Secure access assessment: review your VPN and plan zero trust
Your VPN has grown over the years: gateways, profiles, firewall rules and access for service providers that nobody fully oversees any more? We capture every access path, assess vulnerabilities and legacy issues, and design the target model with zero trust or a mesh VPN. You receive a product recommendation, a migration path and the fixed-price proposal for the replacement.
Companies worldwide trust WZ-IT
The following are trademarks of their respective owners: WireGuard (Jason A. Donenfeld (WireGuard LLC)), Headscale (the Headscale project (Juan Font Alonso)). WZ-IT is an independent service provider and has no business, partnership, or contractual relationship with these companies. We offer independent migration, installation, hosting, and operations services. NetBird is a trademark of NetBird GmbH. WZ-IT is an official NetBird Reseller Partner. Commercial Starter and Enterprise can be purchased through WZ-IT where required; vendor licensing and WZ-IT services are itemised separately.
Starting point
For access that has grown and that nobody fully oversees any more
- An SSL VPN or VPN appliance is reachable directly from the internet, and security updates arrive under time pressure
- Access for employees, administrators and service providers has grown over the years and is only partly documented
- Offboarding, groups and permissions are maintained by hand; sign-in with SSO and MFA is missing or incomplete
- You do not know yet whether NetBird, WireGuard, Headscale or your firewall vendor's solution fits
A target model with a product choice instead of another VPN profile
The report shows who accesses what today, where the risks are and what the target model looks like. It is yours and remains usable without a follow-up order.
Complete inventory
VPN gateways, access paths, users, devices, sites, exposed networks and third-party access in one overview.
Vulnerabilities and legacy issues
Gateways reachable from the internet, outdated versions, shared accounts, missing MFA and overly broad network access, ordered by priority.
Target model and product choice
Zero trust or mesh VPN with identities, groups and policies, plus the product recommendation with licence tier and migration path.
Neutral, with an honest limit: WZ-IT is an official NetBird reseller and operates NetBird as a managed service. If WireGuard, Headscale or your firewall vendor's solution fits better, the recommendation says so.
Basics on zero trust, mesh VPN, MFA and replacing SSL VPNs in the remote access knowledge section.
Four steps from a grown VPN to a target model
Configuration exports, documentation and conversations with your IT team are enough for the assessment. Your existing access stays unchanged.
- 01
Capture access paths
Collect gateways, profiles, firewall rules, identity provider, user groups, devices, sites and external access.
- 02
Assess risks
Classify internet exposure, versions, sign-in, permissions and logging per access path.
- 03
Design the target model
Define identities, groups, policies, networks and hosting location and test the products against your requirements.
- 04
Discuss the outcome
You receive the report, product recommendation, migration path and the fixed-price proposal for the VPN migration sprint.
What we need for the assessment
- Configuration exports or an overview of the VPN gateways and firewall rules
- User groups, service providers and sites with approximate size
- Contacts for network, firewall and identity provider
- Known requirements, for example from customer contracts, insurers or NIS2
Access, risks and target model in one assessment
The assessment covers the remote access of one company with its sites. Very large or international environments are scoped before you order.
Inventory
Capture VPN gateways, client profiles, site connections, users, devices and third-party access.
Vulnerabilities and legacy issues
Assess services reachable from the internet, gateway versions, shared access, missing MFA and open network access.
Target model
Zero trust or mesh VPN: identities, groups, policies per service, device posture and logging.
Product choice
NetBird, WireGuard, Headscale and other options tested against your requirements, with licence tier and hosting location.
Migration path
Order of groups and sites, parallel operation, rollback path and decommissioning plan for the previous VPN.
Report and fixed-price proposal
Priority list, recommendation and fixed-price proposal for the VPN migration sprint.
Boundary
The assessment plans the replacement, the migration sprint carries it out
- Changes to firewalls, gateways or clients
- Penetration test or forensic investigation of the existing gateways
- ISMS or NIS2 consulting beyond remote access
- Licences and runtime infrastructure for the target system
Price
Assessment with a defined scope, replacement after the decision
Scope and price of the assessment are fixed before you order. You receive the fixed-price proposal for the VPN migration sprint together with the report.
Secure access assessment
from €1,490
excl. VAT, one-time
Credited against the replacement if you order it within 6 months on the same topic.
For companies with an existing VPN or grown remote access before deciding on the target model.
- Inventory of all access paths
- Vulnerabilities and legacy issues by priority
- Target model with zero trust or mesh VPN
- Product choice with licence tier
- Migration path and fixed-price proposal
Outcome: Report with inventory, risks by priority, target model, product recommendation, migration path and fixed-price proposal.
VPN migration sprint
Fixed-price proposal
with the report
Build the target environment, migrate a pilot group in parallel operation and define the further rollout.
