--- title: The Citrix Answer description: Learn how Citrix helps organisations deliver secure access, protect applications, and support hybrid work through a unified platform for modern workplaces. image: https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-Header-3.jpg --- [![CXANX+Citrix LockUp White](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20White.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20White.png "CXANX+Citrix LockUp White")](https://www.cxanz.com) [![CXANZ+Citrix LockUp Black RGB](https://www.cxanz.com/hubfs/Australia/Projects/CXANZ/AUS-HSM-CXANZ/Brand%20Assets/CXANZ+Citrix%20LockUp%20Black%20RGB.svg "CXANZ+Citrix LockUp Black RGB")](https://www.cxanz.com/) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) # The Citrix Answer by [Wayne Baker](https://www.cxanz.com/blog/author/wayne-baker) Oct 21, 2026, 9:30:52 AM # One platform, every type of worker — even the non-human ones *In the last two posts, I’ve argued that most security architectures are very good at guarding the door and rather less good at understanding what happens once someone is in the room. The difficulty, of course, is that the room is now a browser tab. In this post, I want to look at what the right architecture actually looks like. The most useful place to start is not with products, but with people.* **Three things that have to work together** Closing the gap I described in the last post is not especially complicated in principle. It does, however, require three things to work as a connected system rather than a collection of tools that have been introduced over time and left to negotiate with one another. First, you need something that controls who gets access, and to what. Second, you need something that governs what happens once they are in. Third, you need something that gives the user a coherent experience across all of it, regardless of which application they open or which device they happen to be using. Most organisations have the first of these. Far fewer have all three working together in a way that feels deliberate. The diagram below is the simplest way I’ve found to explain it, which may say as much about the state of the market as it does about the diagram. ![](https://www.cxanz.com/hs-fs/hubfs/image-png.png?width=795&height=382&name=image-png.png) **Figure 1: The three planes: access, browser, experience** The [Safe Browsing](https://blog.google/products-and-platforms/products/chrome/google-chrome-safe-browsing-real-time/) point is worth stopping to admire. Chrome Enterprise’s threat intelligence is not drawn from a traditional security vendor’s feed; it comes from Google’s view of the public internet. That means protection informed by more than five billion devices and the assessment of over ten billion URLs and files each day. When a new phishing campaign appears on a Tuesday morning, Google has often seen it, classified it and pushed protection across that footprint before many SOCs have had their first coffee. A mid-market organisation in Brisbane therefore benefits from the same underlying threat intelligence backbone as a Fortune 100 bank in New York, without the additional faff of managing another signature feed or renewing yet another threat intelligence subscription. **Six types of worker, one platform** The cleanest way I've found to have this conversation with customers is to put products aside for a moment and talk about the people in their organisation. Every organisation — regardless of size or industry — has a recognisable mix of worker types. The question isn't which type is right for you. It's what proportion of each you have, and whether your current delivery model actually matches it. In my experience across ANZ, most organisations discover two things when they go through this exercise: the hybrid worker is their largest population, and it's also the one their architecture is weakest on. But I'll come back to that later. **Note:** Earlier posts referred to five worker types. A sixth has since been added: the autonomous agent, which has rather insisted on becoming relevant. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-1.png?width=940&height=668&name=image-png-1.png) **Figure 2: Six worker types, one platform** **Note:** Earlier posts referred to five worker types. A sixth has since been added: the autonomous agent, which has rather insisted on becoming relevant. **On the developer persona:** Citrix SecurSpaces is the destination, not a separate architecture. The access and browser governance model is identical to the web apps user’s — Citrix SecurAccess ZTNA handles access, Citrix SecurAccess with Chrome Enterprise handles the browser surface. The reason to call developers out separately is that their security requirements are distinct: source code repositories, IP protection, third-party contributor access, and air-gapped coding environments all warrant their own conversation. **On the autonomous agent,** the Citrix position here is straightforward: an agent is a user. It authenticates through the same identity stack, receives the same policy controls, and generates the same audit trail as any human worker. No new product, no new architecture required. As [Brian Madden](https://www.citrix.com/blogs/2025/06/24/the-7-stage-roadmap-for-human-ai-collaboration-in-the-workplace/) put it in July 2025: *"Human or AI, nothing changes: same identity, same guardrails, same observability, same control. You don't need to invent a new execution layer for AI. You already have one."* So when a customer asks whether their platform is ready for AI agents, the more useful question is whether their agents are ready for the platform they already have. In most cases the answer is yes — if the identity stack is in place, the agents can be onboarded like any other user. **The question worth asking any vendor** Every major SSE and ZTNA vendor can address some of those six personas. The more useful question is whether any of them can support all six from a unified management plane. More specifically: what happens when a customer’s roadmap collides with the legacy Windows application that has, through a combination of inertia and institutional dependence, refused to die? The line-of-business system inherited in a 2014 acquisition. The actuarial tool the CFO will not replace. The case management platform the legal team has arranged its working life around. The obvious answer is to put it on the endpoint. And if you control the endpoint, that is a perfectly reasonable answer. Install the application, manage it, patch it, and carry on. The difficulty is that many organisations now have a substantial