Hey everyone, hoping to get some real-world clarity here. With so many teams now hybrid, the old "castle-and-moat" firewall thinking feels broken. A user can be on the corporate LAN one day and on a home coffee shop Wi-Fi the next.
I've been looking at Zenarmor (formerly Sensei) as a layer on top of our OPNsense boxes, specifically for its user/device awareness and application control. The marketing talks about "identifying risky user behavior," but I'm trying to piece together what that actually means in practice for a hybrid setup.
Can anyone share concrete examples? For instance:
* If an employee's device suddenly starts trying to connect to TOR exit nodes or known malicious IPs from their home network, does it flag the *user* or just the IP? Can it correlate that back to their AD/Okta identity?
* How does it handle data exfiltration attempts over non-standard ports when the device is off-VPN? Does it just alert, or can it actually throttle/block in real-time based on user risk score?
* What's the dependency like on endpoint agents for this off-network visibility? I've seen some solutions fall apart without a heavy agent.
Basically, I'm trying to benchmark its behavioral risk capabilities against something like a Palo Alto User-ID + Cortex XDR combo, but on a more practical budget. Does it give you actionable intelligence, or is it mostly after-the-fact reporting?
Cheers, Carla
Benchmarking my way to better decisions
You've hit on the exact operational question that matters. I've had Zenarmor in a pilot for about eight months, monitoring a group of 200 hybrid engineers. To your specific points:
> does it flag the *user* or just the IP?
It flags the user, provided you've integrated your IdP. In our setup with Azure AD, it correlates the device's hostname and the user's authentication event from the connector (we use the light "Hybrid Agent" on endpoints). The threat log shows "User: dchen" and "Device: DCHEN-LAPTOP," not just the public IP from their home. The behavioral model builds a baseline per user-device pair, so a sudden spike in connections to crypto-mining pools or TOR nodes from Jane's laptop, even off-VPN, raises her specific risk score.
The real-time blocking for data exfiltration is conditional. You can set a policy to outright block categories like "Anonymizers" or "High-Risk Applications." For more subtle behavioral anomalies, like a large volume of SFTP traffic over port 2222 from a device that never does that, it will alert immediately. However, automated throttling based on a dynamic risk score requires you to build that logic yourself via their API and a blocking list - it doesn't natively do progressive enforcement like that out of the box.
The agent dependency is the critical path. Without the lightweight Hybrid Agent on the endpoint, you lose user and device correlation for off-network traffic. You'll only see threats by source IP, which as you noted, is useless for a dynamic home IP. The agent is minimal, just for identity forwarding, but it is a mandatory component for the user-aware visibility you're after. In my benchmarks, its failure mode is graceful - you just revert to IP-based reporting, but that obviously breaks the user-risk model.
data is the product
Exactly, the user/device pairing is what makes the behavior tracking useful. The real-time blocking caveat is important though.
You mentioned building logic via their API for automated throttling. Have you found that the risk score they expose is granular enough to act on? I'm curious if a sudden, high-risk event like a port scan from a known-user device triggers a score that could be used to dynamically isolate that device via a NAC or something.
Or are you just using it for alerting and manual review?
Automate everything.
This is super helpful, thanks. I get lost when people start talking about agents and connectors, so seeing it broken down like this is great.
I'm still a bit fuzzy on one thing though. You mentioned needing an "IdP" to flag the user. If someone's just using a regular Windows/Mac laptop without any special company software, can it still track them off the network? Or does it basically need that light agent to see the user behind the home IP? Trying to figure out how much setup is really needed.
Great question, and you've put your finger on the exact trade-off. That light agent is the key piece for off-network user mapping. Without it, Zenarmor on your OPNsense box only sees the home router's public IP address. It can't know that `192.168.1.105` on some random home network belongs to "Sarah."
The agent's main job is to phone home and say, "Hey, this device `SARAH-LAPTOP` with user `sarah.j@company.com` is currently at public IP `X.X.X.X`." That link is what allows the behavioral baseline and risk score to stick to *her*, not just an anonymous IP.
You could skip the agent if you force everyone through a company VPN 100% of the time, because then your firewall sees their traffic directly. But for true hybrid work where people might be on coffee shop Wi-Fi without the VPN, the agent (or a similar connector) is pretty much mandatory for user-level visibility. It's not *huge* setup, but it is a deployment step.
null