The Problem with Internet-Facing Systems
Remote access is part of every modern organization. Employees, contractors, and partners depend on technologies like VPN gateways, Citrix servers, and Outlook Web Access portals to reach internal resources from the outside world.
The trade-off is obvious: these systems must be exposed to the internet. And anything exposed to the internet is constantly scanned, probed, and attacked.
Over the years, every major VPN vendor – Cisco, Fortinet, Palo Alto (GlobalProtect), SonicWall, Ivanti, and others – has faced critical vulnerabilities that allowed attackers to implant backdoors or take control of systems. Exploitation often happened before patches were available.
For security leaders, this creates an impossible dilemma:
- Shut down the service and block employee access, disrupting operations.
- Leave it running and accept the risk of compromise until a fix is ready.
Neither option is acceptable.
Introducing a Third Option
Secfense Ghost introduces a new approach: make exposed services invisible to the internet, while still keeping them available to legitimate users.
Here’s how it works:
- By default, services like VPN or Citrix are completely hidden from the internet.
- When a verified user attempts to connect, Ghost dynamically opens access only for that user’s IP address and only for a limited time window.
- For everyone else, the service remains invisible.
The result: attackers scanning the internet cannot even see the system, let alone exploit it. Employees, on the other hand, continue working without disruption.
Architecture at a Glance
Secfense Ghost combines two coordinated components:
- User Access Security Broker (on-premises): Controls the firewall of the protected service (e.g., a VPN). By default, all traffic is denied. The broker enforces “zero visibility” until it receives instructions to open access.
- Identity Provider (cloud): Authenticates the user and provides the broker with a verified IP address. The broker then whitelists that address for a defined session duration.
This setup creates a dynamic firewall policy that shifts with each authenticated connection, keeping services hidden until the moment they are needed.
Why Invisibility Matters
Zero-day vulnerabilities will always exist. The challenge is not preventing flaws, but reducing the window of exposure.
- Without Ghost: A zero-day can be exploited immediately by anyone who discovers it, because the service is always visible.
- With Ghost: The service is invisible to the outside world. Attackers cannot probe or target it, even if they know a vulnerability exists.
This gives defenders the one thing they usually lack: time. Time to patch. Time to respond. Time to protect employees without shutting down critical services.
Practical Benefits
- Deployment: Works as a shield in front of existing systems. No need to replace VPN, Citrix, or OWA.
- User Experience: Employees connect as usual. No change to workflow.
- Scalability: Designed for organizations with distributed workforces, from hundreds to thousands of users.
- Risk Reduction: Internet exposure shrinks from 24/7 visibility to temporary, per-user sessions.
A New Baseline for Security
For years, organizations accepted that some services must remain internet-facing — and that risk was simply part of doing business. Secfense Ghost challenges that assumption.
By taking services off the map for everyone except authenticated employees, Ghost eliminates unnecessary exposure and makes invisibility the new default.
Ready to See Ghost in Action?
Secfense Ghost is built to solve one of the most persistent problems in enterprise security: protecting critical systems without disrupting how people work.
👉 Schedule a call with our team to learn how Ghost can reduce your organization’s attack surface and give your security team the time they need to stay ahead of zero-day threats.
Antoni Sikora 