population of users on devices IT has never managed. Contractors on personal laptops. Employees from a recently acquired entity still running their own estate. Frontline workers on shared or personal devices. Board members on personal iPads, which is usually where the fun starts. For that population — and it is a growing one — “put it on the endpoint” is not an option. You do not control the endpoint. So the question becomes: how do you deliver a Windows application to a user on a device you have never managed? Which brings us back to the question I have been circling throughout these three posts: what, in that scenario, actually is the endpoint? Increasingly, the answer is the browser – and often Chrome. And if the browser is the endpoint, then a managed browser that can deliver a published Windows application — inside the same pane the user already uses for SaaS, and governed by the same identity and policy controls — is not a workaround. It is the architecture. A ZTNA-only vendor does not, on its own, solve this problem. It cannot deliver the Windows application, whether the device is managed or not. Citrix can deliver it as a published application inside the Workspace browser pane, governed by the same Citrix SecurAccess ZTNA and Citrix SecurAccess with Chrome Enterprise policies and visible in the same audit trail. The user sees one interface. IT operates one policy plane and manages a single data feed into the SIEM. That's the structural advantage of nearly thirty years of application and desktop delivery capability that everyone else is now trying to bolt on. **The layer beneath the browser** Chrome Enterprise Premium governs what a user does in the browser — copy and paste, downloads, extension behaviour, and access to AI tools at the surface level. That is the orange layer in Figure 1, and for most organisations it addresses the immediate problem. But there is a governance question that sits on a different path entirely. Once an organisation runs sanctioned AI services, and those services start calling foundation models on a user's behalf, that call — the prompt that goes out, who authorised it, and which model it reaches — happens below the browser, where Citrix SecurAccess with Chrome Enterprise cannot see it. That is not a browser-layer problem; it is a question about the path between the application and the model, and it is the part many organisations have not yet got around to governing. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-2.png?width=622&height=714&name=image-png-2.png) **Figure 3: Where AI governance sits in the stack** **Note:** The browser plane (orange) and the AI gateway layer (purple) solve different problems at different points in the stack. Citrix SecurAccess with Chrome Enterprise governs what the user does in the browser; NetScaler AI Gateway governs what happens on the model-call path. Most organisations need both. That model-call path is governed by NetScaler AI Gateway — for organisations already running NetScaler, a capability they hold rather than a new product to evaluate. It deserves its own post, so I'll come back to it later in the series. So when you map your workforce against those six worker types, which persona does your current architecture serve least well? In my conversations with customers, the answer is almost always the hybrid users. They are also usually the largest group. And the reason the architecture is weakest there is not typically the SaaS applications. It is the Windows application sitting alongside them, and the rather unfashionable question of how you deliver it to a user on a device you do not control. That is the question that tends to reframe the whole conversation. Not “which ZTNA vendor should we use?”, but “what is the endpoint for a contractor who needs both Salesforce and the legacy case management system?” Once you answer that honestly, the rest of the architecture tends to follow. Previous Blog [← XenServer 9: Why Organisations Are Rethinking Virtualisation](https://www.cxanz.com/blog/xenserver-9-why-organisations-are-rethinking-virtualisation) ## You May Also Like These Related Blogs [Citrix Connect Pulse Sydney 2026: Building the Future of Secure Digital Work](https://www.cxanz.com/blog/citrix-connect-pulse-sydney-2026-building-the-future-of-secure-digital-work) ![](https://www.cxanz.com/hubfs/blog/images/DD_CITRIX_2026_0062_LARGE.webp) ### Citrix Connect Pulse Sydney 2026: Building the Future of Secure Digital Work Sep 23, 2026, 12:05:44 PM [Why VDI Is Still One of the Smartest Moves You Can Make](https://www.cxanz.com/blog/why-vdi-is-still-one-of-the-smartest-moves-you-can-make) ![](https://www.cxanz.com/hubfs/Imported_Blog_Media/AUS-CXA-011%20CXANZ%20Blog%20Header-9%20copy.jpg) ### Why VDI Is Still One of the Smartest Moves You Can Make Jul 28, 2025, 12:00:00 AM [The browser is the new endpoint. Our security model hasn’t caught up - Is anyone actually governing it?](https://www.cxanz.com/blog/the-browser-is-the-new-endpoint.-our-security-model-hasnt-caught-up-is-anyone-actually-governing-it) ![](https://www.cxanz.com/hubfs/Imported_Blog_Media/AUS-CXA-045%20CXANZ%20Blog-7.webp) ### The browser is the new endpoint. Our security model hasn’t caught up - Is anyone actually governing it? Jun 2, 2026, 12:00:00 AM ![CXANX+Citrix LockUp White](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20White.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20White.png) Cloud Software Group and any trademarks, service marks, trade names, and logos of Cloud Software Group (including Citrix and NetScaler) are owned by Cloud Software Group, Inc. and/or its affiliates and are used by Dicker Data under license from Cloud Software Group, Inc. Dicker Data Ltd is a strategic partner of Cloud Software Group, Inc. and is not a corporate subsidiary or agent of Cloud Software Group, Inc. and/or of its affiliates. Copyright © 2026 Dicker Data Ltd. All rights reserved. ABN 95 000 969 362 - [Privacy Policy](https://www.cxanz.com/privacy-policy) - [LinkedIn](https://www.linkedin.com/company/cxanz) - [YouTube](https://www.youtube.com/@CXANZCitrix) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Wayne Baker", "url" : "https://www.cxanz.com/blog/author/wayne-baker" }, "dateModified" : "2026-10-20T22:30:52.891Z", "datePublished" : "2026-10-20T22:30:52.000Z", "headline" : "The Citrix Answer", "image" : [ "https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-Header-3.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cxanz.com/blog/the-citrix-answer", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cxanz.com/hubfs/assets/logos/CXANZ-DD-AU.svg" } } } ```