Actualizado en July 2026
How much business risk lives inside RDP, SSH, and Win32 access paths? Legacy protocols and unmanaged endpoints keep modern Zero Trust projects stuck in design. They expose auditors and boards to compliance gaps, higher ops costs, and slow incident response.
Choosing agent vs agentless access for legacy apps shapes security, cost, and compliance. This article compares both approaches for RDP, SSH, and Win32 apps. It also gives step-by-step architectures, hybrid patterns, incident playbooks, air-gapped options, and benchmarked TCO.
Agent vs agentless access and cost trade‑offs for legacy
The single most important variable is telemetry fidelity versus endpoint footprint. Decide if host or session data will meet your audit and forensics needs. That choice then drives architecture, buying, and cost.
Defining technical choices quickly speeds procurement and design.
Control vs telemetry
- Agent-based access gives OS and process signals, file events, and local enforcement.
- Auditors that need process-level evidence require agents.
- Agentless access (gateway or broker) gives session logs, connection metadata, and optional screen capture.
Short technical decisions speed procurement and design.
Protocol fit and limitations
- Agent-based approaches enforce local policies for RDP, SSH, and Win32 apps.
- Gateways broker most RDP and SSH sessions and record them.
- Gateways struggle with Telnet and some Win32 native bindings.
- Protocol gaps affect incident response and must influence buying.
Keep protocol limits in procurement documents.
- Agentless rollouts require no endpoint installs and proceed faster.
- Agents add work: installation, patching, and telemetry storage.
- Include agent lifecycle costs in TCO models.
- Agentless cuts endpoint ops but raises gateway and storage costs.
- Costs move from endpoints to central systems as usage grows.
Estimate gateway session recording costs early. Estimate one hour of RDP at 720p to consume 0.5 to 1 GB.
Total cost of ownership model components
Line items to include in procurement and TCO models:
- License fees
- Agent lifecycle (install, patching, upgrades)
- Telemetry retention and storage
- Gateway infrastructure and capacity
- Session recording and indexing
- SOC time and analyst effort
- Audit evidence handling and remediation
NIST and CISA guidance can raise evidence and storage needs for regulated systems. This raises SOC costs and long-term storage spend.
Sample cost benchmark
- For 1,000 endpoints, maintenance and telemetry storage can add 20 to 35% in annual ops cost versus baseline licensing.
- Agentless often shows lower endpoint ops cost but higher gateway and session storage costs as usage grows.
Budget both endpoint and central costs for realistic TCO.
ROI thresholds and decision rules
- If forensic depth needs process-level forensics, pick agents.
- If rollout must finish under 30 days and recorded sessions stay below 200 per day, agentless often pays back faster.
- Include the cost to fix failed audits and emergency access in payback math.
Favor agents when host evidence matters or systems are isolated. Favor agentless when fast onboarding gives clear business speed gains. Run a gateway capacity proof of concept and a session storage cost estimate first.
When to deploy agents for high-assurance systems
Agents are the right choice when host forensics, offline enforcement, or rules require endpoint controls. They give local capture and allow forensic timelines.
Regulatory and audit fit
NIST SP 800-207 and the CISA Zero Trust Maturity Model provide guidance on strong identity controls and telemetry for high-assurance systems. NIST SP 800-207
When rules need kernel or EDR evidence, session brokers alone will not pass audits. Include agent evidence in control mappings.
Air-gapped and offline patterns
Agent stacks work in air-gapped networks where gateways lack external IAM access. Design local log collectors, periodic removable media export, and signed audit trails.
An example case: a SCADA system used agents and WORM storage for audit proof during inspections.
Incident response and forensics
Agents give process-level timelines and speed root cause work. This helps containment and clean-up.
This works on paper. In practice, teams sometimes skip agent updates and lose telemetry during incidents. The most frequent mistake is assuming an agent will always be online. Plan re-enrollment and offline capture.
Agentless for fast rollout and low-touch endpoints
Agentless fits when speed and minimal endpoint change come first. It also fits when session logs meet compliance needs.
