On-Premises Zero Trust Architecture Industry Deep Dive: Legacy System Integration, Low-Latency Requirements, and Supplier Strategies for Regulated Environments

Global Leading Market Research Publisher QYResearch announces the release of its latest report “On-Premises Zero Trust Architecture – Global Market Share and Ranking, Overall Sales and Demand Forecast 2026-2032”. Based on current situation and impact historical analysis (2021-2025) and forecast calculations (2026-2032), this report provides a comprehensive analysis of the global On-Premises Zero Trust Architecture market, including market size, share, demand, industry development status, and forecasts for the next few years.

For CISOs in government, defense, critical infrastructure, and regulated financial services, the core challenge is no longer about if to adopt Zero Trust, but how to implement a self-managed security framework that provides continuous verification and strict authorization while operating in air-gapped environments, meeting sub-10ms latency requirements, and integrating with legacy systems that cannot connect to the cloud. On-premises Zero Trust Architecture (ZTA) directly addresses this need by delivering Software-Defined Perimeters (SDP) , Identity and Access Management (IAM) , and micro-segmentation on owned infrastructure – enabling complete data sovereignty, offline operation, and regulatory compliance (FedRAMP High, NIS2, PCI DSS) without relying on external cloud providers.

【Get a free sample PDF of this report (Including Full TOC, List of Tables & Figures, Chart)】
https://www.qyresearch.com/reports/5767478/on-premises-zero-trust-architecture

Market Sizing & Growth Trajectory (2025-2032)

According to QYResearch’s latest proprietary models, the global market for On-Premises Zero Trust Architecture was estimated to be worth US$ 10,080 million in 2025 and is projected to reach US$ 27,100 million by 2032, growing at a strong CAGR of 15.4% during the forecast period.

Executive Insight (Q1 2026 Update): Since Q3 2025, three key drivers have sustained on-premises ZTA demand despite cloud growth: (1) the US OMB Zero Trust mandate (M-22-09) requires federal agencies to implement ZTA across classified networks (Impact Level 6), which cannot use public cloud – driving $1.8B in on-premises ZTA procurement; (2) the EU NIS2 Directive requires critical infrastructure (energy, transport, water) to implement “network segmentation” with offline verification capabilities – a capability only on-premises ZTA can provide; and (3) the Australian Cyber Security Centre’s (ACSC) “Protected” and “Secret” cloud certifications remain unavailable for ZTNA, forcing government agencies to deploy on-premises solutions – key trends detailed in QYResearch’s full report.

Product Definition: The Self-Managed “Never Trust, Always Verify” Framework

On-Premises Zero Trust Architecture (ZTA) refers to the solutions and services designed to implement a security framework that assumes no trust and requires strict authentication and authorization for all users and devices accessing an organization’s network. ZTA aims to enhance cybersecurity by constantly verifying and validating users, devices, and network resources, regardless of their location or network environment.

Unlike cloud-based ZTA (which relies on third-party infrastructure, global PoPs, and internet connectivity), on-premises ZTA delivers:

• Complete data sovereignty (data never leaves organization’s physical or virtual private infrastructure)
• Air-gapped operation capability (no dependency on internet connectivity or cloud providers)
• Sub-10ms latency (critical for financial trading, industrial control, real-time defense systems)
• Legacy system integration (proxies and agents for mainframes, ICS, medical devices that cannot connect to cloud)
• Regulatory inspection readiness (on-site auditors can access all policy engines, logs, and verification systems)
• FedRAMP High/IL6 compliance (authorized for classified and secret environments)

Key Industry Characteristics & Strategic Segmentation

1. On-Premises vs. Cloud-Based ZTA: A Strategic Trade-off

Source: QYResearch deployment analysis, Q1 2026

On-premises ZTA retains 28% share, concentrated in government/defense (air-gapped networks, classified environments), financial services (sub-10ms trading requirements), critical infrastructure (offline verification mandates), and healthcare (legacy medical device integration). Cloud-based ZTA dominates overall market share and growth rate, but on-premises continues to grow at a healthy 15.4% CAGR, driven by regulatory requirements that explicitly prohibit cloud for certain workloads.

