Post-quantum ZTNA, compliance, and mesh VPN engineering notes. Primary-sourced, technical, and honest.https://quickztna.com/en-ushttps://quickztna.com/blog/post-quantum-free-tier-manifesto/https://quickztna.com/blog/post-quantum-free-tier-manifesto/Post-quantum cryptography protects against harvest-now-decrypt-later. That threat hits free-tier users too. Why QuickZTNA refuses to paywall quantum safety.Sun, 10 May 2026 00:00:00 GMTpost-quantumpricingmanifestopost-quantumfree-tierphilosophyQuickZTNA Foundershttps://quickztna.com/blog/post-quantum-migration-timeline/https://quickztna.com/blog/post-quantum-migration-timeline/Post-quantum cryptography has a migration timeline set by regulators, standards bodies, and vendors. Every known deadline through 2035 with primary sources.Sat, 09 May 2026 00:00:00 GMTpost-quantumpost-quantum-timelinemigrationcnsa-2-0nis2cryptographyQuickZTNA Engineeringhttps://quickztna.com/blog/ztna-metrics-for-cisos/https://quickztna.com/blog/ztna-metrics-for-cisos/Vendor decks quote ZTNA statistics you cannot verify. Your board wants metrics from your own environment. 17 that matter, with formulas and how to collect them.Sat, 09 May 2026 00:00:00 GMTtechnicalztna-metricskpiscisosecurity-operationsmeasurementQuickZTNA Engineeringhttps://quickztna.com/blog/kubernetes-zero-trust/https://quickztna.com/blog/kubernetes-zero-trust/Developers on kubectl-proxy-plus-VPN hit pain at team scale. Kubernetes Zero Trust uses identity-aware mesh access, SPIFFE identities, and per-namespace policy instead.Fri, 08 May 2026 00:00:00 GMTtechnicalkuberneteszero-trustspiffemeshtechnicalQuickZTNA Engineeringhttps://quickztna.com/blog/zero-trust-healthcare/https://quickztna.com/blog/zero-trust-healthcare/Healthcare has unusual network properties — distributed clinics, legacy medical devices, HIPAA, strict uptime. How Zero Trust architecture fits, concretely.Fri, 08 May 2026 00:00:00 GMTindustryhealthcarehipaazero-trustdistributed-networksQuickZTNA Engineeringhttps://quickztna.com/blog/wireguard-vs-openvpn-vs-ipsec/https://quickztna.com/blog/wireguard-vs-openvpn-vs-ipsec/WireGuard, OpenVPN, and IPsec are the three VPN protocols that matter in 2026. Performance, security, code size, and operational simplicity compared.Thu, 07 May 2026 00:00:00 GMTtechnicalwireguardopenvpnipsecvpncomparisonQuickZTNA Engineeringhttps://quickztna.com/blog/wireguard-mesh-network/https://quickztna.com/blog/wireguard-mesh-network/Building a WireGuard mesh by hand becomes painful at about 10 peers. What breaks, why coordination servers exist, and how to scale to 100+ peers.Thu, 07 May 2026 00:00:00 GMTtechnicalwireguard-meshwireguardmesh-vpntechnicalQuickZTNA Engineeringhttps://quickztna.com/blog/sase-vs-ztna-vs-sse/https://quickztna.com/blog/sase-vs-ztna-vs-sse/SASE, ZTNA, and SSE overlap. This explains each term using Gartner's original definitions, shows how they relate, and recommends what a 50-person team actually needs.Wed, 06 May 2026 00:00:00 GMTfundamentalssaseztnassefundamentalsQuickZTNA Engineeringhttps://quickztna.com/blog/what-is-ztna/https://quickztna.com/blog/what-is-ztna/Zero Trust Network Access replaces 'inside is trusted' with 'every request is verified'. Plain-English explanation of the history, mechanics, and how to build it.Tue, 05 May 2026 00:00:00 GMTfundamentalsztnazero-trustnist-800-207beyondcorpfundamentalsQuickZTNA Engineeringhttps://quickztna.com/blog/ztna-vs-vpn/https://quickztna.com/blog/ztna-vs-vpn/ZTNA and VPN are often