VPN replacement is now an identity governance decision

At a glance

What this is: This analysis argues that VPN replacement has shifted from a connectivity choice to an identity governance decision because attack patterns, vulnerability volume, and Zero Trust guidance now treat implicit network trust as a liability.

Why it matters: For IAM and security teams, the issue is no longer whether users can reach internal resources, but whether access is still governed at the identity, device, and session level once the network tunnel is established.

Context

VPN replacement is the governance question hidden inside remote access strategy. Once a network tunnel becomes the primary trust decision, the organisation is no longer evaluating only connectivity, but also whether identity, device posture, and session scope are being enforced after access is granted.

The article ties that question to two pressures at once: attacker behaviour is concentrating on VPN appliances and static credentials, while federal Zero Trust guidance is pushing organisations toward assume-breach thinking and granular access controls. That combination makes VPN dependence a programme-level decision, not a networking preference.

For NHI Mgmt Group, the important shift is that remote access now has to be judged by who and what is being authorised, not by whether the tunnel works. If the access path itself flattens trust, the rest of the identity programme inherits the risk.

Key questions

Q: What breaks when VPN access is granted once at the edge and then trusted across the network?

A: A single successful login becomes a standing network foothold. That breaks the assumption that authentication at the perimeter is enough to keep users safe after the first check. When the session is accepted broadly, any bypass or stolen token can expose more systems than the original application intended, which is why edge trust creates oversized blast radius.

Q: Why do VPN gateways increase breach risk in modern environments?

A: VPN gateways increase breach risk because they combine internet exposure, authentication, and patch timing in one high-value target. A single weakness can yield credential abuse, authentication bypass, or remote code execution, and the resulting session may look legitimate even when the gateway has been compromised.

Q: What do security teams get wrong about replacing VPNs with ZTNA?

A: Teams often assume that changing the access technology automatically changes the trust model. In practice, a ZTNA deployment can still preserve static rules, broad exceptions, or weak session governance if policy design is not tightened. The real test is whether access is scoped to the minimum resource and can change as risk changes.

Q: What should remote access teams prioritise after a major VPN vulnerability?

A: Remote access teams should prioritise inventory, exposure reduction, and entitlement review before they focus on cosmetic migration work. If the vulnerable gateway still defines who can reach internal resources, then patching alone leaves the underlying trust model intact and the organisation remains dependent on the same attack surface.

Technical breakdown

Why VPNs flatten identity controls

Traditional VPNs authenticate a user at the edge and then extend broad network reach inward. That model makes the network location look like trust, which is convenient operationally but weak as a security decision because the access boundary is much larger than the application actually needed. Once connected, lateral movement becomes easier because the tunnel often behaves like an internal foothold rather than a tightly scoped entitlement. The governance problem is not encryption, it is scope: the access decision happens once, then persists across a wide set of resources. In identity terms, this is a coarse-grained model that does not preserve least privilege after entry.

Practical implication: replace network-wide entitlement assumptions with application-scoped access decisions.

How ZTNA changes the authorisation model

Zero Trust Network Access changes remote access from network membership to application authorisation. Instead of treating connectivity as proof of trust, ZTNA authenticates the user, evaluates device posture and context, and grants access only to the specific service being requested. That approach aligns with the Zero Trust principle of continuous verification because the session remains tied to identity and risk signals, not to a blanket tunnel. In practice, this reduces blast radius by ensuring a user never becomes broadly present on the internal network. For IAM, the important distinction is that policy moves from the perimeter to the entitlement decision itself.

Practical implication: enforce per-application access decisions instead of broad tunnel-based reach.

Why edge and VPN appliances stay in the attack path

VPN gateways sit at the intersection of internet exposure, identity authentication, and patch timing. That makes them attractive because a single flaw can yield authentication bypass, remote code execution, or a durable foothold before defenders can fully remediate. The article’s reference to high volumes of CVEs shows why this is not a one-off issue but a recurring exposure pattern, especially where appliances are slow to patch or hard to replace. The technical risk is amplified when remote access depends on static credentials or long-lived trust in the gateway itself. In other words, the appliance becomes both the gate and the target.

Practical implication: treat edge devices as high-risk trust anchors and reduce dependence on them where possible.

Threat narrative

Attacker objective: The attacker seeks a foothold that converts external internet access into broad internal reach, enabling lateral movement and breach expansion.