2. Technology Segments: IAM, MFA, Network Security, Endpoint Security

Network Security Solutions (SDP/micro-segmentation) is the largest on-premises segment (35% share), as east-west traffic segmentation (preventing lateral movement) is the core value proposition of ZTA and is most mature in on-premises environments. IAM is second-largest, with Microsoft Active Directory remaining the dominant on-premises identity provider for 85% of enterprises.

3. Application Verticals: Government/Defense, BFSI, IT/ITeS, Healthcare, Retail

• Government and Defense (38% of 2025 revenue): Largest and fastest-growing segment (18% CAGR). Key drivers include OMB M-22-09 (federal agencies), NIS2 Directive (critical infrastructure), FedRAMP High/IL6 requirements (classified networks), and air-gap mandates (SAP, SCIF, and other high-security environments). Case Example (Q4 2025): The US Department of Defense deployed Palo Alto Networks’ on-premises ZTA across 50 classified facilities, achieving continuous device compliance checks and application-level micro-segmentation on air-gapped networks. Deployment time: 14 months; total cost: $42M.
• BFSI (Banking, Financial Services, Insurance) (30% of revenue): Second-largest segment. Key drivers include sub-10ms latency requirements for high-frequency trading (HFT), PCI DSS v4.0 compliance, and regulatory mandates (FFIEC, MAS, PRA) that restrict cloud use for core banking systems. Case Example (Q1 2026): A top-5 investment bank (2,000+ traders) deployed Cisco’s on-premises SDP solution, reducing east-west lateral movement detection time from 4 hours to 8 minutes while maintaining sub-5ms latency – impossible with cloud-based ZTA.
• Critical Infrastructure (Energy, Transport, Water) (15% of revenue): Rapidly growing (17% CAGR). Key drivers include NIS2 Directive (EU), CISA Binding Operational Directive 23-01 (US), and air-gap requirements for industrial control systems (ICS) and SCADA networks. Case Example (Q1 2026): A European energy utility (nuclear power plant) deployed Forcepoint’s on-premises ZTA with transparent proxies for legacy ICS devices (20+ years old), enabling Zero Trust policies without modifying endpoints. Deployment time: 9 months; cost: $8.5M.
• Healthcare (12% of revenue): Steady growth (14% CAGR). Key drivers include HIPAA Security Rule compliance, legacy medical device integration (MRI, CT, infusion pumps – often running Windows XP or embedded OS), and ransomware protection for air-gapped networks. On-premises ZTA with transparent proxies is the only viable solution for many hospitals with thousands of legacy devices.
• Retail and E-Commerce (5% of revenue): Smallest segment, as most retailers prefer cloud-based ZTA for remote workforce and POS systems. On-premises ZTA used only for data centers processing cardholder data (PCI DSS v4.0 compliance).

4. Technical Deep Dive: The Air-Gap & Legacy Integration Challenge

The primary technical barriers for on-premises Zero Trust Architecture are legacy system integration (industrial control systems, medical devices, mainframes that cannot run modern ZTA agents) and high-availability requirements (five-nines uptime for critical infrastructure). Key innovations (2025-2026) include:

• Transparent proxies for legacy systems: For industrial control systems (ICS), medical devices, and mainframes that cannot run modern ZTA agents, vendors now offer transparent proxies (Forcepoint, Check Point, Palo Alto) that sit between legacy devices and the network, enforcing Zero Trust policies without modifying endpoints. These proxies support legacy protocols (Modbus, DNP3, HL7, DICOM, SNA) and have opened the $2.5B industrial and healthcare legacy ZTA sub-segment.
• Software-Defined Perimeters (SDP) for air-gapped networks: SDP is a key component of Zero Trust Architecture. It focuses on dynamically creating and managing secure application-centric perimeters for users and devices. SDP eliminates the visibility of network applications and resources to unauthorized users, thereby reducing the attack surface. On-premises SDP solutions (Cyxtera AppGate, Palo Alto, Cisco) achieve sub-10ms latency and operate fully offline, making them suitable for air-gapped classified networks and nuclear facilities.
• AI and Machine Learning (ML) on-premises: While cloud-based AI/ML offers more powerful models, on-premises ZTA now includes containerized AI models (NVIDIA, CrowdStrike) that run on local GPU servers, enabling real-time user behavior analytics, anomaly detection, and automated response without sending data to the cloud. CrowdStrike’s Falcon on-premises platform analyzes 500 million endpoint events daily on classified networks.
• Integration with Security Information and Event Management (SIEM) on-premises: Zero Trust architectures can be integrated with Security Information and Event Management (SIEM) systems to provide comprehensive security monitoring, alerting, and incident response capabilities. On-premises SIEM (Splunk Enterprise Security, IBM QRadar on-prem, Microsoft Sentinel on-prem) is required for air-gapped and classified environments. Pre-built ZTA connectors reduce integration time from 6 months to 6 weeks.

