Definition:

An SDP, short for Software-Defined Perimeter, is a security architecture that limits connectivity among users, devices, and resources according to identity and access policies. Instead of exposing a service to the entire network, it establishes an authorized connection to a specific application or resource.

How an SDP works

The central principle is to verify before allowing a connection. Protected services do not respond in the usual way to devices that have not yet been authorized, reducing the information visible to network scans and attacks.

An SDP architecture commonly separates the control plane, where decisions are made, from the data plane, which carries the authorized connection. Its main components are:

Client or initiating host: a component installed on or integrated with the device that requests access on behalf of the user.
SDP controller: validates identity and context, checks policies, and decides which resources each request may reach.
Gateway or accepting host: protects the application or service and accepts only connections enabled by the controller.
Identity system: provides authentication, groups, attributes, and other signals required to evaluate policy.

Designs documented by the Cloud Security Alliance may use prior authorization and techniques such as Single Packet Authorization to keep ports and services hidden before a requester is validated. The specific implementation can vary across products and environments.

Differences between SDP and VPN

A VPN creates an encrypted tunnel between a device and a network or service. In many corporate deployments, once the tunnel is established, the user gains connectivity to a network segment and other controls determine which destinations may be used.

SDP takes a more granular approach: it authorizes connectivity to specific resources and can prevent the rest of the infrastructure from being visible. The user does not need to receive general access to the network hosting the application.

Access scope: a VPN commonly connects to a network or segment, while SDP tends to connect to authorized applications or services.
Exposure: an SDP can hide resources until preliminary verification is complete, whereas a VPN focuses on protecting the tunnel.
Policy: SDP evaluates identity, device, and context to form each connection; a VPN can also integrate identity controls and segmentation.
Coexistence: the technologies can be combined, and a properly configured VPN is not inherently insecure.

Relationship with Zero Trust

SDP is one way to apply zero-trust connectivity, but SDP and Zero Trust are not equivalent. Zero Trust is a broader security model covering identities, devices, applications, data, policies, and continuous monitoring.

The zero trust architecture described by NIST does not grant implicit trust based on network location or device ownership. Authentication and authorization take place before a session to a resource is established. An SDP can implement these principles at the connectivity layer through least-privilege access and policy-based decisions.

Deploying one does not replace other controls. Endpoint protection, identity management, application security, activity logging, and incident response remain necessary. Controllers and gateways also require availability, protection, and monitoring because they participate in critical decisions and connections.

Access process

SDP access is built dynamically for each identity and resource. Although the flow depends on the implementation, it commonly follows these stages:

Request: the client contacts the control component without yet having connectivity to the protected application.
Verification: the system checks identity and may consider device posture, location, risk, or other attributes.
Authorization: the controller applies policy and determines which resource, protocol, and duration are appropriate for the request.
Configuration: the controller coordinates the client and gateway to enable an encrypted route limited to the approved service.
Monitoring: the session can be logged, reevaluated, and closed when conditions change or the policy is no longer satisfied.

The result is a restricted connection instead of general admission to the network. This reduces lateral movement and the exposed attack surface, but its effectiveness depends on the quality of the identities, policies, and signals used for each decision.