Building blocks
- Target environment with identity provider integration
- Groups and access rules
- Pilot group in parallel operation
- Documented rollback path
- Plan for further waves and for decommissioning the old access
Outcome: Tested new access path for the pilot group and a plan for the further rollout.
Remote is the default; on-site sessions are charged with travel costs. WZ-IT is an official NetBird reseller, so you can also obtain Commercial Starter and Enterprise through us; licences from other vendors are bought directly from the vendor. The report is yours and remains usable without a follow-up order.
All prices are net and exclude statutory VAT. The offers are addressed to businesses.
Replacement and operations from one provider
After the decision we build the target environment in the VPN migration sprint, migrate users in waves and, if you wish, operate the new environment permanently.
VPN migration sprint
Build the target environment and migrate a pilot group with parallel operation and a rollback path.
View the migration sprintfrom €349.90 excl. VAT / monthManaged Secure Access
Hand over control plane, relays, monitoring, updates and agreed response permanently.
View operationsNetBird
Self-hosting, licence tiers, SSO, policies and network routes in detail.
View NetBirdFrequently asked questions about VPN consulting
Costs, reasons to replace, zero trust, product choice and operations
The secure access assessment costs from €1,490 excl. VAT. It covers the inventory, the assessment of vulnerabilities and legacy issues, the target model, the product choice and the migration path. You receive the fixed-price proposal for the VPN migration sprint, which costs from €2,490 excl. VAT, together with the report. The assessment price is credited if you order the replacement within 6 months on the same topic.
Common triggers are VPN gateways that are reachable directly from the internet and keep needing urgent patches, access without MFA, shared accounts for service providers and permissions that nobody can attribute any more. Our article on SSL VPN risk explains why internet-exposed SSL VPN appliances become a liability. The assessment orders the findings by priority.
No. Zero trust is a principle: every access is granted individually based on identity, device and policy instead of letting users into the network wholesale. Products such as NetBird implement parts of it technically; groups, policies and processes still need to be defined. The article What is ZTNA? explains the basics.
NetBird comes with a management interface, SSO, groups, policies and network routes and suits environments where access should be controlled centrally by identity. WireGuard is the lean protocol for fixed site connections without central management. Headscale is a self-hosted control server for Tailscale clients. NetBird vs. Tailscale vs. WireGuard offers a detailed comparison; the assessment weights the differences against your requirements.
The Community Edition is free and usable without limits on users and devices, including SSO and MFA via your own identity provider, access controls, device posture checks and audit event logging. Commercial Starter costs €2,000 per year for up to 50 users and 500 devices and adds high availability, SCIM provisioning and device approvals, among other things; Enterprise is available on request (NetBird, self-hosted pricing). As an official NetBird reseller, WZ-IT can supply both licence tiers where required.
The assessment evaluates the technical building blocks of remote access that can matter for NIS2, such as MFA, access control and logging, and shows how the target model covers them. Whether and how NIS2 applies to your company is a legal question and not part of the assessment. More in the article NIS2-compliant remote access.
No. We work with configuration exports, documentation and conversations. Changes to firewalls, gateways or clients only happen in the separately ordered VPN migration sprint, and there too in parallel operation with a rollback path.
Yes. As Managed Secure Access we take over control plane, relays, monitoring, updates and agreed response from from €349.90 excl. VAT / month.
Request the secure access assessment
Which access do you want reviewed?
Name the current VPN, the approximate number of users and sites, and the reason. We confirm scope and price before you order.
Client feedback on networking and secure access
From the NetBird setup with Kubernetes cluster connectivity to site networking in production.
“WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.”
Steve Kirchner
Managing Director, nextGYM GmbH
“WZ-IT supported us professionally with the provisioning and setup of NetBird. Alongside the technical implementation, we also received well-founded advice on connecting our Kubernetes clusters. The recommendations were concrete and directly actionable. The collaboration was consistently reliable, fast and on equal terms. We can recommend WZ-IT without reservation.”
Kai Clauß
Head of Development, SweetConnect GmbH
SweetConnect - cross-manufacturer Industry 4.0 platform for confectionery production.
“Professional, honest and technically thoroughly sound: WZ-IT set up our Proxmox and backup infrastructure securely and future-proof. The consulting from Timo and Robin was objective and needs-driven, the implementation smooth and the final documentation exemplary. You can tell immediately that business-critical infrastructure is thought through holistically from the outset here and implemented with clear ownership.”
Pascal Block
Project Manager, Stadtwerke Brühl GmbH
Stadtwerke Brühl - municipal energy and infrastructure utility.
