Zero trust invisible network platform
MERAK From the ground to the sky, a genuinely invisible enterprise network.
Leave behind the VPN risk of one key opening the whole building, and move to one credential each with a fresh check at every door. To anyone without authorisation, the service cannot even be located — what cannot be found cannot be attacked.
Merak
Invisible zero trust network platform
PRODUCT OVERVIEW
From traditional perimeter defence
to a zero trust invisible architecture
Traditional networks rest on the assumption that inside the wall is safe. In an era of remote work, cloud services and AI-automated attacks, that assumption stopped holding long ago. Merak overturns it with three core mechanisms.
An ID for everyone
Every user and device carries a digital credential that cannot be forged.
Checked every time
There is no free passage once inside; identity and permissions are re-verified on every connection.
Invisible everywhere
No inbound port is open at all. What cannot be scanned cannot be attacked.
CHALLENGES
The four security pain points enterprises face
01
Once a VPN falls, the intranet is wide open
MFA struggles to hold off fatigue attacks and phishing interception. More damaging still: an attacker needs to steal only one account, and once VPN verification passes the intranet is fully open.
02
Services on the public internet are being scanned automatically by AI
AI has accelerated the automation of attacks, so anything exposed to the public internet is under constant probing. An open inbound port is an open door, every single day.
03
International private lines cost a fortune and still leave blind spots
MPLS is secure but expensive, and only protects links between fixed sites. Remote work and cross-border collaboration create dead zones that private lines never reach.
04
Legacy systems resist upgrades, and remain the easiest way in
Upgrades are expensive, so many organisations run systems that have gone unpatched for long periods.
WHY
Why the castle-and-moat model no longer works today
The traditional VPN is like a castle: outside the wall lies danger, inside it is entirely safe. Staff pass a single username-and-password check at the gate, and can then move freely within the castle — finance, HR and engineering all reachable.
But passwords get phished and leaked. An attacker needs to steal only one set to walk straight in and roam the intranet at will. Most major incidents of recent years follow exactly this shape: breach one point, spread sideways.
Merak: connection by connection, check by check
In the traditional architecture on the left, an attacker walks straight in on a stolen password and every intranet system is exposed. In the Merak architecture on the right, a request without a credential never learns whether the service exists at all.
HOW IT WORKS
How does Merak do it? Five core mechanisms
Each is introduced through an everyday analogy and then named in technical terms, so it lands with the board and the engineering team alike.
Issue the credential first, then talk about connecting
In the Merak architecture, every participant — person, laptop, server, service — must first obtain an unforgeable credential, and every connection afterwards is verified against it. A password is one gate among several, no longer the sole proof of identity.
What matters in the issuing flow: the control plane sends a one-time token to the new device; the device generates a key pair locally and sends back only a signing request (a CSR). The private key never leaves the device — like a seal that stays home while only stamped documents are posted. The credential therefore cannot be intercepted or copied in transit.
The whole flow runs without human intervention, and credentials renew themselves before expiry — the IT team no longer manages thousands of certificates by hand.
Every connection is verified again
Holding a credential is not a free pass. Each time someone reaches for a system, the control plane checks three things in real time: is the credential valid, does policy allow this identity to use this service, and is the path legitimate? Only when all three pass is a dedicated encrypted tunnel opened — and only to that one service.
This is the essence of zero trust: no trust is assumed between systems. Even a compromised endpoint leaves the attacker confined to the minimum scope it was already authorised for, unable to spread sideways to anything else.
Checking continues throughout the session, and a device that falls out of compliance is cut off on the spot.
Two layers: a sealed letter inside an armoured van
Data on the Merak network is protected by two independent layers. Picture posting a confidential letter. The outer layer is the armoured van — every leg of the journey is a mutually authenticated encrypted channel (mTLS), so nothing can be intercepted along the way.
The inner layer is the seal on the letter itself, applied so that only the recipient can open it (end-to-end encryption). Relays on the path carry a package they cannot open. Even a compromised relay reads nothing.
Data passes through no third-party vendor, so you retain full sovereignty over it — nobody on the path has the technical ability to reach the contents.
No door means nothing to scan
In a traditional architecture, a system has to open a door to serve anyone, and every open door is eventually found by automated scanning — the VPN gateway being the most typical example, and attackers’ first target for years.
Merak inverts that logic completely: the server opens no inbound port, and the local node establishes the connection outward instead (outbound-only). Legitimate traffic arrives back down that outbound tunnel. From the internet’s point of view your system does not exist — no address to hit, no port to scan, no login page to brute force.
What cannot be found cannot be attacked. It is the most complete form of attack-surface reduction — automated attacks fail before they are even launched.
Smart routing: a broken link is a detour
Merak nodes interconnect as a mesh and continuously measure the quality of each link. Traffic always takes the fastest path available; when a link fails or congests, the system reroutes itself and users barely notice.
Against the single-point VPN design — gateway down, company offline — a mesh removes single points of failure at the architectural level.
The value to the business is plain: connection quality and availability improve markedly for international collaboration, remote work and critical systems alike — no more emergency meetings over an unannounced outage.
ARCHITECTURE
Merak deployed inside your network
Control plane and data plane separated: verification in the cloud, your data stays with you.
