Edge & Network

Zero Trust & SASE

Identity-, device- and context-aware access to every application · secure web gateway, CASB, DNS security and segmentation

Access decisions · 24 h

1.42 M

99.2% allowed

Step-ups

6,214

91% passed

Denied

3,880

device trust below threshold

Average trust score

0.87

user × device × context

Access policies

Policy	Name	Application	Groups	Device trust	Location	Sign-in	Otherwise	Status
ZT-101	Analysts · AFC OS	AFC OS	BFIU analysts	≥ 80	Bangladesh only	Passkey	Step-up	Active
ZT-102	National Intelligence search	AFC OS · National Intelligence	BFIU analysts	≥ 90	Bangladesh only	Passkey + re-auth hourly	Deny	Active
ZT-103	HSM administration	HSM admin console	Key custodians	≥ 95	Bangladesh only	Hardware key only	Deny	Active
ZT-104	RO compliance officers	Client Portal	RO compliance officers	≥ 60	Bangladesh + approved travel	Passkey	Step-up	Active
ZT-105	Whistleblower case room	Whistleblower case room	Committee members	≥ 90	Bangladesh only	Hardware key only	Deny	Active
ZT-106	Developers · source code	Source code	Developers	≥ 85	Anywhere	Passkey	Read-only	Active

Decision

trust   = T_user × T_device × T_context            # each 0–1
T_user  = 1 − identity risk (ITDR, leaked-credential, behaviour)
T_device= device trust score / 100                # posture checks
T_ctx   = location × network × time-of-day factors

allow    if trust ≥ θ_app
step-up  if trust ≥ θ_app − 0.15                   # passkey re-prove
otherwise deny (or read-only where the policy says so)
re-evaluated every 5 min and on any risk change (continuous access)

Why access was denied · 24 h

Device trust below threshold

46%

Outside allowed location

21%

Identity risk high

17%

Session older than re-auth window

11%

Other