--- title: The question that reframes the room – A “day in the life” of a typical user description: Learn how Citrix helps organisations deliver secure access, protect applications, and support hybrid work through a unified platform for modern workplaces. image: https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-4.jpg --- [![CXANX+Citrix LockUp Black](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20Black.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20Black.png "CXANX+Citrix LockUp Black")](https://www.cxanz.com/) [![CXANZ+Citrix LockUp Black RGB](https://www.cxanz.com/hubfs/Australia/Projects/CXANZ/AUS-HSM-CXANZ/Brand%20Assets/CXANZ+Citrix%20LockUp%20Black%20RGB.svg "CXANZ+Citrix LockUp Black RGB")](https://www.cxanz.com/) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) # The question that reframes the room – A “day in the life” of a typical user By [**Wayne Baker**](https://www.cxanz.com/blog/author/wayne-baker) on Oct 27, 2026, 2:00:35 PM ![\The question that reframes the room – A “day in the life” of a typical user\](https://www.cxanz.com/hs-fs/hubfs/AUS-CXA-080-Blog-4.jpg?width=1920&height=1080&name=AUS-CXA-080-Blog-4.jpg) *There's a question I've started using in customer conversations that does something useful — it shifts the discussion from "which security vendor should we use?" to "what are we actually trying to govern, and for whom?" The answer tends to change the architecture conversation entirely.* I was in conversation recently with a CISO who had done the work properly. Zscaler deployed, ZTNA in place, identity sorted, device posture checks running. She walked me through the architecture with the quiet confidence of someone who had fought for budget, navigated internal politics, and delivered something quite impressive. It was genuinely good work and I said so. And then — because architecture diagrams are only ever half the story — I asked about a user I know exists in almost every organisation. Let’s call her Sarah. Sarah is a project manager at a firm the organisation acquired eighteen months ago. She has been there since before the acquisition and is still using a personal laptop she bought herself, for the simple reason that it works and no one has yet stopped her. Since the acquisition, she has needed access to two things: the parent organisation’s project management SaaS platform, and a Windows-based resource scheduling application that has been running since 2009, integrates with nothing, and will be replaced sometime around never. So: how does Sarah get the scheduling application? The silence that followed was a different sort of silence from the browser-governance question I wrote about earlier in this series. That silence comes when people have not considered the question. This one came from someone who had considered it, knew the honest answer was not ideal, and was deciding how plainly to put it. When the answer came, it was not elegant. Sarah logs into the corporate VPN portal — the one kept alive less by strategy than by institutional habit — and clicks through to an internal file share that has been there longer than anyone still in the building. On that share sits the install package, alongside a PDF guide explaining how to stand up a Windows virtual machine in Parallels or Fusion and install the scheduling client inside it. The guide was last updated so long ago it’s practically historical, and nobody in IT can now say with any confidence what the package actually contains. Sarah follows it anyway: she builds a Windows VM on her Mac, then installs a 2009 application that has firm opinions about where it should live and what it regards as "dependencies". The server side, for what it's worth, still runs on a Windows Server 2016 box in the datacentre. IT, meanwhile, has approximately zero visibility into any of this. It does not know the VM exists, let alone what the installer scattered across it on the way in. And every step has happened on a device — and now inside a second, virtual one — that the organisation has never touched, cannot verify, and would very much prefer not to examine too closely. **The assumption buried in every ZTNA architecture** Sarah’s situation isn’t an edge case. It’s the quiet reality underneath most ZTNA deployments. Every ZTNA architecture I’ve seen carries an assumption so universal it barely gets said out loud: the users who need governed access will, at some point, be on a device IT either controls or can verify. That made perfect sense when everyone sat inside the network on corporate laptops. That assumption still looks perfectly sound, right up to the point reality arrives with a personal device, a legitimate access requirement, and no interest in your architectural preferences. And that reality is no longer unusual. Contractors. Employees from acquired entities. Third-party auditors. Seasonal staff. Board members who regard corporate laptops with the sort of suspicion usually reserved for cursed artefacts. The list grows faster than organisations retire the assumptions built for a simpler world. