VPNs and bastions create broad access and audit gaps

At a glance

What this is: This article argues that VPNs and bastion hosts no longer fit modern infrastructure because they create friction, broad privileges, operational overhead, and weak auditability.

Why it matters: It matters because infrastructure access is now an identity problem, and IAM, PAM, and NHI teams need controls that reduce standing access rather than wrap legacy network paths.

By the numbers:

• 56% of organisations experienced cyberattacks leveraging VPN vulnerabilities in the past year.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.

👉 Read Teleport's analysis of VPN and bastion limitations for modern infrastructure

Context

VPNs and bastion hosts were built for a world of stable networks and relatively fixed infrastructure. In cloud-native environments, where servers, containers, and Kubernetes pods appear and disappear constantly, those models depend on broad trust zones and manual administration that do not match the pace of modern identity governance.

For IAM and NHI programmes, the real issue is not just connectivity. It is how access is authenticated, scoped, logged, and revoked when identities, endpoints, and workloads are dynamic. Once access patterns rely on static credentials and network reach, the programme inherits both operational drag and a wider breach surface.

That is why infrastructure access has become a governance problem as much as a networking one. The article frames the case for short-lived, identity-bound access as an alternative to persistent VPN and bastion trust, and that is a typical pressure point for teams modernising hybrid and multi-cloud access.

Key questions

Q: How should security teams replace VPN access without creating new operational gaps?

A: They should start by identifying which resources actually need reachable access, then move to identity-bound, resource-scoped sessions with short-lived credentials. The transition works when access is tied to the task and can be revoked cleanly, while audit logs preserve evidence for investigation and compliance.

Q: Why do VPNs and bastions increase lateral movement risk?

A: Because they often grant broad network-level access once a user authenticates, so one stolen credential can open many internal paths. That expands the blast radius far beyond the original task and makes the environment easier to traverse if the access channel is compromised.

Q: How do organisations know whether their access management controls are actually working?

A: Look for three signals: fewer unneeded entitlements, faster removal of access after role or employment changes, and a lower number of review exceptions left unresolved. If approvals happen but permissions do not change, the programme is producing process activity, not governance outcomes.

Q: Who is accountable when a bastion or VPN credential is abused?

A: Accountability usually sits with the team that owns credential lifecycle, access scope, and audit logging, not just the user who triggered the session. Governance frameworks such as NIST CSF and ISO 27001 expect traceable access control and evidence of review, so ownership must be explicit.

Technical breakdown

Why VPN and bastion models fail in cloud-native environments

VPNs and bastion hosts assume relatively stable endpoints and a small set of predictable network paths. Cloud-native infrastructure breaks that assumption because resources are ephemeral, distributed, and often multi-cloud. Every change in IP, cluster, or workload topology increases configuration churn and makes perimeter-style access harder to govern. The result is not only friction but also a higher probability of stale routes, inconsistent policy enforcement, and access paths that outlive the systems they were meant to protect.

Practical implication: move away from network-centric access paths where topology changes faster than policy can be maintained.

Why static credentials expand the attack surface

VPNs and bastions commonly rely on passwords, SSH keys, and other long-lived secrets that must be rotated, revoked, and distributed across users and contractors. That creates a lifecycle burden because any delay or omission leaves reusable credentials in circulation. In practice, the access model is broader than the task requires, which increases the risk of lateral movement if a secret is stolen. This is a classic NHI governance problem because the credential, not the person, often becomes the durable trust anchor.

Practical implication: treat credential lifecycle and scope as the control plane, not as an afterthought.

How audit visibility changes the compliance equation

A VPN connection log usually tells you that a session started and ended, but not what the user actually did inside the session. Bastions can improve that slightly, yet many still stop short of durable command-level evidence across all paths. Modern infrastructure access needs session recording, command attribution, and integration into SIEM workflows so investigators can reconstruct activity and prove control operation. Without that, compliance becomes a partial story built from fragmented logs.

Practical implication: require access telemetry that supports forensic reconstruction, not just connection confirmation.

Threat narrative

Attacker objective: The attacker aims to turn one compromised access path into broad internal reach with poor detection and limited traceability.

1. Entry occurs through exposed VPN or bastion credentials that grant broad access into the internal environment.
2. Escalation follows when the reused or stolen credential provides network-level reach beyond the task the user actually needed.
3. Impact emerges as an attacker moves laterally to other systems, abuses weak audit coverage, and hides activity inside a trusted access channel.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Broad network access is the wrong control model for modern infrastructure. VPNs and bastions were designed to extend trust across a network, but cloud-native infrastructure is built from transient resources that should not inherit persistent reach. That mismatch turns access into a perimeter problem when it is now an identity problem. The practical conclusion is that access should be resource-scoped, time-bound, and tied to the actual task boundary.

