Three technologies come up whenever remote or hybrid access is on the table, and they get compared as though you must pick one. You usually don't.
Citrix and RDS answer the same question — where does the application actually run? Both keep it on a server and send you the screen. ZTNA answers a different question — how does a person reach an application at all, and what should they be allowed to touch once they're in?
That distinction matters, because the most common design we deploy uses two of them together: ZTNA controlling who gets to the front door, and Citrix or RDS running the application behind it.
What it is. Microsoft's own multi-session Windows. One Windows Server hosts many users at once, publishing either a full desktop or individual applications (RemoteApp) that appear in the user's own Start menu.
Where it fits. Organisations already invested in Windows Server, with one or two line-of-business applications that everyone needs and that don't tolerate being installed on laptops.
Typical industries. Accounting and bookkeeping practices, small and mid-sized professional services, construction back-office, and any organisation built around a single Windows line-of-business application.
What it is. A virtualisation layer that publishes desktops or individual applications from central infrastructure, with its own display protocol (HDX) designed for hostile network conditions.
Where it fits. Larger or more regulated environments, graphics-heavy applications, and situations where data must demonstrably never land on the endpoint.
Typical industries. Healthcare and dental (clinical software from shared workstations), financial services and insurance (regulated data that must not leave the data centre), legal (document management with strict controls), engineering, architecture and manufacturing (CAD, GPU workloads, shop-floor terminals).
What it is. The modern replacement for VPN. Instead of putting a device on the network, ZTNA brokers access to one named application at a time, checking identity and device posture on every connection.
Where it fits. Organisations replacing an ageing VPN, working with contractors or third parties, or running mostly SaaS with a few internal systems.
Typical industries. Professional services on a SaaS-first stack, distributed and multi-site organisations, anyone with contractors or seasonal staff, and regulated sectors needing auditable third-party access.
| RDS | Citrix | ZTNA | |
|---|---|---|---|
| Question it answers | Where does the app run? | Where does the app run? | How do you reach it? |
| Data on the endpoint | No | No | Yes, unless controlled elsewhere |
| Cost | Lowest | Highest | Per-user subscription |
| Poor connections | Adequate | Strongest | Depends on the app |
| Legacy apps | Good | Strongest | Can need work |
| Limits ransomware spread | Only with a gateway | Only with a gateway | Yes, by design |
| Expertise to run | Common | Specialised | Moderate |
| Graphics/CAD | Limited | Yes | Depends on the app |
Three patterns we deploy most often:
The cheapest way to get line-of-business apps to remote staff without exposing RDP. ZTNA handles who gets in; RDS runs the application.
Clinical or finance staff work in a Citrix session where data cannot leave; the rest of the organisation reaches SaaS through ZTNA.
Where applications already perform acceptably and the only real problem is that a VPN gives every connected laptop the run of the network.
We are not tied to one of these. The right answer depends on what your applications are, where your data has to stay, and what your connections look like — which is a conversation, not a product recommendation.
%20(1).webp){kind=logo}
%201.webp)