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-3.png?width=773&height=560&name=image-png-3.png) **Figure 1: What ZTNA verifies, and what it doesn’t** The left-hand column is what ZTNA was built to do and generally does well. The right-hand column is what happens once the user is inside — in the room rather than at the door. For people on enrolled corporate devices, some of those gaps can be narrowed by endpoint agents. For Sarah, on a personal laptop IT has never touched, they stay wide open. And that’s where the architecture runs into a very specific wall. It can’t check a device certificate her laptop doesn’t have, and it has, at best, limited posture visibility on a device it has never managed. Most deployments deal with that in one of two ways. They either block her entirely — which produces exactly the kind of workaround behaviour that makes CISOs go quiet in meetings — or they grant access with reduced posture confidence and hope. Neither option is especially satisfying. Neither, for that matter, does anything to solve the Windows application problem, which is still sitting there in the corner: old, awkward, and much harder to get rid of than anyone expected. **What organisations actually do — and what it costs them** When I ask how organisations handle Sarah's situation — BYOD user, legitimate access requirement, one SaaS application and one legacy Windows application — I tend to get the same three answers, usually in roughly this order. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-4.png?width=889&height=478&name=image-png-4.png) **Figure 2: The three options organisations reach for** Option 1 is often the default because it feels safe. Option 2 is often the lived reality because it is fast. Option 3 is what becomes possible once the browser is treated as the endpoint, rather than merely the thing through which users go looking for trouble. I want to pause on Option 2, because it is more common than most organisations would care to admit in public. The security team usually knows it is a compromise. The CISO usually knows it is a compromise. But when the project manager from the acquired entity needs to be productive on day one, and the alternative is a minimum of a fortnight spent waiting for procurement, imaging and shipping, the VPN credential gets issued and the unease is filed under “temporary exception”. And as we all know, temporary exceptions in enterprise IT have a curious tendency to age in place. They remain temporary in much the same way that “interim” systems remain interim: for years at a time, with broad institutional support and very little urgency attached. By the time the next architecture review arrives — usually at a stately distance that allows everyone to maintain the fiction that this was never meant to last — the risk has already become part of the furniture. What Option 3 requires, above all, is a change in mental model. It means accepting that the browser on Sarah’s personal laptop, properly governed and subject to Citrix SecurAccess with Chrome Enterprise policy, may be a more controllable surface than a VPN tunnel from an unmanaged device into the corporate network. For some security teams, that still feels counter-intuitive, but it is consistent with the broader move away from network-based trust towards identity-, session- and resource-level controls. **What Sarah's day actually looks like** It’s worth walking through the scenario properly, because the details are where governance either holds or collapses. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-Oct-13-2026-08-33-38-3621-PM.png?width=940&height=324&name=image-png-Oct-13-2026-08-33-38-3621-PM.png) **Figure 3: The hybrid BYOD user: what she needs, what delivers it** The Windows application never touches Sarah's personal laptop. It runs in the datacentre and streams to her browser — the same way it would for any Citrix user, just without requiring a Workspace app install on her end. When her engagement ends, access is revoked in one action. No hardware to retrieve, no software to uninstall, no residual data on a device IT never controlled. From IT's perspective: a fully governed user, complete audit trail, no VPN exposure, no hardware overhead — on a device they've never touched. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-Oct-13-2026-08-33-45-7476-PM.png?width=940&height=310&name=image-png-Oct-13-2026-08-33-45-7476-PM.png) **Figure 4: Sarah's session from authentication to offboarding** The CISO I mentioned at the start had been handing out VPN access to people in exactly Sarah’s situation. When we walked through this scenario, her reaction was blunt: “We’ve been solving a $50 problem with a $500 answer, and the $500 answer was less secure.” It’s very hard to argue with that. **Why ZTNA vendors don't ask this question** There is a reason the conversation I described at the opening does not happen very often with ZTNA-only vendors. The honest answer to “how does Sarah get the legacy Windows application on her personal laptop?” is: she does not, at least not through them. ZTNA-only vendors are not built to deliver a Windows application. Their architecture generally assumes the application is a web app, a SaaS service, or something the user’s endpoint can run natively. The ancient scheduling application that integrates with nothing and runs on Windows Server 2016 sits outside that model entirely. So the question often does not get asked, because it leads straight to a problem the architecture was never designed to solve. The customer is left to deal with it separately — usually through Option 1 or Option 2 from the diagram above — while the vendor governs the SaaS side of the estate and the non-web application problem remains sitting just outside the frame. It is the same silence I saw on the CISO’s face earlier: the silence that appears when an architecture meets a requirement it was never meant to handle. This is not a criticism of ZTNA as a category. As I have said throughout this series, ZTNA is necessary, and the vendors doing it well are doing important work. It is simply a recognition that a ZTNA-only architecture has a blind spot, and that its vendors have little commercial incentive to make that blind spot the centre of the conversation. Organisations