me because most of you already know the answer, and the answer is 70%. So 70% of the digital transformation project, like VPN replacement, actually not meeting, their goals. And why? How how do we, this? It's because, as I said, you need to transform a lot of things, and you have different phases. Right? So what happened when you look at these phases? The first phase is usually what we said, the initial rollout. You can see here, based again on our survey, that the initial time to just do that phase one, which is usually a set of user group between, like, two to three, so it could be sales, maybe IT or c suite, you know, people that are always, I would say, always looking for new solution to accelerate the business, and maybe just two or three different types of application. Maybe collaboration or maybe the ERP solution at the end, because this is what runs the business as well. So you can imagine eleven months just to go through that phase one. And then we have phase two, which can take, again, an additional, fifteen months, and then phase three where we expand more application and more user type, all the way to sixteen months. So what do you think happen when you start to deploy your project and that takes already maybe eleven months for 25% of the apps and the users. Right? That's where sometimes people start to complain and, like, this is not going fast enough. We are not seeing the revenue on this. And that's where we feel that we start to go into that 70% of digital transformation that didn't really achieve their goal. So the idea here is really to focus on that phase one and bring more results much faster. And guess what? The best way to do that is to start looking at agentless zTNA. Why agentless? Because you remove a huge portion of that project, which is deploying agents. In these eleven months, there's actually a lot of work to be done to deploy the agents. Writing the policies and doing the discovery on the application, yes, that's one part. But I'm sure most of you having dealt with endpoint before knows that it's a bit unpredictable. Sometimes you deploy the agent on a set of machines, everything is fine, and then you will find one or two machines where you are struggling and you have to fine tune and maybe go on-site and all this. So this is what we wanna do. We wanna make sure that your project is a success and much faster than expected by leveraging on an agentless z t n issue solution. So a solution that will really give you quick wins, and be able to, capture as much as possible as much use case as possible as early as possible. So when we ask and when we experimented on client list, 84% of the people that started this agreed that it accelerated their zero trust adoption. 84% of the people. That's a huge number. I mean, earlier, we were comparing 70% of the people saying that the digital project are not working. Here, 84% acknowledge that if you go via clientless approach, it will definitely accelerate the adoption. And they also agree on some of the points that I mentioned earlier that it was meeting the type of user and the type of application that were in use at that time, which means most of it might be web based because we are talking clientless. So clientless is a very good solution for everything web based. It definitely simplify the deployment because you don't have this situation where you deploy the agent and maybe there's some conflict with the endpoint and you have to fine tune and troubleshoot and all that. They also agreed that it made it much easier to scale. I think these last two are very tied together since it's quite simple to deploy and you don't need really an agent on the machine, it's very easy to scale, right, because it's considered, software as a service. The only thing you need to do is add additional license. Right? You wanna move from 100 to a thousand, from a thousand to 5,000. It's a Cloud service at the back, which is completely elastic. So the only thing you need is to, come to an agreement on how many users, how many, license we will need for that. That's it. The licensing is definitely easier to calculate as well because we are not looking at the usual or traditional, like concurrent user depending on the throughput of the box and all this. No. Here, we are only looking at named user. So you are one user in your active directory or your intra ID or your Google Workspace. That means you need one license to access your application. As simple as that. Okay? So we make it much faster and much easier to deploy and to operate. So let's go back to this 70, 6%, of the people that started replacing, VPN with zTNA. When we asked them and when we continue the conversation, we discuss about the three biggest risk that they wanted to address by doing that. So if you remember, there's the vulnerability, there's all these things. But what are the actual risk that they identify in terms of, maybe users or devices or where they would focus at the beginning. You can see here that 44% of, the the the full time employees are actually hybrid or remote user, which means these people are not working in the office. So they can't leverage any perimeter defense. You have to focus on their endpoints and deliver the security services over there. 27% of the people of the user accessing your internal resources, actually even third party, not even employees, but third party. 