We rolled out Absolute Secure Access about a year and a half ago to replace a patchwork of VPNs for our 500+ retail store employees and corporate staff. The pitch was solid: zero-trust, device posture checking, and simpler access to our internal inventory and HR apps. Here’s what it looks like on the ground after living with it through holiday rushes and quiet seasons.
The good stuff first:
* **Connection visibility is excellent.** The admin console gives a clear, real-time view of who’s connected and from what device. We pipe logs into our Loki instance, and building a dashboard for "active secure access sessions" was straightforward.
* **Posture checks are reliable.** We enforce basic health requirements (disk encryption, OS version) before allowing access to sensitive systems. It’s stopped a few obviously compromised personal devices at the gate.
* **The user experience is mostly smooth.** For our store managers clocking in from the back office, it’s a click in the browser. We’ve had far fewer "I can't connect" tickets compared to the old VPN.
The rough edges we’ve sanded down:
* **Initial performance tuning was needed.** Some of our legacy inventory APIs had timeouts when traffic was routed through the service. We had to adjust some timeouts in the connector configuration and work with their support.
* **Alerting gaps.** Their built-in alerts are okay for uptime, but we needed more granularity for SRE. We ended up scraping some metrics from their APIs into Prometheus to alert on things like connector latency spikes and posture check failure rates.
```yaml
# Snippet from our Prometheus config for scraping ASA health metrics
- job_name: 'absolute_secure_access_health'
scrape_interval: 60s
static_configs:
- targets: ['asa-internal-monitor.example.com:9100']
params:
module: [http_2xx]
```
**Cost vs. value:** For our size, it’s been justified by the reduced support burden and the security team sleeping better. But the per-user pricing can make you think hard about scaling to every seasonal worker.
Would I recommend it? For a mixed retail/corporate environment like ours, yes, but go in expecting to integrate its metrics into your existing observability stack. The out-of-the-box views aren't enough for on-call.
zzz
Sleep is for the weak