Hybrid appliance for zero trust network access to customer applications

A system for zero trust network access to a customer application comprising:

• an application hosted on a customer premises;
• a firewall between the customer premises and a public data network;
• a threat management facility configured to manage security for the customer premises;
• a cloud computing platform hosted remotely from the customer premises, the cloud computing platform configured to provide zero trust network access to the application by a device operated by a user associated with the customer premises;
• and
• a zero trust network access appliance hosted on the customer premises, the zero trust network access appliance configured to respond to a user input by selecting between operating in a gateway mode and operating in a cloud mode, wherein:
• in the gateway mode, the zero trust network access appliance operates as a zero trust network access gateway to provide zero trust network access from the public data network to the application through the firewall for the customer premises,
• in the cloud mode, the zero trust network access appliance acts as a zero trust network access connector coupling the application hosted on the customer premises to the cloud computing platform through a secure tunnel to provide zero trust network access from the public data network to the application through the cloud computing platform, and
• the threat management facility securely coupled to one or more control plane services executing on the cloud computing platform and a cloud agent executing on the customer premises to provide a control plane for configuring the zero trust network access appliance to operate in the cloud mode or the gateway mode.