1. Entry begins when attackers target VPN gateways and exposed remote access portals, using credential spraying, authentication bypass, or appliance vulnerabilities to reach the edge.
2. Credential access or trust abuse follows when static credentials, weak access controls, or a compromised gateway let the attacker establish a valid-looking session.
3. Escalation occurs when the tunnel grants broad internal reach, turning a remote login into lateral movement opportunity across flat networks and internal services.
4. Impact is the expansion of breach scope, because the attacker can move beyond the access gateway into internal systems that were assumed to be protected by the VPN boundary.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VPN replacement is an identity governance decision, not a transport decision: The article is right to frame remote access as a governance problem because the tunnel itself becomes an authorisation boundary. When the boundary is coarse, the identity programme inherits broad reach, weak session containment, and poor blast-radius control. Practitioners should stop treating VPN migration as infrastructure refresh and instead evaluate what identity control is actually being preserved at the point of access.

Implicit network trust is the broken premise: VPN design was built for a condition where network location could stand in for trust. That assumption fails when attackers routinely weaponise edge devices, stolen credentials, and appliance flaws to gain the same connectivity as legitimate users. The implication is that access governance must move from network membership to per-resource entitlement and continuous verification.

Remote access scope is now the real control surface: The important distinction is not VPN versus ZTNA as products, but whether the organisation can limit what a remote identity reaches after authentication. A broad tunnel enlarges lateral movement potential even when authentication is strong. Practitioners should treat scope reduction as the primary control objective, because that is where breach containment now lives.

Edge appliances are a governance liability when they become trust anchors: The article’s vulnerability and policy references point to a structural problem, not a patching problem alone. When remote access depends on ageing perimeter devices, the organisation also depends on patch windows, credential hygiene, and appliance hardening that attackers can pressure faster than teams can respond. The implication is that governance has to account for the device as part of the identity control path.

Zero Trust expectations are now shaping remote-access accountability: Federal guidance is moving from abstract principle to operational expectation, which means VPN dependence increasingly needs to be justified against assume-breach and granular access goals. That changes the decision calculus for IAM, PAM, and security architecture teams alike. The practitioner conclusion is simple: remote access design now sits under identity governance scrutiny, not just network architecture review.

What this signals

Remote access scope is the governance variable that matters now: The real question is not whether a VPN exists, but whether the organisation can still prove that remote users only reach the applications they need. Where the tunnel is broader than the entitlement, the identity programme has already lost precision.

Zero Trust is changing the baseline for remote access design: Federal guidance and attacker behaviour are now moving in the same direction, which means broad network reach will be harder to justify in audits and architecture reviews. Security teams should expect more pressure to demonstrate continuous verification and resource-level access decisions.

VPN dependency creates policy debt: Every exception that keeps broad tunnel access alive adds more inherited trust to the programme. That debt shows up later as slower incident containment, weaker segmentation, and more expensive migration when the organisation eventually has to unwind it.

For practitioners

• Define remote access by entitlement scope Map every VPN use case to the minimum application set it actually needs and identify where broad tunnel access persists after authentication.
• Inventory edge trust anchors List VPN gateways, concentrators, and other perimeter devices that still act as primary trust boundaries, then classify which business flows depend on them.
• Enforce identity and device context before access Require authentication, device posture checks, and contextual policy evaluation before any remote session can reach internal services.
• Reduce standing network reach Replace all-or-nothing network access with application-level entitlements so remote users never receive more internal visibility than their role requires.
• Align remote access with Zero Trust guidance Document whether your current remote access model meets assume-breach, continuous verification, and granular access expectations now emerging from federal guidance.

Key takeaways

• VPN replacement is now an identity governance problem because the tunnel itself determines how much trust a remote user receives after authentication.
• The article ties the shift to concrete pressure points, including more than 21,500 CVEs by mid-2025 and a growing share of edge and VPN appliance exposure.
• Teams should move remote access decisions from network membership to application-level entitlements and continuous verification.

Key terms

• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• Remote Access Entitlement: A remote access entitlement is the permission that allows a user or device to reach internal resources from outside the network. In practice, it should be owned, scoped, reviewed, and revoked like any other access right, because stale entitlements quickly become hidden entry points.
• Edge device exposure window: The edge device exposure window is the period between disclosure of a flaw in an internet-facing system and the point at which defenders can safely contain it. For VPNs, gateways, and similar services, that window can be extremely short, so segmentation, restriction, and emergency response paths become part of the control model.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.