50% of them are accessing your resource from an unmanaged device, which means not controlled by corporate, not being installed with an antivirus or an EDR, but simply a bring your own device. To put that in the frame of a whole Zero Trust transformation, At the beginning over here, there is a strong focus on clientless access as we mentioned. And guess what? Clientless access expect for contractor access. And that's exactly what the people in that survey was, talking about. They were saying that people are using bring your own device access, that they are not employees, and that they are working remotely. This is exactly what define what a contractor access is. K? Most of the time, people struggle with that because contractor access, can be challenging, and that's also something we are aiming to solve with a client less access. So let's look at this via two different perspective. One perspective will be, from the security team, and one perspective will be from the IT operation or the IT team in general. The challenges usually with third party access or contractor access are that you are using VPN and VPN are not secured as we mentioned in the introduction. A lot of vulnerabilities, We are giving network access levels. So, if someone wants to do a scan of the entire infrastructure, they can do that from, the endpoints. The IAM tools, when people deploy IAM tools, usually don't go all the way to contractors and third party. They are more focused on employees. You always have the problem of the privileged access. Someone that you give too much privilege can start to move laterally in the network and starts moving data around. So when we look at clientless access and when we apply clientless access, Zero Trust, to a contractor use case, these are the risks that we can reduce. We can give way more granular policy based on identity, because identity is the root of all zero trust security to really help enforce what we call the least privileged access. K? So making sure that people are only access to what they are supposed to access to. We integrate with the whole identity ecosystem. So you might have different identity providers. You might already have multifactor authentication. So we can integrate with that and expand. We can also help to enforce data controls, which is very interesting. You don't even have to have an agent to enforce data controls because you are using the browser to block specific upload, download, to apply specific policies, and even to block keyboard. Like, sometimes, that's very interesting use case. When people are trying to connect to a phishing website and they see this, please enter your information and then you will get a $50 voucher, The last thing you want is people start putting their email address, their names, you know, things like that. So there's tools, a set of tools of controls that we can put over there, and keyboard input is one of them, which is a a very interesting one. Again, all of this without agent. Now that was for the security portion. Now let's look a bit at the IT operation side of things. So on the IT operation, why is it so complicated to handle third party and contractors? Again, it goes back to having to deploy an agent or a VPN. Sometimes most of the times, you don't control their devices, so you first have to convince them to install something that is not managed by their IT or their security. So you have to, do a lot of compliance justification, risk assessments, all these all these things. And then when things are not working, when the agent has some problems as we explained before, you will have to troubleshoot and you will have to help them. Because at the end of the day, they will need to access your infrastructure for the business to continue. So this can take a lot of times, and I'm not even talking about the identities of these people. Are you gonna manage the life cycle of these contractors inside of your own identity provider, inside of your own infrastructure, or would it be easier to integrate with whatever they already have on their end? And that's, again, where zero trust and the clientless access can help you accelerate that onboarding from an IT operation. No software, no client to install. Use simply a web browser and any HTML5, basically, web browser, can work with that even with the more advanced, data control, policies. You avoid a blanket permission. You assign specific roles to these people with specific, access controls, and you can leverage on any existing policy you already have for your employees, of course. You are simply extending that to, another set of user which are who are, like, external to your environment. Okay? So a lot of traditional security and IT operation challenges can be fixed with a simple client less zero trust approach. So let's talk quickly about why CloudFlare, for clientless before we jump into the demo. Clientless access is very simple. Basically, you just log in to your browser, try to access this application. Because you have Cloudflare in front of it, you will be asked to authenticate, and you can choose a different identity provider depending if you're an employee, if you're a partner, a contractor. And once you're authenticated, our connector and our tunnel, feature will help to redirect the traffic to your application, which means anyone outside on the Internet cannot see that application. It's still a private application. But anyone that can pass that authentication, of course, with MFA and all of this traditional, two factor authentication will be able to access it. So that's perfect. No you no end user software to install. Just use the web browser and put the policy there and use a connector to link it back to your application. I mentioned a few of these examples earlier. This is to limit access to your contractors, control the data flow, and the type of data that are being exchanged between your environments and their computer or laptop or endpoints. Also, make sure that you can do that on a very time bounded metric. These contractors are usually not full time employees. They're going to come here, They're gonna work for a month, two months, three months. So it's very important to decommission the the access after that. And that's what the clientless access helps you to do that, even if it's one week. Right? If it's one week and you have to deploy an agent, most of the time, you won't go there. Too much effort for just