usually discover it when someone like Sarah needs access to something the architecture was never designed to reach. The question worth asking any vendor is not “can you do Zero Trust?” Every major vendor will say yes, and most can make a respectable case for it. The better question is: “what happens when a legitimate user on a device you have never managed needs access to a Windows application that is never moving to the cloud?” That is the question that separates platforms from point solutions. **What's actually changed** Step back from Sarah for a moment, because her situation is a symptom, not an anomaly. The model most security teams still run on rests on two assumptions: that the user is on a device the organisation owns, and that the work happens somewhere the network can see. For twenty years both held, because they matched reality — the managed laptop, the corporate network, the application run end to end by IT. Work doesn’t happen there anymore. It happens in a browser tab, on a device IT may never have touched, reaching applications delivered from wherever they happen to live. The browser has quietly become the endpoint — not by grand design, but by the slow, inexorable gravity of how people actually work. The vendors who recognised that shift early — and built their architectures around the browser as a governed surface rather than an afterthought — are in a different conversation to the ones still selling network perimeter controls as the complete answer. The organisations working it out now are building something their peers won’t have for the next few years. The ones who haven’t started are accumulating a governance debt that will eventually come due, usually at the worst possible moment. Sarah, in the meantime, is on her personal MacBook, in a browser tab, doing her job. The question is whether IT knows what’s happening in that tab, and has the architecture to govern it. In the best organisations I work with, the answer is now yes. In most, it’s still no — but the gap is getting harder to ignore, in the same way a dripping tap becomes impossible to tune out once you’ve noticed it. Governance always catches up with reality. The question is whether it does so by design or by incident report. --- I started this series by asking how organisations are governing what happens inside the browser. Four posts in, the question has expanded: it's not just about the browser, it's about every user who reaches corporate resources through one — including the users on devices you've never touched, reaching applications you didn't expect to still be running. Sarah is the most common version of that user. Every organisation has people in her situation. Most have more than they think, and fewer governance controls around them than they'd be comfortable admitting to their board. --- **Notes and references** 1. [**NIST SP 800-207, Zero Trust Architecture.**](https://csrc.nist.gov/pubs/sp/800/207/final) The foundational reference for the principle that trust should not be granted simply because a user or device sits on a particular network, and for the broader shift away from implicit trust based on location or ownership. 2. [**NIST SP 1800-35, Implementing a Zero Trust Architecture.**](https://csrc.nist.gov/pubs/sp/1800/35/final) Useful practical guidance on how Zero Trust is being applied across users, partners and hybrid workforces accessing resources from different devices and locations. [**Citrix SecurAccess ZTNA documentation.**](https://docs.citrix.com/en-us/citrix-secure-private-access/service/citrix-secure-private-access-overview.html) Citrix documentation for deploying Citrix SecurAccess ZTNA. [**Citrix Device Posture documentation.**](https://docs.citrix.com/en-us/device-posture.html) Citrix documentation for Device Posture and its integration with Citrix SecurAccess ZTNA. [**Citrix SecurAccess with Chrome Enterprise announcement.**](https://www.citrix.com/blogs/2025/03/18/welcoming-google-chrome-enterprise-premium-into-the-citrix-platform) Google and Citrix announcement of the joint collaboration now positioned as Citrix SecurAccess with Chrome Enterprise.     Previous Blog [← The Citrix Answer](https://www.cxanz.com/blog/the-citrix-answer) ![CXANX+Citrix LockUp White](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20White.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20White.png) Cloud Software Group and any trademarks, service marks, trade names, and logos of Cloud Software Group (including Citrix and NetScaler) are owned by Cloud Software Group, Inc. and/or its affiliates and are used by Dicker Data under license from Cloud Software Group, Inc. Dicker Data Ltd is a strategic partner of Cloud Software Group, Inc. and is not a corporate subsidiary or agent of Cloud Software Group, Inc. and/or of its affiliates. Copyright © 2026 Dicker Data Ltd. All rights reserved. ABN 95 000 969 362 - [Privacy Policy](https://www.cxanz.com/privacy-policy) - [LinkedIn](https://www.linkedin.com/company/cxanz) - [YouTube](https://www.youtube.com/@CXANZCitrix) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Wayne Baker", "url" : "https://www.cxanz.com/blog/author/wayne-baker" }, "dateModified" : "2026-10-27T03:00:35.534Z", "datePublished" : "2026-10-27T03:00:35.000Z", "headline" : "The question that reframes the room – A “day in the life” of a typical user", "image" : [ "https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-4.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cxanz.com/blog/the-question-that-reframes-the-room-a-day-in-the-life-of-a-typical-user", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cxanz.com/hubfs/assets/logos/CXANZ-DD-AU.svg" } } } ```