When identities route around ZTNA, VPN, or firewall controls, security teams lose the visibility those tools provide for session monitoring, threat detection, and policy enforcement. That creates gaps in access history, data flow analysis, and response speed. The result is often delayed discovery of unauthorized activity, which can allow compromise, exfiltration, or persistence to continue unnoticed.
How bypassing network controls creates observability gaps
network access control only add value when traffic actually passes through them. If users, applications, or machine paths move around ZTNA, VPN, or perimeter filtering, the control plane stops seeing the full session, source, destination, and policy context that analysts rely on for investigation and enforcement. That means the organisation may still have connectivity, but it loses the record of how that connectivity was established and whether it was approved.
Those gaps matter because detection is not just about blocking traffic. Teams also need continuous visibility into access history, data movement, and session behaviour to spot misuse, correlate events, and prove that policy was applied consistently. The blind spot can be especially severe when identities use alternate paths that look legitimate from the network’s perspective but bypass the intended inspection or logging point.
- Session monitoring becomes incomplete, so anomalous duration, unusual geolocation, or unusual tool use may never be seen in one place.
- Data flow analysis weakens because east-west or direct-to-app traffic can evade the control that was expected to anchor telemetry.
- Policy enforcement becomes inconsistent when one access path is governed and another path is effectively ungoverned.
When the bypass is tied to access material rather than a one-off configuration issue, the visibility loss can persist until the credentials, tokens, or trust path are discovered and revoked. The broader NHI risk profile often appears first in the Ultimate Guide to NHIs, Key Challenges and Risks, where visibility gaps and overprivilege are treated as core failure modes, not edge cases. A related example is the SonicWall VPN Mass Breach via Stolen Credentials, which illustrates how access can be abused through a path that was supposed to improve control, not weaken it.
Why the blind spot becomes a security problem, not just a logging problem
Once the control plane loses sight of a session, the issue becomes one of dwell time and response speed. Unauthorized activity may continue long enough for exfiltration, persistence, or lateral movement to take place before anyone notices. That is why bypassing network access controls is not merely a design shortcut, it changes the defender’s ability to reconstruct the event and prove whether the access was legitimate.
The risk is amplified when organisations assume that a perimeter control is equivalent to a complete access control story. It is not. A network filter can enforce a path, but it cannot on its own guarantee identity assurance, session-level accountability, or complete audit coverage once alternative routes exist. For that reason, the control failure often surfaces later as an investigation gap, a containment delay, or a missed correlation between access and data movement.
Current NHI guidance also shows how often visibility is the weak point: NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts. That matters here because the same visibility problem that affects non-human access can also hide the bypass path itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST Zero Trust (SP 800-207) and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Visibility and Discovery | Bypassed access paths create the same visibility gaps this control addresses. |
| NHI-05 — Secrets and Credential Rotation | Bypass risk often persists while abused access material remains valid. | |
| NHI-06 — Least Privilege and Access Boundaries | Overbroad access makes it easier for identities to route around intended enforcement. | |
| Recommendation — Inventory all access paths and ensure every identity route produces central telemetry. Rotate exposed secrets quickly and invalidate any credential that can evade the intended control path. Constrain access so no identity can reach production paths beyond its minimum required scope. | ||
| CIS Controls v8 | CIS 6 — Access Control Management | Network bypasses weaken access enforcement and require tighter control of allowed paths. |
| CIS 8 — Audit Log Management | Blind spots arise when sessions are not logged where defenders expect. | |
| Recommendation — Restrict every access path to approved users, systems, and destinations. Centralize session and access logging so bypassed traffic still leaves an audit trail. | ||
| NIST Zero Trust (SP 800-207) | SC-7 — Boundary Protection | This subject is about defeating the assumed enforcement boundary and losing inspection coverage. |
| PE-3 — Policy Enforcement | Bypasses undermine the policy enforcement role that zero trust relies on. | |
| Recommendation — Place enforcement points so traffic cannot avoid inspection without detection. Ensure access decisions are enforced at every path rather than only at the perimeter. | ||
| MITRE ATT&CK | T1133 — External Remote Services | Attackers often abuse remote access paths to gain trusted entry and avoid perimeter visibility. |
| T1021 — Remote Services | Remote services are a common path for access that bypasses expected network scrutiny. | |
| Recommendation — Monitor remote access routes for anomalous use, abuse, and unauthorized persistence. Hunt for lateral movement and administrative activity over remote services. | ||
| NIST CSF 2.0 | DE.CM — Continuous Monitoring | Blind spots directly reduce the monitoring coverage needed to detect misuse. |
| Recommendation — Continuously monitor access paths so policy bypasses are visible quickly. | ||
Practitioner Guidance
What to verify: Treat every alternate access path as a telemetry decision, not just a routing decision. If users or workloads can reach an application without traversing the expected enforcement point, verify where session logs, policy decisions, and alerting are actually produced, and whether those records are still enough to reconstruct who accessed what, when, and from where.
What changes at scale: The more identities, apps, and third-party integrations you have, the easier it is for bypass paths to multiply quietly. At scale, the real question is not whether a network control exists, but whether it is still the authoritative place where access is observed and decided.
Practitioner takeaway: If a control can be bypassed, its main weakness is usually not denial of service, it is loss of trusted visibility and delayed response, so design access paths to preserve auditability even when traffic no longer stays on the intended network route.
Related resources from NHI Mgmt Group
- Why do non-human identities create blind spots in GitHub access governance?
- Why do network DLP controls create blind spots for modern endpoint data loss risk?
- When does just-in-time access reduce risk, and when does it create blind spots?
- Why do hybrid workforces create blind spots for AI security controls?