one week. But if it's clientless access, simply put a policy there based on an identity, you can do that. Some examples of clients that work with Cloudflare before, Most of them started with clientless use case, indeed, in The US, Canva in Australia. Delivery Hero, you might be more familiar with their, local name, which is Foodpanda, in in Southeast Asia. So present all over the Southeast Asia to do, food delivery, and, and groceries delivery. They also use us, both client based and clientless access, and and some other financial services also that needed to use, a more straightforward approach, as part of their whole Cloud migration journey, and making sure that people can access application both on premise, in the Cloud, from inside of the office or outside of the office. So just to wrap it up before we move to the demo, this is what it looks like when you wanna accelerate zero trust deployment by using clientless access. You identify the application. You identify your, users. Most of the time, you can include the third party as well. You integrate with your identity provider to make sure that you can leverage SSO and multi factor authentication. You configure the Zero Trust rules to make sure that they only have access to what they are supposed to access, and that's it. You can start using clienteleast right away. After this, if you wanna move to, let's say, a more database controls, data loss prevention, and further protects your, environment, you can start to upgrade the web browser connection to an isolated web browser connection and you apply the DLP capabilities over there. These are two additional steps that you can do for more risky profile or sensitive profile, but you can see that this can work in a clientless access. Access. You don't need to move to an agent based deployment to start applying these additional controls, and that's that's really the beauty of it. So in summary, simplify your zero trust network access journey. Start with reducing risk by, leveraging clientless access and accelerate the onboarding. And why Carflare? Simply because we have a huge network covering 330 cities all over the world, and that means that as soon as the traffic is onto CloudFlare, you get the benefit of that network for much, much better performance connecting to your application, making sure that we support all the latest and greatest protocols on the Internet. We talk about IPv6, we talked about HTTP free, QUIC, all these protocols, Cloudflare is always pushing the boundaries. And even more today, when we talk about, public, PQC, you know, post quantum cryptography, that's a concern today, because when we are looking at 2030, it's still a bit far, but it's coming fast. All these traditional ciphers and encryption mechanism will have to change. Cloudflare is already ready. So the moment you start on Bondi on the dual trust approach, you will leverage on our PQC, encryption straightaway. A lot of benefits leveraging the underlying Cloudflare architecture for the zero trust deployment. With I'm going to hand over to Leila, to go through a few scenarios, and he's going to explain the scenario and show you how it looks like, with the Cloudflare solution so you get a much better idea on, all the high level, use cases that I I just explained. Lida, please go ahead. Thanks. Thank you. Thank you. So I'll take over these slides. Thank you. So bear with me while I bring up my screen. Alright. I hope everyone can see my screen. It's coming through now. Yep. All good. Yep. Thank you. So quickly talking about the use cases we're gonna discuss through. So firstly, what I'm gonna show you is an Acme Corp domain. So think of you are an, employee or a contractor of a company called Acme Corp. So part of the client's access, you wanna provide your users or the contractors access to your portal in an safe approach while allowing them to do their job on this portal. Right? Now, again, you don't want them to install agents or anything. At the same time, you wanna protect this application. Right? So this application could be hosting some internal data. So this application should be protected from any malicious inputs. For example, I could be an attacker trying to access this portal and maybe do some SQL injection attacks or maybe try to upload some malware into it and see my luck. Right? So part of the demo, what we're gonna see is we can access this portal, without any agent installed my on my laptop. And simultaneously, we'll be seeing, the CloudFlare path also getting applied. So I'll start with that. And as an contractor, what we'll do what you will do is if you if you think of Cloudflare protecting this application, so normally as a contractor, you'll go onto a portal. This is the portal. This is where all your applications are available for access. Let's say I'm logging in. I can log in with different identity providers. Okay. This is the first step, a contractor or an employee of ACME Corp would go through. So in this case, as an ACME Corp, you have integrated with Google or you have an existing identity provider, which is SAML as well. So let's say I'm logging in with the SAML. I'm an employee. I'm trying to access my application through, this portal. So this is the username, eve at acmecov dot work. And let me log in to this panel. Once I log in through my identity provider, I have access to all these applications. So in this case, I'll be quickly accessing a portal. This is the portal I have. All that I need to do is I need to come up to this application page and select the right application for me to access. Now this application is accessible, so give it a moment while it comes through. It shouldn't take this long, usually. The demo gods are not with me today, it seems. So let me let me give it a try. So usually, this should bring up a portal for us and, which will where I can show you the WAF also kicking in. Right? So