Secure remote access VPN: the right person, on an approved device. Nobody else.
VPN access that only works from devices you've approved, with every user signing in against your Active Directory. People reach only the systems their role needs, MFA comes built in, and access disappears the moment someone leaves. We design it around your requirements with whatever technology fits.
Four checks, every connection.
Port-forwarded remote desktop and shared VPN passwords are how many ransomware incidents start. We replace them with access tied to a known device and a known person.
Approved devices only
Each company laptop, and any personal device you choose to allow, is registered by its device identity, including its MAC address where useful. Devices that aren't on the approved list are refused before anyone gets to sign in.
Active Directory sign-in
Users authenticate with their existing directory accounts. There are no separate VPN passwords to share, forget or leave behind on a sticky note.
MFA-ready
A second factor for everyone or for chosen roles, such as admins and finance, enforced at sign-in.
Role-based access
Directory groups decide what each person can reach: finance gets ERP, engineers get CAD storage, vendors get one machine for an agreed time window, and admins get the management network.
Disable the account. Access is gone.
Because remote access runs on Active Directory, people management and access management become the same job. Nobody has to remember a separate VPN list.
- Joiner: add the user to the right group and register their device, and they can connect
- Mover: change their group, and what they can reach changes with it
- Leaver: disable the account or remove the device, and access is revoked immediately
- Lost laptop: remove the device from the approved list, and it can no longer connect
- Audit: who connected, from which device, to what, and when
Vendor and machine-builder access, controlled
Machine builders often need remote access to a single controller. Instead of a permanent open door, they get a named account in a vendor group, an approved device, and access to that one machine for an agreed window, with every session logged.
OT/IT segmentation for manufacturingDevice checks are a layer, not the lock.
A MAC address on its own can be copied by a determined attacker. That's why we never rely on device checks alone. Device authorisation keeps casual and unknown devices out, while the user's directory identity and MFA decide who actually gets in. Where your environment supports it, we add stronger device identity, such as certificates issued only to company devices.
Defence in depth
Device, identity, MFA and segmentation each stop a different kind of attack.
Nothing port-forwarded
Remote desktop and file shares stay off the internet entirely.
Logged & reviewable
Connections feed your monitoring, and our MDR service when you have it.
Tool-agnostic
We build on the equipment you already own where it can do the job, and specify what fits where it can't. We don't resell hardware.
From shared passwords to device + identity.
Current access
Who connects today, how, from what, and what's exposed to the internet.
Groups & policies
Role groups, approved device list, MFA scope and allowed systems per group.
One team first
A small group moves first while the old access runs in parallel.
Close the old doors
Everyone moves over, legacy access and port forwards are removed, and runbooks are handed over.
Straight answers about VPN access.
Scoped after a short review of your current access, then set out in a tailored proposal: a fixed project or part of your managed engagement.
Book the access reviewIs MAC-based device approval secure on its own?
No, and we won't pretend otherwise. MAC addresses can be spoofed. Device approval is one layer, combined with Active Directory sign-in, MFA and role-based segmentation. Where possible we add certificate-based device identity.
Do we need a cloud directory, or does our on-premise Active Directory work?
Your existing Active Directory works. If you also use a cloud directory, we design for both so users keep a single identity.
What happens when an employee leaves?
Disable their directory account, and their VPN access ends at the same moment. Removing their device from the approved list blocks the hardware too.
Can staff use personal devices?
Only if you decide they can. Personal devices can be registered and limited to a smaller set of systems than company laptops.
Do we have to buy new firewalls?
Often not. Many existing firewalls and gateways can do this with the right design. We'll tell you honestly if yours can't, and we don't sell hardware, so there's no upsell.
Does this work for multiple sites and the cloud?
Yes. The same identity and device policy covers plants, branches and cloud workloads on AWS, Azure or Google Cloud.
What is the difference between secure remote access and a VPN?
A VPN is one way to provide remote access. Secure remote access adds the controls around it: approved devices only, directory sign-in, MFA, least-privilege access and logging. Some designs use zero-trust access instead of a full VPN.
Can a VPN authenticate users against Active Directory?
Yes. Users sign in with their directory account, group membership decides what they can reach, and disabling the account removes access immediately.
Can machine vendors use secure remote access for OT?
Yes. Vendor sessions can be approved per request, limited to one machine, recorded and switched off afterwards.
Who can reach your network right now?
If the honest answer is "not sure", start with a short access review.