“Communication with WZ-IT was open, friendly and professional from the very beginning. Mr. Wevelsiep and Mr. Zins responded to every one of our questions patiently, promptly and respectfully, and contributed their own suggestions and good ideas on how to modernize our server infrastructure and adapt it even better to our needs. Throughout, WZ-IT consistently kept our need for data sovereignty and GDPR compliance in mind. Even short-notice adjustments and change requests from our side were implemented quickly and patiently and integrated consistently into the overall concept. From planning to the final handover, every step was documented transparently and comprehensively - so if a provider change should ever become necessary, the documentation would let us onboard a successor into our infrastructure very quickly. We are extremely satisfied with WZ-IT and hope to continue working together for a long time.”
Christoph Mußmann
Project Officer, DGHO e.V.
DGHO - German Society for Hematology and Medical Oncology.
“I got to know Timo and Robin as dedicated and professional partners who make a lot of things possible for their clients that initially seem impossible. I felt very well advised. The services offered have thoroughly convinced me. (translated)”
Andrea Pawlowski
Communications Manager, Golem.de
Golem.de - leading German IT news outlet.
“While looking for a partner to integrate a local AI solution, we came across Timo and Robin - and could not have made a better decision. They quickly understood our requirements and solved technical challenges competently and pragmatically. We were particularly impressed by the straightforward collaboration, their high level of expertise and the speed of implementation. We are delighted to have Timo and Robin at our side as reliable business partners and look forward to our next projects together. (translated)”
Henrik Jeche
Head of IT Administration
ml&s - full-service provider for the electronics industry.
“With Timo and Robin, you're not only on the safe side technically - you also get the best human support! Whether it's quick help in everyday life or complex IT solutions: the guys from WZ-IT think along with you, act quickly and speak a language you understand. The collaboration is uncomplicated, reliable and always on an equal footing. That makes IT fun - and above all: it works! Big thank you to the team! (translated)”
Sonja Aßer
Data Manager, ARGE
ARGE Neue Medien - master data & digital standards for plumbing and building technology.
“I recently worked with Timo and the WZ-IT team, and honestly, it turned out to be one of the best tech decisions I have made for my business. Right from the start, Timo took the time to walk me through every step in a simple and calm way. No matter how many questions I had, he never rushed me. The results speak for themselves. With WZ-IT, we reduced our monthly expenses from $1,300 down to $250. This was a huge win for us.”
Aleksandr Shuliko
CTO, EVA Real Estate
EVA Real Estate - leading real-estate agency in Dubai.
“WZ-IT manages our Proxmox cluster reliably and professionally. The team handles continuous monitoring and regular updates for us and responds very quickly to any issues or inquiries. They also configure new nodes, systems, and applications that we need to add to our cluster. With WZ-IT's proactive support, our cluster and the business-critical applications running on it remain stable, and high availability is consistently ensured. We value the professional collaboration and the noticeable relief it brings to our daily operations.”
Pascal Hakkers
Aphy AG
Aphy AG - AI platform for hotel back-office.
“WZ-IT provided very competent support in implementing our server and virtualization infrastructure. As part of the project, a Proxmox-based virtualization environment was set up along with a virtual machine for our application systems. Additionally, a structured backup concept was implemented. A particular focus was on security: the setup of a VPN tunnel and the clean implementation of encryption and access concepts were professionally executed. The structured consulting as well as the reliable and swift implementation deserve special mention. We are very satisfied with the services provided and are happy to recommend WZ-IT.”
John Hellmerichs
Managing Director, AInergy GmbH
AInergy - consultancy for energy and facility management.
“We have had very good experiences with Mr. Wevelsiep and WZ-IT. The consultation was professional, clearly understandable, and at fair prices. The team not only implemented our requirements but also thought along and proactively. Instead of just processing individual tasks, they provided us with well-founded explanations that strengthened our own understanding. WZ-IT took a lot of pressure off us with their structured approach - that was exactly what we needed and is the reason why we keep coming back. (translated)”
Matthias Zimmermann
Managing Director, Annota GmbH
Annota - healthtech startup with an AI documentation assistant.
“Timo and Robin from WZ-IT set up a RocketChat server for us - and I couldn't be more satisfied! From the initial consultation to the final implementation, everything was absolutely professional, efficient, and to my complete satisfaction. I particularly appreciate the clear communication, transparent pricing, and the comprehensive expertise that both bring to the table. Even after the setup, they take care of the maintenance, which frees up my time enormously and allows me to focus on other important areas of my business - with the good feeling that our IT is in the best hands. I can recommend WZ-IT without reservation and look forward to continuing our collaboration! (translated)”
Sebastian Maier
Managing Director, Yonju GmbH
Yonju - business coaching and AI products.
“Counting on WZ-IT team was crucial, their expertise and solutions gave us the pace to deploy in production our services, even suggesting and performing improvements over our configuration and setup. We expect to keep counting on them for continuous maintenance of our services and implementation of new solutions.”
Gabriel Sanz Señor
Managing Director, Odiseo Solutions
Odiseo Solutions - software engineering for the space industry.
Let's Talk About Your Idea
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Arrange a callback
Companies worldwide trust WZ-IT