while it while it takes its time, I think it's still failing for whatever reason. You have tried directly accessing. If it still fails, we'll go on to another application. So I'll show you another application, which is Outlook. So let's say the same user, they want to access the Outlook. So now if you notice, it is it is being proxied through CloudFlare access solution. If you notice, it is not directly I'm not directly accessing login. Microsoft online, or I'm not accessing the Outlook mail directly on the, on the on the browser. So I'm trying to access this through the Cloudflare remote browser isolation or through the API, we call it. It's logging me out. Let's try again. Yeah. So now because I have logged into this session earlier, so it is prompting me for the username of, Eve. But once I click on that, let me get the credentials of Eve and and sign in. So that's how I can access my Outlook email. So now you could ask me, what is this different? So how is this different from a regular user accessing their Outlook? Now if I try to access the same Outlook from my browser see this. I'm trying to access this and let's see what happens. Let me try to use the Eve's username and see how it behaves. And then I try to log in with the credentials, and you can see I'm being denied. So what is actually happening? So when I'm accessing through Cloudflare, I can access my email. Whereas when I'm accessing directly from a regular browser, I'm not being alone. So this is again a security measure we have in place. I'll quickly show you the policy, what I have configured. So M365. So every time a user accesses these applications like Microsoft Outlook or etcetera, we are only allowing them to access through CloudFlare. So I have something I have something called dedicated egress or the solution is a dedicated way of this is the one. Yeah. So if a user comes if an employee comes and access through Cloudflare to the SaaS application, in this case, it could be Outlook or it could be a SaaS application like Salesforce, we are allowing them. But whereas if they're coming from a different IP, it could be an employee or it could be an attacker. If they're trying trying to access this solution or access the SaaS application directly, they would be denied. So that's what is happening now. So when I'm accessing the Outlook directly, I've been restricted for this tenant. If I'm accessing through Cloudflare, I'm being alone. Now I'll show you little, more nuance on this policy. I'll go back to the firewall policy I have configured for this application. So if you notice this policy, I have said printing is not allowed. I have said file downloads are allowed, but within the remote browser, but file uploads are not allowed. Right? So keyboard actions are allowed. So copy copy paste are allowed. So basically, what I'm doing is, though I'm letting my employee access their resources like SaaS applications, we are still we are allowing we are allowing them to access these emails or allowing them to access their SaaS applications, but we are blocking them from accessing any, uploads or making uploads to this from your laptops. Let me show you how. So in this example, if I try to upload, I'm basically disabled. Right? So this is how it works. So you can you can protect your applications, you can protect your data from being exfiltrated to, to these Cloud applications or unnecessarily allowing the employees downloading the data can also be disabled. In this case, I'm allowing downloads, but I'm protecting the users from any uploads to the or sending emails with the files externally. Right? So that's so that's about the use case, so where we can secure employees from uploading, upload uploading data to applications unexpectedly and unknowingly. Right? So these are the two use cases. But apart from that, there's another use case we're gonna look at. Right? So this is where we're gonna talk about accessing the infrastructure. So in typical environments, you might wanna provide your contractors. Let's say you have a contractor coming through, and and they wanna access your, Linux server for maintenance or they wanna access a Windows server for maintenance. Right? So you wanna provide them secure access, but at the same time, you wanna ensure they're accessing only through authorization methodologies in a safe and secure manner. You don't want to provide them private keys or public keys, or you don't want to generate private keys and public keys. In those scenarios, you can create an identity for them on Cloudflare and they can simply access these SSH and RDP directly to the browser. I'll show you how it's done. If I go to this particular tool, again, a front end facing, this is, again, another portal where I have different applications for a user called David. So now David is a contractor in my case, and for David, I have given access to all these applications. And in this case, if they wanna access, Linux server to SSH, I have predefined it. Right? And if you notice, David didn't need to do anything. So David need doesn't need to input a private key. It doesn't need to input a password or anything. This is all happening behind the scenes because we have provisioned the user within an identity provider, and that identity provider is already synced in with the CloudCheck. Right? We are passing the credentials seamlessly to the Linux machine and without prompting the user for any credentials or authentication further. Okay? The same thing. Similarly, we can do it for Windows. So here, Windows, I have a user. Let's say with the Windows desktops, it typically requires a username and password for RDP. Again, the same approach. So once they enter the credentials, what what we have provided them, they can happily access the RDP as well. Again, so with this, your contractors can be seamlessly provided access to their applications like Windows servers or Linux