pitted against each other. The real picture is more nuanced. Here are the eight differences that actually matter when you choose — with diagrams.Tue, 05 May 2026 00:00:00 GMTfundamentalsztna-vs-vpnzero-trustvpnfundamentalswireguardQuickZTNA Engineeringhttps://quickztna.com/blog/open-source-vs-managed-ztna/https://quickztna.com/blog/open-source-vs-managed-ztna/Open-source ZTNA (OpenZiti, Headscale, NetBird) vs managed products. A decision framework that puts the trade-offs in engineering hours, not ideology.Mon, 04 May 2026 00:00:00 GMTcomparisonopen-source-ztnamanaged-ztnaztnadecision-frameworkQuickZTNA Engineeringhttps://quickztna.com/blog/device-posture-checks/https://quickztna.com/blog/device-posture-checks/Most device-posture checks are checkbox exercises. Twelve signals that actually catch unmanaged laptops, how to enforce continuously, what auditors expect.Sun, 03 May 2026 00:00:00 GMTtechnicaldevice-postureztnacontinuous-authenticationmdmedrQuickZTNA Engineeringhttps://quickztna.com/blog/soc-2-remote-access-controls/https://quickztna.com/blog/soc-2-remote-access-controls/SOC 2 is based on AICPA's Trust Services Criteria. The 11 specific Common Criteria auditors test for VPN, ZTNA, and remote-work deployments.Sun, 03 May 2026 00:00:00 GMTcompliancesoc-2compliancetrust-services-criteriaztnaremote-accessQuickZTNA Engineeringhttps://quickztna.com/blog/hipaa-compliant-vpn-2026/https://quickztna.com/blog/hipaa-compliant-vpn-2026/HIPAA encryption is 'addressable', not optional. The Security Rule technical safeguards for remote access, and what a HIPAA-aligned VPN looks like in 2026.Sat, 02 May 2026 00:00:00 GMTcompliancehipaahealthcaresecurity-rulevpnztnaQuickZTNA Engineeringhttps://quickztna.com/blog/headscale-vs-managed-coordination/https://quickztna.com/blog/headscale-vs-managed-coordination/Headscale is an open-source Tailscale-compatible coordination server. Self-host saves subscription cost but adds operational cost. Honest total-cost model.Fri, 01 May 2026 00:00:00 GMTcomparisonheadscaletailscaleself-hostmesh-vpntotal-costQuickZTNA Engineeringhttps://quickztna.com/blog/cloudflare-access-alternatives/https://quickztna.com/blog/cloudflare-access-alternatives/Cloudflare Access is an edge-native identity proxy, not a device-agent mesh. If you need a real agent, data-plane control, or self-host — these alternatives.Thu, 30 Apr 2026 00:00:00 GMTcomparisoncloudflare-access-alternativeztnamesh-vpnwireguardcomparisonQuickZTNA Engineeringhttps://quickztna.com/blog/netbird-vs-tailscale-vs-quickztna/https://quickztna.com/blog/netbird-vs-tailscale-vs-quickztna/NetBird, Tailscale, and QuickZTNA — three WireGuard mesh products for developers. Architecture, licensing, features, and post-quantum posture compared.Thu, 30 Apr 2026 00:00:00 GMTcomparisonnetbirdtailscalequickztnawireguardcomparisonQuickZTNA Engineeringhttps://quickztna.com/blog/twingate-alternative/https://quickztna.com/blog/twingate-alternative/Twingate is an agent-based ZTNA. Looking for an alternative — for licensing, protocol, pricing, or post-quantum reasons? Five serious options in 2026.Wed, 29 Apr 2026 00:00:00 GMTcomparisontwingate-alternativeztnamesh-vpncomparisonwireguardQuickZTNA Engineeringhttps://quickztna.com/blog/tailscale-alternatives-2026/https://quickztna.com/blog/tailscale-alternatives-2026/Tailscale popularised mesh VPN. Honest comparison of the best Tailscale alternatives in 2026 by architecture, licensing, pricing, and post-quantum posture.Wed, 29 