Global CRM Leader

Scaling Secure Access for Global Development Teams

The engineering organization required secure, low-friction access to both ephemeral development environments and legacy services. Traditional VPN-based solutions were not viable because they introduced user friction and relied on a "trust-by-network" model that created security risks.

Previous approaches combined OAuth2 Proxy with ZScaler, but this setup could not meet the organization's requirements for Linux compatibility, route-level control, and scalability. AWS alternatives were evaluated but proved cost-prohibitive since they required a dedicated load balancer for every workspace.

As adoption grew, the team encountered critical scaling challenges:

• Route-per-user model that was difficult to extend

• Frequent certificate issuance and renewal, increasing operational overhead

• Globally distributed teams across multiple regions, amplifying routing and upgrade fragility

These issues compounded into significant operational toil, with recurring disruptions related to routing, certificate management, and scheme migrations.

Clientless, Identity-Aware Access at Enterprise Scale

The company implemented Pomerium Enterprise as a clientless, identity-aware access proxy. The platform enforces policy-as-code over standard HTTPS while integrating with Zscaler for device and network signals, Okta and Keycloak for identity, and Pomerium for final authorization. This approach maintained agentless access while aligning with Zero Trust principles and enterprise auditing requirements.

The engineering team embedded Pomerium's Enterprise API into their internal control plane, enabling on-demand provisioning and retirement of routes. The system now supports approximately 100 workspace creations and retirements daily, sustaining developer velocity without manual intervention.

To address extreme route density and isolation requirements, the organization deployed Pomerium's Clusters capability. Clusters enabled self-sharding and autonomous configuration based on geography and availability zone, ensuring both scalability and operational resilience.

Production-Grade Zero Trust at Global Scale

For this organization, Pomerium centralizes authorization and auditing for internal access, enforces least-privilege policies and eliminates trust-by-network patterns. Device and identity context are evaluated on every request, supporting Zero Trust objectives and maintaining audit readiness.

"Pomerium, when deployed correctly with real certs, does not require anything to be done on the client's side. It's just bog-standard HTTPS."

Principal Engineer at Global CRM

Key Outcomes and Technical Specifications

With Pomerium, the team:

• Secured 100,000+ internal routes with gigabit-class throughput and production-grade availability

• Zero-setup browser access reduced setup time from hours to minutes and onboarding from days to hours

• Avoided an estimated 2 engineer-years of internal development while eliminating fragile OAuth2 Proxy dependencies

• Scaled to 6,000 licenses supporting 12,000 instances globally

Technical architecture:

• VM-based, multi-region deployment: Each 6-core VM supports approximately 15,000 routes

• Dynamic route management: Enterprise API drives ~100 daily route operations for ephemeral workspace provisioning

• Intelligent sharding: Clusters capability enables 4,000-5,000 routes per shard with geographic distribution

• Certificate automation: 500,000+ certificates managed without manual intervention

What's next?
The organization is prioritizing health endpoint APIs for cost-optimized hibernation, native SSH improvements, and OAuth 2.1-based gateway integration to standardize AI and agentic service access across their internal infrastructure.