HBX Labs Logo
HBXLabs
A technician with a laptop works on a single roadside equipment cabinet at dusk.

Solutions · VPN replacement

The VPN hands over the network. They only needed one machine.

Remote access VPNs were built to join two networks together, and they cannot do less than that. HBX puts one named person on one device, for one window of time, and leaves no standing route behind.

What you're running today

A VPN doesn't grant access to a system. It grants membership in a network.

You issue a profile so one engineer can reach one controller at one site. What the profile actually does is put their laptop on the same part of the network the controller lives on, with an address inside your perimeter. From there, everything that part of the network can reach is one scan away, and the network doesn't care which of those things the ticket was about.

The unit of access is the subnet

There is no way to write “this person, this device” in a tunnel. You approximate it with routes, firewall rules and a group in the directory, and the approximation drifts the first time someone re-addresses a plant.

Lateral movement is the network working correctly

Once a laptop is on that network, moving sideways isn't a hack. Every neighbour of the box you meant to expose is reachable by whoever holds that profile, or by whoever ends up holding that laptop.

Someone else sits in the path

Cloud-delivered remote access sends your traffic through a vendor's servers, because that is where the policy is enforced. Your provider ends up in the middle of a connection between two machines that are both yours.

And when something looks wrong at 3am, the only control you have is a switch with two positions.

Kill the tunnel and you cut every person and every integration riding that VPN, including the ones doing legitimate work in the middle of a maintenance window.

Leave it up and the connection you are unsure about carries on, because there is no way to stop a single connection.

What replaces it

One person, one device, one window, and nothing left standing afterwards.

There is no profile to provision and no route to add. The decision is made per request, for one target and one window.

How HBX Access decides
A VPN puts one box in the middle of every connection and opens the whole network. HBX Access stays out of the traffic and opens one machine.On the left, labelled with a VPN: employees, contractors and AI agents each send a thick traffic line down into a single VPN server. Every connection lands there and all traffic crosses that box. Out of it a thick bus runs into the customer network and branches to every machine in it (an Oracle database, plant control, a Linux server and a file share) and arrows between those machines show that once you are inside you can move sideways. On the right, labelled with HBX Access: the same three actors, but a single thick line runs directly from one of them into one machine, limited to one target and one time window. The other three machines are greyed out and not reachable. The HBX Access box sits above and to the side, touched only by thin dotted control lines: one approving the access for the actor, one setting up that access inside the customer network. No traffic line touches it.WITH A VPNhow remote access is done todayEmployeesContractorsAI agentsVPN serverevery connection lands hereall traffic crosses this boxCUSTOMER NETWORKOracledatabaseSCADAplantLinuxserverFile shareofficeonce you are in, you can move sidewaysYou get the network, not a system.Every packet crosses the box in the middle.WITH HBX ACCESSthe same three actors, one target eachEmployeesContractorsAI agentsCUSTOMER NETWORKHBX Accessauthorizes one targetsets it up, then steps asideapproves the accesssets it upone target · one windowOracle1521SCADAplantLinuxserverFile shareofficethe one targetnot in this authorizationno sideways path from the one to the othersYou get one machine, for one window.HBX authorizes it. It never carries the traffic.A VPN puts a box in the middle of the traffic. HBX Access stays out of it.
See the demo

A name, not an address

Every access starts from an identity your directory already vouches for. The record names the person answerable and the target, not a network address and a duration, so it reads like evidence an auditor can use.

Reaching one thing reaches one thing

Approval is for the device itself, not the part of the network it happens to sit on. Its neighbour is not included, and changing a site's addresses doesn't quietly widen anything.

It ends without anyone deciding to

Access expires because that is how it was authorized. The connector removes the temporary login when the window ends, so nobody has to remember the contractor from March.

Where the traffic goes

Drop the network-wide tunnel. Publish nothing to the internet.

A connector runs next to the system, inside your private network, and dials outward. Nothing to open in your firewall, and no change to negotiate before the first device is reachable.

Once access is approved, the traffic goes directly from the person's device to that connector. HBX is not on the route, which is why HBX cannot read what crosses it. That is the shape of the thing, not a promise about our conduct.

Outbound only

The connector registers itself and keeps the conversation going from the inside. This opens nothing new to the outside.

Revocation with a handle on it

Each connection can be stopped on its own, so stopping one stops one. The rest of the estate keeps working while you find out what happened.

Bring us the tunnel you like least.

Half an hour, one VPN server, one set of profiles nobody wants to touch. We'll walk through what replacing it actually looks like, and where it does and doesn't fit.

Talk to us for 30 minutes

People get a console → HBX Human Access. Agents get their own temporary access → HBX Agent Access.