Apr 2026 00:00:00 GMTcomparisontailscale-alternativemesh-vpnztnawireguardcomparisonQuickZTNA Engineeringhttps://quickztna.com/blog/anssi-pqc-transition-plan/https://quickztna.com/blog/anssi-pqc-transition-plan/ANSSI, France's cyber agency, has a three-phase plan for post-quantum. What each phase requires and how to align ZTNA with ANSSI qualification.Tue, 28 Apr 2026 00:00:00 GMTcomplianceanssifrancepost-quantumqualificationcomplianceQuickZTNA Engineeringhttps://quickztna.com/blog/bsi-post-quantum-transition-2026/https://quickztna.com/blog/bsi-post-quantum-transition-2026/Germany's BSI TR-02102-1 sets the cryptographic baseline for federal and regulated entities. Current recommendations, PQ transition, and what it means.Mon, 27 Apr 2026 00:00:00 GMTcompliancebsitr-02102post-quantumgermanycomplianceQuickZTNA Engineeringhttps://quickztna.com/blog/dora-compliance-network-resilience/https://quickztna.com/blog/dora-compliance-network-resilience/DORA has applied to EU financial entities since January 2025. Articles 5 through 27 translated into ten concrete network-resilience implementation steps.Mon, 27 Apr 2026 00:00:00 GMTcompliancedorafinancial-regulationict-risk-managementeu-regulationregulation-2022-2554QuickZTNA Engineeringhttps://quickztna.com/blog/post-quantum-vpn-vendor-questions/https://quickztna.com/blog/post-quantum-vpn-vendor-questions/Most VPN vendors claim post-quantum readiness. Six specific questions separate real implementations from marketing — with honest answers from 2026.Sun, 26 Apr 2026 00:00:00 GMTpost-quantumpost-quantum-vpnquantum-safevendor-evaluationztnawireguardQuickZTNA Engineeringhttps://quickztna.com/blog/nis2-remote-access-requirements/https://quickztna.com/blog/nis2-remote-access-requirements/NIS2 has applied to EU organisations since October 2024. Remote-access-specific reading of Article 21 with a concrete implementation checklist.Sun, 26 Apr 2026 00:00:00 GMTcompliancenis2eu-cybersecuritydirective-2022-2555remote-accesscomplianceQuickZTNA Engineeringhttps://quickztna.com/blog/cnsa-2-0-deadlines/https://quickztna.com/blog/cnsa-2-0-deadlines/CNSA 2.0 is the NSA's post-quantum algorithm suite for US National Security Systems. Approved algorithms, transition deadlines, and what DoD vendors must do.Sat, 25 Apr 2026 00:00:00 GMTcompliancecnsa-2-0nsapost-quantumdodcompliancenssQuickZTNA Engineeringhttps://quickztna.com/blog/hybrid-key-exchange-x25519-mlkem/https://quickztna.com/blog/hybrid-key-exchange-x25519-mlkem/Hybrid post-quantum key exchange combines X25519 with ML-KEM-768 so a session stays secret if either primitive holds. Construction, code, failure modes.Sat, 25 Apr 2026 00:00:00 GMTpost-quantumhybrid-key-exchangex25519ml-kempost-quantumcryptographyQuickZTNA Engineeringhttps://quickztna.com/blog/harvest-now-decrypt-later/https://quickztna.com/blog/harvest-now-decrypt-later/Harvest now, decrypt later is a real attack model. Nation-state actors record encrypted traffic today to decrypt with future quantum computers.Fri, 24 Apr 2026 00:00:00 GMTpost-quantumharvest-now-decrypt-laterpost-quantumthreat-modelquantum-computingcryptographyQuickZTNA Engineeringhttps://quickztna.com/blog/ml-kem-768-explained/https://quickztna.com/blog/ml-kem-768-explained/ML-KEM-768 is the NIST-standardised post-quantum KEM in every QuickZTNA tunnel. How it works, real benchmarks, and why we pair it with X25519.Fri, 24 Apr 2026 00:00:00 GMTpost-quantumml-kempost-quantumfips-203wireguardcryptographyQuickZTNA Engineering