Session brokering and JIT access
Use a session-broker to issue short-lived sessions and stop shared credentials. Map SSO claims to ephemeral credentials and record sessions for audit.
IAM, MFA and legacy protocols
Agentless often eases SSO by centralizing auth at the gateway. Bridge SAML or OIDC claims to LDAP or Kerberos when legacy protocols need it.
A practical flow: SSO with conditional access issues an assertion. The broker then creates a temporary SSH certificate.
Scaling and gateway complexity
Gateways must scale for peak concurrent sessions and recording needs. Hidden costs include load balancing, session-store throughput, and SIEM spikes.
Verizon DBIR 2022 reported that 61% of breaches involved credential compromise. That raises the need for strong MFA at the gateway. Verizon DBIR 2022
Architectures and deployment patterns
Three patterns cover most legacy needs: bastion/session-broker, reverse-proxy gateway, and hybrid agent-assisted deployments. Each suits different constraints and fleets.
Bastion / session-broker
A bastion proxies RDP or SSH, records sessions, and enforces short-lived access. Core parts include a hardened jump host, MFA, recording, and short-lived credential issuance.
Open options include AWS Systems Manager Session Manager, Azure Bastion, or self-hosted OpenSSH jump servers.
Reverse proxy / ZTNA gateway
A reverse proxy enforces policy before it connects to internal hosts. It can apply conditional access tied to identity and device posture.
CASB or data loss prevention tools can run inline at the gateway.
Hybrid: agent-assisted gateway
Agents give local enforcement and telemetry while a gateway brokers external access. This keeps forensic fidelity and reduces exposed surface.
This pattern fits mixed fleets where full modernization is not yet possible.
| Criteria |
Agent-based |
Agentless |
| Telemetry fidelity |
Process, file, and network events |
Session logs, connection metadata, screen capture |
| Deployment speed |
Slower due to installation and patching work |
Faster, no endpoint installs |
| Air-gapped support |
Yes, with local collectors |
Usually no, needs offline connectors |
Key difference: agents give local enforcement and rich telemetry. Agentless centralizes control and can speed rollout. Each approach moves operations to different teams and cost centers.
Agentless should not be used when rules mandate endpoint agents or when systems are fully air-gapped and cannot accept external brokers. For those cases, design an agent-based bastion with removable media export and signed logs.
1
SSO with MFAUser authenticates via SAML or OIDC
2
Policy decisionGateway checks device and role
3
Session brokerIssue ephemeral credential or proxy session
4
Recording & auditStore session logs and index for SIEM
Translate high-level patterns into concrete topology notes so operators can diagram deployment and firewall rules. Example bastion topology: DMZ load-balanced bastion cluster with TCP 443, 3389, and 22 to bastions. Bastions use MFA and session recording.
Bastions make outbound-only connections to a management VLAN where legacy hosts live. Strict firewall rules block inbound host-initiated admin ports.
Example agent-assisted hybrid: host agents run in the management VLAN and send signed telemetry to an internal collector. An agentless gateway in the DMZ brokers external sessions and links SSO claims to agent state via API.
For reverse-proxy gateways, diagram TLS termination at the proxy. Use mutual TLS to internal connectors and a sidecar logging service that writes WORM-signed audit bundles.
For air-gapped systems, show an isolated network with a local bastion and an internal log collector on WORM storage. Add periodic signed export using removable media and an offline verifier appliance for log validation.
Annotate diagrams with required ports, certificate chains, and where session recording, endpoint telemetry, and EDR evidence are stored. This helps teams map controls to network and host diagrams.
Troubleshooting access failures and runbooks
Every deployment needs runbooks for agent failures, gateway outages, and emergency access. These runbooks cut mean time to repair.
Agent failure runbook
Detect agent non-reporting with SOC alerts and agent heartbeats. Triage with a local recovery image and an automatic re-enrollment script.
Fallback: allow bastion access with temporary MFA-protected credentials and full session recording.
