Modern software development moves fast, driven by distributed teams, external contractors, and the rapid rise of AI coding agents. Yet, providing engineering teams with secure, high-performance environments remains a major challenge. Shipping and maintaining high-end laptops creates heavy overhead and endpoint risk, while traditional Virtual Desktop Infrastructure (VDI) rarely aligns with modern DevOps toolchains and platform engineering workflows.
To bridge this gap, Citrix has announced Citrix SecurSpaces™ Flex, a fully Citrix-managed service within Citrix Platform Flex. SecurSpaces Flex delivers turnkey, containerized Linux workspaces hosted directly on Microsoft Azure, eliminating infrastructure maintenance while keeping data, identity, and security strictly under customer governance.
Citrix SecurSpaces Flex is designed around operational simplicity, strong data protection, and modern developer flexibility. Key benefit areas include:
Lightened IT & Operational Overhead: Citrix operates and maintains the entire control plane on Azure Kubernetes Service (AKS) and Azure Cosmos DB, including zero-downtime updates, infrastructure scaling, and monitoring. IT and platform engineering teams avoid managing databases and clusters, freeing them to focus on workspace templates, tooling, and governance.
Zero Endpoint Risk & Secure AI Sandboxing: Source code, access tokens, and sensitive data remain strictly inside isolated cloud workspaces and never touch local machines. Workspaces enforce granular Role-Based Access Control (RBAC), native Data Loss Prevention (DLP), network ingress/egress filtering, and audit logging. This architecture also establishes safe execution boundaries for agentic development, allowing AI coding tools to run in sandboxed environments without risking lateral network movement or data leakage.
Flexible, Right-Sized Developer Experience: SecurSpaces Flex completely decouples the workspace template (the container image and installed toolchains) from the workspace size (the compute profile). Developers can instantly connect to identical setups using their preferred tools, including browser-based Progressive Web App (PWA) IDEs, terminal sessions, or local editors via SSH (e.g., VS Code, JetBrains Gateway, Cursor, Windsurf). Compute power can be scaled dynamically between Light, Medium, and Heavy profiles to match workloads like heavy compilations.
Predictable Spend with Platform Flex Credits: Workspaces consume credits from the unified Citrix Platform Flex pool based on daily active usage and compute tier. This shared credit model covers multiple services (such as Citrix DaaS Flex and SecurSpaces Flex), enabling organizations to dynamically allocate resources to developers and contractors without navigating complex procurement cycles.
While both solutions provide containerized, zero-trust development workspaces, they operate on different deployment models:
| Capability / Dimension | Citrix SecurSpaces (Customer-Managed) | Citrix SecurSpaces Flex (Citrix-Managed SaaS) |
|---|---|---|
| Hosting Infrastructure | Customer-managed cloud or on-premises Kubernetes (EKS, AKS, OpenShift, etc.) | Fully Citrix-managed Azure infrastructure with dedicated regions |
| Platform Operations | Customer manages control plane, databases, scaling, and patching | Citrix manages control plane, backend Cosmos DB, scaling, and platform upgrades |
| Licensing Model | Traditional software licensing plus customer-incurred underlying infrastructure compute costs | Unified Citrix Platform Flex consumption credits based on daily workspace size usage |
| Provisioning Speed | Requires time to architect and provision Kubernetes clusters, databases, and ingress | Turnkey deployment pre-architected and maintained by Citrix for rapid onboarding |
| Compute Scaling | Dependent on customer Kubernetes cluster nodes and autoscaling policies | Dynamic switching between predefined tiers (Light, Medium, Heavy) per day based on workload |
| Workspace & Policy Control | Full customer ownership over images, network policies, and identity integrations | Customer maintains full ownership of images, policies, Git integrations, and SSO |
| Target Use Case | Organizations with strict data residency mandates or custom private cloud requirements | Modern, distributed teams seeking immediate time-to-value and low operational burden |
Transitioning to a new developer operating model requires strategic alignment between engineering, security, and IT architecture. As a Citrix Preferred Services Partner, Altanora provides the specialized expertise to seamlessly integrate Citrix SecurSpaces Flex into your broader enterprise ecosystem.
