Reduce your attack surface to zero with Anapaya PathGuard

Anything reachable on the Internet is a target. Anapaya PathGuard makes your critical services reachable only by approved users. Everyone else has no path to your infrastructure at all, so there is nothing left to scan and nothing left to attack.

Book a demo

Trusted by industry leaders

Every exposed service expands your attack surface

Critical services depend on an increasingly connected ecosystem of applications, operational systems, remote users, suppliers and service providers. Every service exposed to the public Internet creates another potential entry point, one that attackers can discover, scan and continuously target. As cyber threats become more automated, every one of those attack surfaces becomes a cyber security problem.

Default reachability on the public Internet

If a service is connected to the public Internet, it can be discovered, scanned and attacked. Traditional mitigation does not address that underlying vulnerability.

Find a solution

Reactive defense mechanisms

Filtering, scrubbing and edge caching all respond to an attack already in progress. None of them remove the exposure that made the attack possible.

Find a solution

Concentration risk

Layering multiple security controls adds operational complexity, licensing costs and potential points of failure, often inside a single vendor's cloud.

Find a solution

Compliance and data sovereignty

Regulated industries need control over routing paths, jurisdictions and audit trails. Traditional Internet architectures offer little of either.

Find a solution

From 20 billion hosts to only the users you care about

Your service currently sits on an Internet of roughly 20 billion hosts: every connected device, from laptops and servers to IoT sensors and smart appliances. Any one of them can reach your service, and any one of them can be used to attack it.

Today

~20 billion hosts

every connected device on the Internet
can reach your service

With PathGuard

Only your approved users

can reach it, down to the individual user level

What is Anapaya PathGuard?

Anapaya PathGuard is a product suite that provides user-authenticated access to enterprise applications and services on the SCION Internet. It prevents unauthorized access to the service entirely.

SCION runs all the way to the end user’s device, so path information is controlled per user. Without a path, no traffic can reach your infrastructure, not a single packet.

SCION SDK

For native mobile and desktop applications, integrated into the application itself so the connection is SCION end to end.

PathGuard Web SDK

For services used through a browser. It is integrated into the web application, so the user installs no software at all.

PathGuard VPN client

For everything else. It requires no changes to your applications: existing applications reach the service through the tunnel.

PathGuard Gateway

Sits in front of your application and terminates the connection, so your existing application backend is not modified.

Built on SCION, enforced at the network layer

Only approved users get access to your application on SCION, and they benefit from all its properties: provider diversity, path control and full security.

Zero attack surface

Access controls are applied per user rather than per network, so only approved users can reach the protected service. What cannot be seen cannot be attacked, so there is no exposure to scanning, DDoS or ransomware.

Cyber-resilience

A multi-operator setup removes concentration risk and single points of failure. SCION’s multipathing and fast failover keep packets reaching their destination even in degraded network conditions.

Sovereign path control

Choose which providers carry your traffic and which jurisdictions it crosses. Enforce geo-fencing and optimize path usage for low latency or high throughput, whichever your application needs.

Cost-efficient

Secure your users for a fraction of the cost of traditional solutions, with simple integration into your existing authentication systems and no added complexity for users across devices.

How does PathGuard work?

PathGuard sits between your users and your applications, and hides the connection between them from everyone else.

1

Put your application behind the Anapaya EDGE

The application is placed behind Anapaya EDGE, on premises or in the cloud, with a PathGuard Gateway in front of it. The gateway terminates
the connection, acting as a VPN termination
point or an HTTP reverse proxy, so the
application backend itself does not need to
be modified.

2

Register your private paths and access policy

Private paths to the application are registered together with an access policy that defines who is allowed to use them. This is where you decide which users can reach the service. Everyone outside that policy is simply never given a path.

3

Approved users connect

Users authenticate and, if the access policy allows it, receive the path information they need to reach the service. Anyone who does not authenticate receives nothing, so there is no
route to your infrastructure and no traffic can
be sent to it.

A cut above the rest

The Secure Swiss Finance Network (SSFN)

The Swiss Financial Industry led by the Swiss National Bank and SIX raised their standards to address
the above threats and created the most secure, reliable financial network in the world - the SSFN.

Watch more videos

Where Anapaya PathGuard fits

Anapaya PathGuard protects any service that should only ever be reachable by a known set of users.

Applications and APIs

Partner API integrations and customer applications, connected through the SCION SDK so the link between device and backend is SCION end to end.

E-banking
EV chagring
Patient portal

Web services

The Citizen and supplier portals, protected through the PathGuard Web SDK, with no software for the user to install.

Telemedicine
Payment gateway
Ecommerce

Remote access

Operational and IoT connectivity, protected through the PathGuard VPN client without changing the applications behind it.

VPN
Micro-branch communication
Field devices

Every exposed service is a target: A new approach to protecting critical access

Join our engineers for a live introduction to PathGuard: how it works, what it takes to deploy, and where it fits alongside your existing infrastructure.

Webinar-Preview-on-pathguard-landing-page

Frequently Asked Questions

How does Anapaya PathGuard reduce the attack surface?

Attack surface reduction means cutting down the number of entry points an attacker can reach. Most security tools approach this by filtering or blocking traffic once it has already arrived. PathGuard works earlier than that. Path information to your service is given only to users who have authenticated, so an unauthorized user has no route to your infrastructure and cannot send traffic to it at all. There is nothing to scan and nothing to overwhelm.

How is Anapaya PathGuard different from a VPN?

A VPN gateway has to be publicly reachable for users to connect to it, and VPN gateways are complex pieces of software with a long history of vulnerabilities. That makes them a standing target. The PathGuard Gateway is only reachable by users who have already been authorized, so it is not exposed to scanning or attack.

Do users need to install software?

It depends on how they connect. Browser users need no software installation at all, since the PathGuard Web SDK is integrated into the web application itself. Native mobile and desktop applications integrate the SCION SDK directly. Where integrating an application is not an option, the PathGuard VPN client provides the same protection without changing the applications behind it.

Is Anapaya PathGuard a ZTNA alternative?

Zero trust network access solutions authenticate users before granting access to an application, but the access gateway itself usually remains reachable on the public Internet, which makes it discoverable and a target in its own right. PathGuard enforces the same principle one layer lower, at the routing layer. Unauthorized users do not reach a gateway that turns them away, because there is no path to the gateway in the first place.

How does Anapaya PathGuard relate to Anapaya GATE?

They address the same problem at different levels of granularity and work well together. Anapaya GATE reduces your exposure by moving your service off the public Internet path onto the SCION Internet. PathGuard reduces it further, down to the individual users you have approved. Organizations can combine the two or move between them as their needs change.

Does Anapaya PathGuard work with our existing authentication system?

Yes. PathGuard integrates with existing enterprise authentication systems, including OIDC and corporate identity providers, so you can use the IAM infrastructure you already have rather than managing a separate set of identities.

Learn more

See Anapaya PathGuard in action

Book a meeting with one of our specialists to see how PathGuard can make your critical services reachable only by the users you approve.