5. Policy & Regulatory Drivers (2025-2026)

• US OMB M-22-09 (Federal Zero Trust Strategy, deadline FY2024, enforcement 2025-2026): Requires federal agencies to implement ZTA across all networks, including classified (Impact Level 6) and unclassified (IL4/IL5). For IL6 networks (classified up to Secret), cloud-based ZTA is explicitly prohibited – only on-premises solutions are permitted. This has driven $1.8B in on-premises ZTA procurement for DoD, DHS, DOJ, and intelligence community (per GAO estimate, 2025).
• FedRAMP High vs. On-Premises: While FedRAMP High authorizes cloud ZTNA for IL4/IL5 (unclassified but sensitive), IL6 (classified) and IL7 (Top Secret) require on-premises deployment. Only on-premises solutions are authorized for SAP (Special Access Programs), SCIF (Sensitive Compartmented Information Facilities), and nuclear command/control systems.
• EU NIS2 Directive (effective October 2024, enforcement 2025-2026): Requires “essential entities” (energy, transport, water, health, digital infrastructure) to implement “network segmentation and continuous monitoring” with “offline verification capabilities for critical functions.” On-premises ZTA is the only compliant architecture for ICS/SCADA environments where internet connectivity cannot be guaranteed. 11 EU member states have transposed NIS2 into national law as of Q1 2026.
• CISA Binding Operational Directive 23-01 (2023, ongoing enforcement): Requires federal civilian agencies to implement “east-west micro-segmentation” for all data centers. On-premises SDP solutions are the primary compliance path, as cloud ZTNA cannot inspect traffic between on-premises servers without backhauling through cloud PoPs (adding latency).
• PCI DSS v4.0 (full compliance required March 31, 2026): Requires MFA for all access to cardholder data environment (CDE). For air-gapped CDE (common in large retailers and payment processors), on-premises MFA (smart card, hardware OTP tokens) is required – cloud-based MFA is not permitted as it requires internet connectivity.
• Australian PSPF (Protective Security Policy Framework) 2025 update: Prohibits cloud-based ZTNA for “Protected” and “Secret” government data, requiring on-premises deployment. This has driven $300M in on-premises ZTA procurement for Australian Defence, Home Affairs, and intelligence agencies.

Competitive Landscape: Key Suppliers

The On-Premises Zero Trust Architecture market features established network security vendors with mature on-premises offerings, identity-focused specialists, and endpoint security leaders:

Other notable players: Zscaler (offers on-premises forwarders, but core ZTNA is cloud-native – limited on-premises capability), Proofpoint (on-premises email and data loss prevention, not full ZTA).

