Greater security, less complexity: Zehnder's path to Zero Trust.

What is your role at Zehnder, and what responsibility do you have specifically for network access design and security?

Jörg Allemann

I am the Chief Information Officer of the Zehnder Group and have overall responsibility for IT. Given our international footprint, with locations across Europe, North America, and Asia - particularly China - the network plays a critical role in our operations. Ensuring secure and reliable connectivity is therefore one of my highest priorities.

Willem de Groot

I am responsible for operational execution and actively contribute to the design of our architecture. This includes making architectural decisions as well as selecting, developing, and continuously improving the solutions we use.

What prompted you to change your existing security architecture?

Security has always been a top priority for us because our supply chain is business-critical. We deliver physical products that must reach customers at the right place and at the right time. Stable, secure, and continuously available systems and processes are essential to making that happen. As a result, ensuring reliable connectivity and controlling access effectively are both extremely important to us.

In addition, we operate manufacturing sites and work with external partners who also require secure access to our systems. At the same time, some components of our existing infrastructure had reached end of life and needed to be replaced.

Another important consideration was our desire to simplify the overall architecture. We believe that reducing complexity creates the foundation for stronger security and greater control. At the same time, the threat landscape on the internet has become significantly more challenging. Risks continue to increase, driving the need for more advanced protection mechanisms.

What specific challenge led you to choose ZTNA and CSWG?

We realized that our existing remote access solution no longer reflected current best practices. In particular, our traditional VPN with a full-tunnel architecture was no longer suitable for our requirements.

At the same time, ways of working have changed significantly. Remote work has increased substantially, which has raised requirements for secure and scalable access solutions. Our previous infrastructure relied on only a few centralized access points, creating clear disadvantages in a global operating environment.

Why did you choose Open Systems specifically?

We evaluated a number of alternatives using our standard selection criteria. The solution needed to fit architecturally within our existing environment, which was particularly important given that we were already using Open Systems' SD-WAN infrastructure. The managed service model was also a major factor in our decision.

Beyond the technical considerations, cost-effectiveness naturally played an important role as well. The solution needed to make financial sense as part of the overall picture. Open Systems stood out through its combination of functionality, integration, and cost. Our decision was therefore based not only on our existing relationship but on a comprehensive evaluation of all relevant factors.

With the new solution, we now have much more granular access control. This is a key building block of our Zero Trust strategy, which we are implementing step by step. Open Systems' solution has become an important enabler of that strategy.

Another decisive factor was the size of our team. For us, a managed service approach made far more sense than operating and integrating multiple components ourselves. It was also important to have an integrated solution from a single provider rather than coordinating several vendors.

How did the planning and implementation phase of the ZTNA and CSWG solutions unfold within your organization?

Getting the project started took some time because several other initiatives were running in parallel on our side. However, with the support of our Technical Account Managers at Open Systems, we were able to move the project forward in a structured way.

Integration with our existing systems also went smoothly. There have only been isolated cases where access rights needed to be adjusted after implementation, which is to be expected in a project of this nature. Overall, the system has been stable and reliable.

What improvements have you seen since the implementation?

User acceptance has been very high. Feedback has been overwhelmingly positive, especially regarding performance and ease of use. Many users find the new solution faster and simpler than the previous one.

We have also seen gains in efficiency and expect that the support effort associated with remote access has decreased.

One of the most significant improvements is in security, even though it is less visible to end users. Thanks to granular access controls, users can now access only the resources they actually need. At the same time, the solution prevents users from bypassing security mechanisms, something that was possible with traditional VPN architectures. External access is also much better protected today.

In the first phase, we established the underlying connectivity and successfully implemented ZTNA. We are currently in the next phase, where we are further refining access controls and making them even more granular.

One goal was to meet the deadline without disrupting ongoing operations. How did that work out?

We completed the migration without interrupting business operations. Although we had a dedicated migration weekend, there were no outages, exactly as planned. Since some of our production facilities also operate on weekends, uninterrupted access was absolutely essential.

Because of contractual obligations with our previous provider, we had a fixed deadline to meet. The timeline was ambitious, but through close collaboration with Open Systems, we successfully delivered on schedule.

A major advantage was that we avoided a 'big bang' approach. Instead, we built the new system alongside the previous solution and migrated users gradually. This allowed us to achieve a smooth and seamless transition by the deadline.

How did the Open Systems team support you throughout the project?

The support was excellent throughout. Despite periods of considerable pressure - particularly due to parallel internal projects - the collaboration remained efficient and well structured.

The division of responsibilities worked very well. Open Systems prepared the groundwork, we provided the necessary input, and together we executed the next steps. Overall, the project progressed as expected, and we are very satisfied with the outcome.

Our previous positive experiences with Open Systems were fully confirmed. The quality of the collaboration remained consistently high.

What impact has the solution had on remote work?

The solution supports our remote and hybrid work models extremely well. Connections are stable, and users consistently report a significantly improved experience.

Another advantage is the availability of access points around the world. This eliminates unnecessary routing detours and has a positive impact on perceived performance.

How has visibility and control over user access changed?

Visibility has improved significantly. Through the Open Systems Portal, we can see which users are accessing which resources and when - capabilities we simply did not have before.

While this functionality is not something we use constantly in day-to-day operations, it becomes extremely valuable when issues arise. It enables us to analyze incidents in a targeted way and understand exactly what happened. This additional level of transparency provides clear value for us.

What advice would you give to other organizations facing similar challenges around secure access or network protection?

Network connectivity and remote access are core services that directly affect both security and usability, and they should be treated accordingly. Increasing connectivity and workforce mobility make it essential for organizations to actively address these topics.

There are various approaches available, and every organization should choose the one that best fits its architecture, requirements, and team size. For us, a managed service approach has proven to be the right choice, including from an economic perspective.

We recommend starting with a smaller user group and rolling out the solution gradually rather than attempting a company-wide transition all at once. For us, ensuring connectivity first was critical so that we could successfully replace the previous system.

It is also important to allocate sufficient time for implementation and fine-tuning. Introducing granular access concepts is an ongoing process rather than a one-time project.

Is there anything else you would like to share about working with Open Systems?

Open Systems has been a reliable partner for us, particularly because we had already worked together in the SD-WAN space. This allowed us to build on existing structures, processes, and experience.

We were already familiar with the team, the way they work, and established operating models such as Mission Control. That familiarity made the project easier to execute and helped us implement the solution efficiently.