Our team helps organizations navigate this transition by focusing on three core pillars:
Mapping Developer Personas: We analyze your engineering team's workflows to appropriately align developer and AI agent needs with the correct Light, Medium, or Heavy compute profiles, optimizing your Platform Flex credit consumption right out of the gate.
Designing Secure Network Architectures: SecurSpaces Flex requires shared Azure vNET peering or VPN gateways to connect the Citrix-managed Azure tenant to your internal systems. We engineer this critical integration layer, ensuring your new workspace securely connects to existing VMware infrastructure, private clouds, on-premises Git repositories, CI/CD pipelines, and secrets managers.
Unifying the Digital Workspace Strategy: Whether you are expanding your cloud portfolio with Citrix DaaS or transitioning legacy infrastructure, we help consolidate your environments under the unified Citrix Platform Flex umbrella. This ensures developers receive high-performance Linux environments for coding while utilizing lightweight desktops for standard collaborative tasks, all managed efficiently through a single credit model.
It is a fully Citrix-managed service, hosted on Microsoft Azure, that provides secure, containerized Linux workspaces for development teams and AI agents. It falls under the Citrix Platform Flex umbrella, meaning there is no customer infrastructure to stand up or maintain.
In a traditional Citrix SecurSpaces architecture, the customer is responsible for maintaining the underlying Kubernetes infrastructure, databases, and control plane. With SecurSpaces Flex, Citrix manages the Azure infrastructure, Azure Kubernetes Service (AKS) control plane, and Azure Cosmos DB. However, organizations still retain complete governance over their identity providers, workspace templates, policies, and data.
No, developers have the flexibility to work exactly how they prefer. Workspaces can be accessed via a browser using a PWA-based IDE or terminal. Alternatively, developers can connect via SSH using their local IDEs, such as VS Code, JetBrains Gateway, Cursor, or Windsurf.
Compute profiles are right-sized by persona and completely decoupled from the workspace template. A single template can be dynamically paired with three specific compute sizes based on immediate demand: Light (2 vCPUs, 8 GB RAM, 32 GB Storage) for general coding, Medium (4 vCPUs, 16 GB RAM, 64 GB Storage) for mixed workloads, and Heavy (8 vCPUs, 32 GB RAM, 128 GB Storage) for large builds, compilations, and data-heavy workloads.
The Citrix-managed Azure tenant connects directly to your customer-owned systems through a shared Azure virtual network (vNET) peering or a VPN gateway. This securely bridges the isolated workspaces to your existing Git repositories, CI/CD pipelines, artifact repositories, secrets managers, and internal identity providers.
Yes, it provides sandboxed execution environments specifically designed for AI coding agents, operating under the exact same control plane used for human developer sessions. This ensures that AI agents can operate productively while strictly adhering to compliance policies and zero-trust boundaries.
The service ensures that source code, data, and access tokens never reside on a developer's local machine. The environment includes native Data Loss Prevention (DLP), role-based access control (RBAC), controlled network ingress and egress, and full audit logging to guarantee absolute isolation.
The service uses the unified Citrix Platform Flex credit model, with each workspace size mapped to a published daily credit rate. Because usage is tracked daily, a developer can run a light workspace for standard tasks and switch to a heavy profile only when necessary, drawing from the same shared pool used for other solutions like Citrix DaaS Flex.
Modernizing developer workspaces does not require an all-or-nothing migration. Organizations can adopt Citrix SecurSpaces Flex incrementally, starting with high-value use cases such as external contractor onboarding, rapid laptop replacement, or sandboxed AI developer workflows.
By offloading the complexity of hosting and platform maintenance to Citrix, engineering and security teams can ensure developer productivity remains high while maintaining absolute control over company IP.
As a Citrix Preferred Services Partner that regularly collaborates with Citrix executive leadership on advanced enterprise architectures, from Post-Quantum Cryptography to zero-trust network access, Altanora has the deep expertise required to design and deploy your optimal developer environment.
Ready to modernize your development environment? Reach out to the Altanora engineering team to schedule a SecurSpaces Flex architecture assessment.