Act's security division has been named Zero Trust Network Access Solution of the Year in the 2026 CyberSecurity Breakthrough Awards, according to a company announcement posted on LinkedIn. The recognition singles out a product category that has become central to how organizations defend against intrusions that no longer rely on breaching a perimeter but instead exploit trust relationships between users, devices, and networks.
The distinction matters because zero trust architecture has shifted from a buzzword to a baseline expectation across enterprise security budgets. Unlike legacy models that granted broad access once a user cleared a single checkpoint, zero trust assumes no user or device is inherently trustworthy, verifying every request continuously regardless of where it originates. Act's own framing, as described in its LinkedIn post, positions zero trust network access as one piece of a larger architecture that also governs identity permissions, suggesting the company is competing less on a single feature and more on how tightly it binds network and identity controls together. This distinction echoes broader industry conversations about business models in adjacent markets, including ongoing scrutiny of how VPN companies make money and whether their revenue structures align with the privacy and security promises they advertise. how VPN companies make money
Why the Gap Between Network and Identity Matters
Many breaches do not happen because an attacker defeats encryption or brute-forces a firewall. They happen because a compromised credential grants access that should never have been permitted in the first place, or because a network-level control fails to check whether the identity behind a connection still deserves the permissions it was issued. Security teams have long struggled to keep these two layers synchronized. A user might lose their job, change roles, or have their credentials stolen, yet retain network access that was never properly revoked. Act's pitch, as outlined in its announcement, is that treating network access and identity permissions as a single coordinated system closes that gap rather than patching it after the fact.
What an Industry Award Signals, and What It Does Not
Awards from publications like CyberSecurity Breakthrough carry weight as a form of market validation, offering a signal to potential customers and investors that a product has been evaluated against competitors and found distinctive. They do not, however, substitute for independent audits, penetration testing results, or long-term deployment data. For organizations evaluating zero trust vendors, recognition of this kind is best treated as a starting point for due diligence rather than a final verdict. Questions worth asking include how a platform handles identity revocation in real time, how it integrates with existing directory services, and how transparently it discloses its own security practices and incident history.
The Broader Shift Toward Integrated Security
The timing of this recognition reflects a wider trend: security buyers increasingly resist point solutions that solve one problem while ignoring adjacent risks. Standalone VPNs, standalone identity providers, and standalone network access tools are giving way to platforms that attempt to unify these functions, partly because attackers themselves move laterally across exactly the seams that disconnected tools leave exposed. For investors and customers alike, Act's award offers a data point in that direction, though the real test will be whether the company's integrated approach holds up against the kind of sophisticated, multi-stage attacks that zero trust architecture was designed to prevent.
