Traditional VPN risk is outpacing hybrid access governance

At a glance

What this is: Appgate argues that traditional VPNs no longer fit hybrid access patterns because broad network access, patch churn and end-of-life exposure expand risk.

Why it matters: This matters because IAM and security teams need access models that constrain privilege by identity and context, not just by network connection.

Context

Traditional VPNs were designed for a different operating model, when remote access was the exception and the network perimeter still did most of the control work. In hybrid environments, that model breaks down because authentication often grants broad reach rather than a tightly bounded entitlement, which creates a governance gap for both human users and the non-human services that now depend on remote access paths.

The article frames this as an access governance problem, not just a remote connectivity problem. That matters for IAM, PAM and NHI programmes because once access is established through a VPN, the control boundary shifts away from identity and toward the network, making least-privilege enforcement and lateral movement containment much harder to sustain.

Key questions

Q: What breaks when organisations rely on VPNs for modern remote access?

A: VPNs tend to extend network trust more broadly than modern risk models allow. In distributed environments, that can expose too much of the internal network once a user connects, especially when personal devices and cloud applications are involved. Browser-mediated access narrows the trust boundary to the session rather than the network.

Q: Why do legacy VPN models create compliance risk?

A: Legacy VPNs often grant broad connectivity after a single login event, which makes it hard to prove least privilege, segmentation, and continuous enforcement. They can also leave unpatched or unmanaged devices trusted for the full session, creating both security exposure and audit gaps.

Q: What are the signs that permissive remote-access policies have become a hidden risk?

A: A clear sign is when temporary remote-access exceptions remain in place long after the reason for them has passed. Teams should watch for relaxed VPN rules, expanded server reachability, and network policies that were changed for continuity but never reviewed. If no one can quickly name which controls were loosened, or when they will be restored, the organisation is carrying avoidable risk.

Q: What should teams do when VPN access and zero trust overlap?

A: Treat VPN as a transport layer, not as a trust decision. Access should still be explicitly authorized based on identity, session context, and resource sensitivity. If the VPN becomes the reason access is allowed, the zero trust model has not actually replaced perimeter trust.

Technical breakdown

Why VPN authentication creates an access boundary problem

A VPN typically authenticates a user or device and then places that session inside a trusted network zone. The problem is not authentication itself, but the scope that follows it: the tunnel often grants more internal reach than the user actually needs. In hybrid environments, that broad trust boundary makes segmentation, entitlement scoping and continuous authorization much harder than identity-native access models. For service accounts, contractors and administrators, the control issue is not just whether they can connect, but what they can reach once connected.

Practical implication: replace network-level trust with identity-scoped access rules that limit each session to specific resources and actions.

Patch dependency and end-of-life risk in remote access stacks

Legacy VPN estates create a recurring maintenance cycle because new vulnerabilities often demand urgent patching, testing and redeployment before exposure closes. That is manageable only when the access layer is small, modern and well-supported. Once the platform reaches end-of-life, organisations face a second problem: even when patches exist, support, compatibility and change windows become fragile. The result is an exposure window that adversaries can exploit while defenders are still coordinating response and recovery.

Practical implication: treat VPN replacement as a lifecycle-risk programme, not a product refresh, and prioritise systems approaching end-of-life.

Why zero trust access changes the governance model

Zero Trust Network Access changes the model by making access conditional on identity, context and explicit authorization rather than location on the network. This matters because it reduces the blast radius of a compromised account or device, and it gives governance teams a better fit for third-party, contractor and workload access. In practice, the control shifts from 'inside means trusted' to 'authenticated, authorised and continuously evaluated', which is a far better match for hybrid work and distributed applications.

Practical implication: design remote access policies around explicit resource authorization and continuous evaluation, not on-premises network membership.

Threat narrative

Attacker objective: The attacker aims to convert a single remote access session into broad internal reach that supports lateral movement and operational disruption.

1. Entry occurs through a trusted VPN connection that gives the attacker a foothold inside the internal trust zone.
2. Escalation follows because the VPN tunnel exposes more internal resources than the session actually requires, enabling lateral movement.
3. Impact is broader network reach, faster movement across systems, and greater difficulty containing compromise once the access path is established.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VPN governance is now an identity problem, not a connectivity problem. The core weakness is not encrypted transport, but the oversized trust granted after authentication. In hybrid environments, that creates a mismatch between the access path and the entitlement model, which is why IAM and PAM teams need to treat remote access as part of identity governance rather than as a separate network control.

End-of-life remote access technology creates governance debt. When a VPN platform depends on constant emergency patching, the organisation has already accepted a fragile control model. That fragility matters because the operating cost of maintaining exposure windows is paid in analyst time, change risk and residual attack surface, not just in software support contracts.

Zero Trust becomes the practical control language for third-party and workload access. The article’s strongest signal is that broad network access is no longer compatible with modern access patterns, especially when third parties and service identities are involved. The more access is scoped by identity and context, the less likely one compromise is to become a lateral-movement event.

Traditional VPNs create a standing reach problem. The named failure mode is persistent internal reach after a one-time authentication event. That pattern is especially dangerous in hybrid access governance because it assumes the network perimeter can still absorb trust decisions that now belong at the identity layer. Practitioners should interpret this as a signal to remove broad post-authentication reach wherever possible.

Modernisation is about resilience, not tool substitution. The operational lesson is that patching faster will never fully compensate for a control model that grants too much by default. A better access architecture reduces the number of crisis moments teams must absorb, which is the real governance dividend.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Standing reach is the real VPN problem. Once a session lands inside the network, the access model often outlives the actual task. That creates a control mismatch for identity teams because entitlement decisions are being made implicitly by topology rather than explicitly by policy.

Hybrid access programmes should treat third-party and contractor connectivity as a governance boundary, not just a secure tunnel. That is where identity-scoped access, session constraint and revocation discipline matter most, especially when external users share infrastructure with core business systems.

Zero Trust Network Access is becoming the more coherent access pattern for distributed estates. It does not eliminate risk, but it moves enforcement to the point where identity, device context and resource authorization can be evaluated together. For practitioners, that is a cleaner foundation than hoping patch velocity keeps pace with exposure.

For practitioners

• Inventory VPN-dependent access paths Map which users, contractors, service accounts and admin workflows still rely on VPN entry, and classify the resources each path can reach today.
• Shrink post-authentication reach Replace broad tunnel-based reach with resource-specific authorization so each session only exposes the applications, data sets or management planes it actually needs.
• Prioritise end-of-life remediation Create a migration plan for remote access platforms nearing end-of-support, including risk acceptance thresholds and scheduled replacement milestones.
• Add continuous access checks Require context-aware re-evaluation for high-risk sessions so access can be narrowed when device posture, location or role changes mid-session.

Key takeaways

• Traditional VPNs still assume that network placement is a trustworthy signal, and that assumption no longer holds in hybrid environments.
• Patch dependency and end-of-life exposure turn remote access platforms into recurring operational risk, not just deployment choices.
• Identity-scoped access and continuous evaluation reduce lateral movement risk far more effectively than broad tunnel-based trust.

Key terms

• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• End-of-Life Risk: End-of-life risk is the exposure created when a system is no longer supported by the vendor but remains in production. It often forces organisations into fragile maintenance patterns, delayed patching, and exception-based risk acceptance that weaken overall security posture.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Intent-Scoped Access: Intent-scoped access is permissioning that is tied to what an AI agent is meant to do, not to the broader role of the human who created it. The model narrows privilege to the task, which is essential when non-human identities can act without direct human review.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need stronger control over identity, privilege and access governance across modern environments.