Gateway outage and rollback
Prepare DNS and TCP failover plans and autoscale blue/green gateways. If the gateway fails, enable pre-approved manual jumpbox access with a signed audit token.
Restore normal flow only after log integrity checks and a post-mortem review.
SIEM tuning and evidence collection
Enrich proxy logs with IAM claims and correlate with endpoint telemetry when available. Create SOC rules that alert on session anomalies and failed MFA attempts.
Store recordings in searchable, time-indexed blobs with retention set to compliance needs.
What to do now
Run a two-week PoC that measures telemetry fidelity, gateway CPU and network load, and session storage growth. Use the PoC to test costs and scaling.
PoC checklist: test RDP, SSH, Telnet, and Win32. Simulate agent failures, exercise JIT SSO, and record compliance artifacts.
If procurement nears, prepare vendor RFPs that ask for API proofs of telemetry, session recording formats, and retention costs. Ask vendors for realistic load test scripts and run them during the PoC.
Start with inventory: list hosts, OS versions, open ports, and legacy protocols. Tag systems by criticality so work focuses on highest risk.
For RDP security, deploy a hardened broker or bastion that enforces MFA and session recording. Turn on Network Level Authentication and limit clipboard and drive redirection.
For SSH access, use short-lived certificates issued by a session broker or ephemeral keys mapped from SSO claims. Enforce command and pty limits for maintenance accounts.
For Telnet, encapsulate traffic through a TCP-to-SSH gateway or protocol converter and apply session brokering and recording. If Telnet devices cannot change, put them behind a gateway that records ASCII sessions.
For Win32 apps, prefer RemoteApp or app virtualization to limit desktop attack surface. Install a lightweight host agent when kernel-level evidence is needed and have it collect process and EDR events.
Finish each host task with verification: SSO-to-credential mapping works, recorded session playback succeeds, endpoint telemetry is ingested, and a rollback path exists if access breaks.
Frequently asked questions
What is the difference between agent and agentless?
Agent runs on the endpoint and gives deep telemetry and local enforcement. Agentless brokers sessions and gives connection logs and optional screen recording. Choose based on forensic detail and rollout limits.
Is agentless zero trust practical for legacy apps?
Yes when session audit and conditional access meet compliance needs. Agentless works for many RDP and SSH use cases. It may fail for deep host forensics.
When should a team deploy agents for legacy systems?
Deploy agents when host-level data is needed for response or compliance. Agents give remote forensic capture and posture checks. Make sure enrollment and update playbooks exist.
How do JIT SSO and session brokering work for legacy access?
The broker converts SSO assertions into ephemeral credentials or proxy sessions. It enforces conditional access and records sessions for audit. Map SAML or OIDC claims to LDAP groups or Kerberos as needed.
What are the common hidden costs of agentless?
Gateway scaling, recording storage, SIEM ingestion, and operational playbooks drive hidden costs. These costs grow with concurrency and retention windows. Budget them before choosing agentless.
How does PCI or HIPAA compliance affect the decision?
When rules need host-level controls or evidence, agents are usually necessary. For some PCI scopes, session recording plus strong identity controls may suffice. Consult auditors early and map controls to proof artifacts.
How to handle air-gapped legacy systems?
Use agent-based designs with local log collectors and signed export procedures. Agentless gateways rarely work without secure offline connectors. Create chain-of-custody and WORM storage for audit evidence.
The action plan
Start with a short evaluation that maps required telemetry to acceptable rollout time. Define telemetry and compliance must-haves and list mandatory protocols.
Run parallel PoCs for agent and agentless patterns over 14 days. Measure telemetry fidelity, gateway load, and storage growth.
Choose a hybrid if neither approach alone meets requirements. Deploy agents where forensics matter and gateway brokering where rollout speed matters.
Do not assume lower maintenance with agentless without a gateway capacity and evidence-cost review.
References and further reading:
- NIST SP 800-207, Zero Trust Architecture (2020)
- CISA Zero Trust Maturity Model (2021)
- Verizon DBIR 2022: credential compromise data