PRODUCT DETAILS
Capabilities
Make enterprise services disappear from the public internet
Built on a zero trust architecture, Merak leaves unverified requests unable to perceive that a service exists at all. Attackers cannot scan, probe or lock on to a target — the defence begins at the source.
SERVICE HIDING ARCHITECTURE
KEY OFFERINGS
Zero-touch protection for legacy systems
A node deployed on a separate VM places zero trust protection over legacy architecture without modifying the existing system.
Contact usHide public-facing services
Public APIs and services return nothing at all to unverified requests, removing the exposure risk entirely.
Contact usBlock automated scanning
AI-driven scanning tools find no target, so the attack fails before it is launched.
Contact usProtection across satellite networks
From terrestrial networks to satellite links, service hiding applies regardless of the underlying network.
Contact us
Public transit, private-line security
Traffic runs mTLS encrypted point to point, never through a third-party server. Private-line grade confidentiality at public internet cost turns international connectivity away from a heavy fixed expense.
DIRECT ROUTING ARCHITECTURE
KEY OFFERINGS
Replace international MPLS lines
Multinationals replace part of their MPLS footprint with Merak direct routing, cutting fixed costs while raising security.
Contact usSecure remote access
Wherever staff work, traffic stays encrypted and direct, with connection quality and security unaffected by location.
Contact usCross-border transfer compliance
Point-to-point routing keeps data off third-party servers, supporting regulatory requirements on cross-border transfer.
Contact usFast branch connectivity
A new branch needs no new circuit or contract negotiation; a secure connection is established through Merak directly.
Contact us
Reaching the network is not reaching the service
Service-level access control through RBAC means each identity connects only to the services it is authorised for. No more intranet nightmare where breaching one point brings down everything — lateral movement is closed off at the architectural layer.
MICROSEGMENTATION ARCHITECTURE
KEY OFFERINGS
Third-party vendor access control
Vendors sign in to a dedicated URL through the browser and reach only authorised services; the corporate intranet stays entirely invisible to them.
Contact usSecure BYOD access
Personal devices install nothing. Agentless mode reaches authorised services while keeping personal and corporate data fully separated.
Contact usLeast privilege in practice
Each identity receives only the access its work requires, sharply reducing exposure to insider threat and account compromise.
Contact usIsolation during mergers
Through a merger, access rights across the old and new organisations can be partitioned finely, avoiding risk during integration.
Contact us
COMPARISON
One table: traditional VPN, gateway-based ZTNA and Merak
Start with the quick comparison below; for the full reasoning, an analysis of each architecture’s limits and the common evaluation mistakes, see the engineering blog in the resources centre.
| Criterion | Traditional VPN | Gateway-based ZTNA | Merak SDP |
|---|---|---|---|
| Getting in | Username and password, once | Username and password, plus application-layer checks | A credential, re-verified on every connection |
| Once inside | The whole intranet is reachable | The applications the gateway proxies | Only the services this identity is authorised for |
| Public exposure | The gateway is published and can be scanned | The gateway remains a public endpoint | Invisible; no inbound door at all |
| Data path | Through the VPN gateway | All traffic proxied through the gateway | Control and data planes separated; point to point, never via a third party |
| When a password leaks | The attacker walks in and spreads sideways | Bounded by policy, but the gateway is still probeable | Without a device credential, nothing moves |
| When a link fails | Usually a full outage and a manual reconnect | The gateway is a central bottleneck | Mesh routing reroutes itself; users barely notice |
| Legacy systems | The system itself must be manageable | Usually needs application-layer compatibility | Covered by a separate node, with no change to the original system |
| Operational load | Certificates and configuration largely by hand | A gateway cluster to maintain and scale | Credentials issued automatically and renewed before expiry |
BUSINESS VALUE
What real value does this bring the company?
The architectural difference ultimately shows up on four management reports: incident volume, audit and compliance, operational headcount, and supplier dependency.
01
An attack surface close to zero
Systems do not exist on the network, so ransomware and automated scanning have nothing to work with. After deployment, security incidents drop significantly by 85%; as the likelihood of an incident falls, audit costs fall with it.
02
Least privilege, clean audit trail
Contractors and external vendors receive the key to one service, not to the intranet. Who reached what, and when, is recorded throughout, so compliance reporting has evidence behind it.
03
Lower operational cost
Issuing, renewing and granting are automated. Joiners, leavers and expiring vendor contracts turn access management from ticket work into policy configuration.
04
Sovereign and flexible
Deploy in your own datacentre or any cloud, with data sovereignty entirely in your hands. Kunan Technology provides local implementation and support, so security does not hinge on a vendor.
GLOSSARY
Glossary: the analogy and the term
The analogies used on this page, mapped to the words your engineers will use.
- Digital ID card X.509 certificate
- Identity bound to each user and device, cryptographically impossible to forge.
- One-time entry ticket Enrolment JWT
- A single-use credential that bootstraps the trust relationship and then expires.
- Control plane Merak Auth Server
- Issues credentials, holds policy and authorises every connection. Never on the data path.
- Relay Merak Node (data plane)
- Carries the encrypted traffic, interconnected and choosing the fastest path available.
- Armoured channel mTLS
- An encrypted connection per leg, with both ends authenticating each other.
- Sealed letter End-to-end encryption
- A second layer only the recipient can open; relays carry it without reading it.
Make your enterprise services invisible, starting today.
See how Merak fits into your existing architecture without disruption, and brings zero trust protection with it.