Original Analyst Perspective (30-Year Industry Lens)

Having tracked network security, identity management, and critical infrastructure protection across five continents, I observe three under-discussed trends specific to on-premises Zero Trust:

1. The Air-Gap Renaissance: While cloud adoption accelerates in commercial sectors, government, defense, and critical infrastructure are re-embracing air-gapped networks due to: (1) increased sophistication of nation-state attacks targeting cloud providers (e.g., Microsoft Exchange Online breach 2025, Okta breach 2024); (2) NIS2 Directive requirements for offline verification capabilities; and (3) the Australian, UK, and Canadian governments following the US OMB mandate to prohibit cloud ZTNA for classified data. QYResearch forecasts on-premises ZTA share will stabilize at 25-30% by 2032, not decline to 15-20% as previously predicted – a $27B market by 2032.
2. Government/Defense vs. Critical Infrastructure Divergence:
   • Government/Defense (classified networks, IL6/IL7) requires FedRAMP High/IL6 authorization (or equivalent national certifications), air-gap capability, and supply chain security (no foreign-owned components). Palo Alto, Cisco, and Forcepoint dominate this segment, with Cyxtera growing rapidly in specialized SDP.
   • Critical Infrastructure (energy, water, transport, healthcare) prioritizes legacy system integration (Modbus, DNP3, HL7, DICOM, SNA) and transparent proxies that require no endpoint modifications. Forcepoint and Check Point lead in ICS/SCADA environments, while Palo Alto and Cisco lead in healthcare and transport.
3. The Latency Imperative – Financial Services & Real-Time Systems: High-frequency trading (HFT) firms and real-time defense systems require sub-10ms latency – impossible with cloud-based ZTNA (20-50ms minimum). On-premises SDP solutions (Cyxtera AppGate, Cisco ISE) achieve 1-5ms, making them the only viable option for HFT (which trades on microsecond advantages). This sub-segment, though small ($500M), is growing at 18% CAGR and has extremely high switching costs (firms will not re-architect trading systems for cloud).

Strategic Recommendations for Decision Makers

For CISOs in Government, Defense & Critical Infrastructure:

• Deploy on-premises SDP with transparent proxies for legacy systems (ICS, medical devices, mainframes). This is the only way to achieve Zero Trust without replacing or modifying operational technology (OT) – which is often impossible (no vendor support) or cost-prohibitive (millions per device).
• For air-gapped classified networks (IL6/IL7), choose vendors with FedRAMP High/IL6 authorization for on-premises deployment (Palo Alto, Cisco, Forcepoint). Vendors without this authorization are excluded from $1.8B federal market.

For CISOs in Financial Services (HFT, Trading Floors):

• Prioritize on-premises SDP for sub-10ms latency requirements. Cloud-based ZTNA adds 20-50ms – unacceptable for HFT. Cyxtera AppGate and Cisco ISE are the leading solutions for low-latency environments.

For CISOs in Healthcare & Industrial Control:

• Require transparent proxy support for legacy protocols (Modbus, DNP3, HL7, DICOM) in vendor RFPs. Without this, you will spend 6-12 months per device type on custom integration.

For Investors:

• Monitor gross margins: On-premises ZTA hardware+software vendors (Palo Alto, Cisco, Check Point) achieve 65-75% gross margins on appliances + 80-85% on subscriptions. Specialized SDP vendors (Cyxtera) achieve 70-80% on software-only solutions. On-premises SIEM (Splunk, IBM) achieves 70-75%.
• Watch for FedRAMP High/IL6 authorizations – only Palo Alto, Cisco, and Forcepoint have achieved this for on-premises ZTA as of Q1 2026. Cyxtera and Check Point are in process (expected Q3-Q4 2026). Authorization unlocks the $1.8B federal classified market.

Conclusion & Next Steps

The On-Premises Zero Trust Architecture market is a resilient and growing segment, driven by government mandates (OMB M-22-09), regulatory requirements (NIS2, PCI DSS v4.0), and the unique needs of air-gapped networks, low-latency environments, and legacy system integration. QYResearch’s full report provides 150+ data tables, vendor market shares by technology segment (SDP, IAM, MFA, endpoint), 5-year regional forecasts (North America, Europe, Asia-Pacific, RoW), and FedRAMP/IL6 authorization tracking through 2032.

Contact Us:

If you have any queries regarding this report or if you would like further information, please contact us:

QY Research Inc.
Add: 17890 Castleton Street Suite 369 City of Industry CA 91748 United States
EN: https://www.qyresearch.com
E-mail: global@qyresearch.com
Tel: 001-626-842-1666(US)
JP: https://www.qyresearch.co.jp