Static credentials create trust debt that compounds over time. Passwords, SSH keys, and shared bastion credentials survive far longer than the session they were meant to support. That gives attackers a reusable foothold and gives defenders a lifecycle problem, not just an authentication problem. The governance lesson is that credential persistence is itself a source of risk concentration.

Identity blast radius is the real measure of access quality. Once a VPN grants broad network reach, compromise of one credential can expose far more than the intended server or database. This is where least privilege becomes operational rather than theoretical, because the control is only meaningful if it limits lateral movement as well as initial access. Practitioners should measure how much of the environment a single access event can touch.

Visibility is not an add-on, it is part of the access control itself. If the access path cannot produce command-level evidence and durable session records, then compliance, incident response, and post-incident review all depend on inference. That creates a governance gap between policy and proof. Teams should treat auditability as a first-class requirement for infrastructure access design.

Short-lived certificates align better with task-scoped trust than network tunnels do. Identity-authenticated access narrows the window in which credentials can be abused and makes revocation more meaningful. That does not eliminate risk, but it shifts the control point from static perimeter connectivity to governed access events. The implication is that infrastructure teams need identity controls, not just secure transport.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have already endured a successful cyberattack resulting from compromised non-human identities, which shows how quickly access governance failures become operational incidents.
• For a deeper view of NHI breach patterns, see MongoBleed breach and Guide to the Secret Sprawl Challenge.

What this signals

Identity-bound infrastructure access will keep replacing perimeter access as cloud estates expand. The governance pressure is moving from network reach to session control, because teams can no longer assume that stable IPs or fixed bastions define safe access boundaries. Practitioners should expect stronger demand for short-lived certificates, finer-grained policy, and better session evidence across hybrid estates.

Identity blast radius should become a programme metric. If a single access path can touch too many resources, the problem is not just technical exposure, it is governance overreach. Teams that can quantify blast radius, credential lifetime, and session traceability will be better positioned to justify modern access controls.

As access becomes more dynamic, the audit trail must become more complete. Infrastructure teams should align access logging with NIST Cybersecurity Framework 2.0 and the control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, because compliance evidence now needs to show what happened inside the session, not just that the session began.

For practitioners

• Inventory all persistent infrastructure access paths Map every VPN, bastion, and shared jump path to the systems it can reach, then rank them by breadth of access and credential lifetime. Focus first on routes that still depend on passwords, long-lived SSH keys, or manual offboarding.
• Replace network-wide reach with resource-scoped access Use role-based policies that limit access to specific clusters, servers, or databases instead of granting broad network entry. The goal is to reduce lateral movement opportunities if a credential is exposed.
• Shorten the credential lifecycle for infrastructure access Move toward short-lived certificates and explicit revocation workflows so access expires with the task, not the account. Make rotation and revocation operationally visible so contractors and former users do not retain dormant trust.
• Require session evidence for privileged access Capture command-level logs and session recordings for all elevated infrastructure access, then route them into SIEM for alerting and review. Connection logs alone are insufficient for investigation or compliance proof.

Key takeaways

• VPNs and bastions create an oversized trust zone that modern cloud infrastructure no longer needs.
• Static credentials, broad access, and weak audit trails turn infrastructure access into a repeatable identity risk.
• Resource-scoped, short-lived access with session-level evidence is now the governance baseline for secure infrastructure access.

Key terms

• Identity-bound access: Access that is issued to a specific human, workload, or agent and can be traced back to that identity in logs and audit evidence. In NHI governance, this is the difference between knowing a credential was used and knowing exactly who or what performed the action.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Short-Lived Certificate: A short-lived certificate is a time-bound credential that expires automatically after a limited window of use. For NHI governance, it reduces dependence on long-lived secrets and shifts the control problem toward issuance policy, renewal, and session auditing rather than manual rotation.
• Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.

What's in the full article

Teleport's full blog covers the operational detail this post intentionally leaves for the source:

• Direct comparison of VPN and bastion workflows across SSH, Kubernetes, databases, and web applications
• Platform-specific explanation of how short-lived certificates and session recording are implemented in practice
• Vendor walkthrough of audit logging and SIEM integration details for infrastructure access monitoring
• Additional examples of how distributed teams experience latency, maintenance overhead, and access friction

👉 Teleport's full post covers the access model comparison, audit capabilities, and zero trust mechanics in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.