servers without much effort from your IT teams. At the same time, controlling their access is also very simple. All that you need to do is create applications within the Cloudflare dashboard. For example, for this SSH, which is a browser based SSH, and define policies on who can access this. Right? So here I have defined only these users can access. So tomorrow, if you notice, I have one of the, simplest ways of accessing this. I can define an email as well. Let's say you have a contractor tomorrow coming and who doesn't have a corporate email address, or maybe they are not integrated with your IDP. So in that case, you can just define an email as well so that they can come and access by just dropping their email address. They'll be authenticating with their email address, and they can access these applications, whatever you have defined previously. Yeah. So that's pretty much it, team. So that's a quick demo I wanna take you through. Any questions so far? So, Lila, I think that's, a very good showcase of what we discussed early in the presentation about some of the use cases, releasing it live, and how easy it can be, done to, like, implement and push out to the end user, giving a fast remote access, and at the same time being able to control some of the data flow, which I think is is very good, both on private application as well as SaaS application. You saw that, email being controlled as well, which is a very interesting use case. So, yeah, we we are in advance compared to, the usual. Usually, we finish, like, on time or we need a bit more, but I think today we got we got a bit more time. So, if you guys have questions or additional, comments on the solution, please go ahead. I think there's one that just came in. We can look at that. What about file transfer protocol related to SSH access? So for if you are referring to FTP and SFTP and and things like that, I think this one still need to use, clients, as long as we want to, consider that traffic. I don't think there's a a specific clientless access for that. And, Eli, can confirm, maybe? Yeah. So there are some plans to, like, support again, it's gonna be client based. It's not in browser based. It's not a common protocol that's requested for a browser based, access. But there is something called, infrastructure access with a client based approach. We have more capabilities coming through that. For example, the same browser based SSH SSH what we have done, we won't be able to capture the SSH log. But whereas when you do it through a client, where you have an agent installed on the laptop, you can actually capture the logs of the SSH commands the users are inputting. So basically, you're getting more visibility when you are using an agent on the laptop. So similarly, when you're using an f SFTP protocol, the same things we can do. So that's a work in progress. Thanks, Lida. So, yeah, this, infrastructure access is very interesting. There there are a lot more things coming up. SSH was definitely the first one, but there's a lot of, protocol that needs to be supported. And we're also looking at databases. We're looking at Kubernetes. We're looking a lot of things. So, interesting place to to follow. Any other questions? Otherwise, we might be able to end early. Next time, we we should put some Christmas, background, you know, because I we know that everyone is almost, going into the vacation period and the holiday season. Okay. I think we are almost there. So in that case, we're gonna just ask you one last thing. I'm gonna share the screen again. And we just have one request. If you could help to, scan your code and ask to write some feedback on the session. For example, if you want the Christmas for next year, please go ahead and tell us. But, yeah, very interested to to hear. You should be able to see it now. Yep. So please go ahead and scan that survey. Tell us what you think about the session. If you want more demo, less demo, if you want something else, we are we are quite happy to customize a bit. The idea of this webinar is really, to give the information as men to as many people as possible. So sometimes when we do one on one, we can go into more details, but, yeah, we have to schedule, the time and all this. When we do this webinar, it's really a good way, to, communicate to as many people as possible. But we also want it to be, addressing your needs. So please go ahead and let us know. K. We're gonna leave, the QR code for a while. And in two minutes, we're gonna wrap this up. There's also some documents. If you go onto the the doc, so in your interface, you should see the chat and the docs and the q and a. If you go into the docs, there are four different documents that you can download, explaining a bit more in details what is the zTNA product and the client less access, explaining how we can work together with potentially other solution. We have clients use cases where they already have, a partial zero trust implementation, and this partial zero trust implementation is maybe for Internet security. But for the zero trust access, for, the remote access, maybe, this is not a good setup. So if you wanna use clientele, that's possible. You can use Cloudflare, alongside an existing, provider. So there's a solution brief that talks about this very specifically. Otherwise, you have, some of this, transformation journey that we share with you today also, the path to VPN replacement that is explained. So feel free to download these resources. And, yeah, get in touch with us if you wanna talk a bit more about this specifically for your organization. With that, I think we are coming to the end of this webinar. Thank you, everyone, for joining again. Wishing you a very good, holiday season, merry Christmas, and, and happy New Year and all this, and we hope to see you again with us next year. Thanks a lot, everyone. Take care. Thanks, you. Lida. Bye bye. Bye.