VPNs and bastions create broad access and audit gaps

At a glance

What this is: Teleport argues that VPNs and bastion hosts struggle with modern infrastructure because they broaden access, depend on static credentials, and provide limited visibility.

Why it matters: IAM, PAM, and NHI teams need to treat infrastructure access as an identity problem, because oversized trust zones and weak auditability undermine both containment and compliance.

👉 Read Teleport's analysis of VPN and bastion access gaps in modern infrastructure

Context

Legacy VPNs and bastion hosts were built for static, on-premises environments, but cloud-native infrastructure changes too quickly for network-perimeter access patterns to keep up. The result is a growing mismatch between how access is granted and how modern systems are actually deployed, scaled, and retired.

For identity and access programmes, the issue is not just user friction. Broad network access, static credentials, and thin logging turn infrastructure access into an NHI governance problem, because the controls that once worked for fixed endpoints do not provide the same assurance for ephemeral resources, distributed teams, or multi-cloud estates.

Key questions

Q: What breaks when VPN and bastion access is used for cloud-native infrastructure?

A: They break when access is designed around stable networks instead of ephemeral workloads. In cloud-native environments, endpoints change often, so coarse network access creates configuration drift, broad trust zones, and fragile exceptions. The result is not just inconvenience. It is a governance model that cannot keep pace with how modern infrastructure is created, scaled, and retired.

Q: Why do static credentials create more risk than short-lived access tokens?

A: Static credentials create more risk because they remain valid until someone finds and removes them, which gives attackers a durable entry path. Short-lived tokens reduce exposure time, but they still need scope limits and revocation. The real control is the combination of short lifetime, least privilege, and continuous review.

Q: How do teams know whether unauthorized access controls are actually working?

A: Look for fewer standing credentials, lower lateral movement potential, and faster revocation when access is no longer needed. Good controls also reduce the number of identities that can reach sensitive systems without explicit approval. If access paths remain broad after a change, the control model is still too loose.

Q: What is the difference between basic log collection and session recording for privileged access investigations?

A: Basic log collection records discrete events, such as a login or command, but often leaves gaps in context. Session recording captures the full interaction as it happened, then indexes the activity for search and replay. For privileged access investigations, that difference matters because teams can see the sequence, timing, and exact user actions instead of reconstructing events from partial records.

Technical breakdown

Why VPN and bastion access breaks in cloud-native environments

VPNs and bastion hosts assume relatively stable endpoints and manually managed access paths. Cloud-native estates are different: instances, containers, and Kubernetes pods appear and disappear continuously, so IP-based or gateway-centric access models become brittle. Each change forces policy updates, configuration drift, and operational exceptions that expand risk. The architecture also struggles across hybrid and multi-cloud environments because the access layer sits outside the workload identity layer. That makes the control plane too coarse for modern infrastructure, where access needs to be bound to specific resources, not the network as a whole.

Practical implication: move from network-centric access assumptions to resource-specific identity controls for ephemeral infrastructure.

Static credentials and broad privileges enlarge the blast radius

VPN and bastion deployments typically rely on passwords, keys, and pre-shared secrets, then grant broad access after authentication. That combination creates a large attack surface because one compromised credential can expose many downstream systems. In NHI terms, this is a classic overprivileged identity pattern: the access grant is wider than the task requires, and the credential often lives longer than the business need. The article also points to delayed revocation for former employees, contractors, and third parties, which extends exposure windows and makes lateral movement easier once access is abused.

Practical implication: tie infrastructure access to least privilege and short-lived credentials rather than static secrets with network-wide reach.

Audit visibility is the difference between access and assurance

Basic VPN logs usually show that a session started, but not what happened inside it. Bastion logging can be better, but still leaves many organisations with fragmented evidence that is hard to correlate during investigations or compliance reviews. That is why session recording matters: it captures commands, resource access, and the sequence of actions taken during a session. In governance terms, the control gap is not just about monitoring. It is about proving who did what, against which resource, and whether the access path was consistent with policy. Without that traceability, compliance and incident response both become slower and less defensible.

Practical implication: require session-level evidence for infrastructure access, not just connection metadata.

Threat narrative

Attacker objective: The objective is to turn one compromised access path into broad internal reach and hard-to-investigate access across infrastructure.

1. Entry begins when attackers abuse exposed VPN vulnerabilities, weak bastion controls, or stolen static credentials to obtain valid access to the access layer.
2. Escalation follows when broad network permissions let that access reach more systems than the original task required, creating room for lateral movement.
3. Impact occurs when the attacker uses that wide trust zone to reach sensitive infrastructure, abuse secrets, or evade meaningful audit detection.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Broad network access is the wrong unit of control for modern infrastructure. VPNs and bastions were designed around the assumption that access can be granted to a network zone and safely narrowed later. That assumption fails when workloads are ephemeral and endpoints change constantly. The implication is that access governance has to shift from perimeter reach to resource-specific identity policy.

Static credentials create governance debt that accumulates faster in distributed environments. Passwords, keys, and pre-shared secrets are not just harder to rotate at scale; they also make revocation dependent on humans noticing and acting in time. That creates a standing exposure window for contractors, third parties, and former staff. Practitioners should treat credential lifecycle as the control boundary, not an afterthought.

Visibility is not a reporting feature, it is an access control requirement. When sessions are only partially logged, organisations cannot reliably reconstruct what access was used for or whether it stayed within policy. That is why auditability, session recording, and resource-level traceability belong in the same control conversation as authentication and authorisation. Practitioners should design infrastructure access so that every privileged action leaves a usable record.

Ephemeral access, not persistent reach, is the correct security model for cloud infrastructure. The article reinforces a broader shift already visible across IAM and NHI programmes: access needs to be short-lived, task-scoped, and bound to identity rather than network position. The practical conclusion is that modern infrastructure governance should optimise for narrow, inspectable, and revocable access paths.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Static vs Dynamic Secrets

What this signals

Static credentials are the hidden fault line in infrastructure access: when passwords and keys remain in circulation, access governance becomes slower to revoke, harder to audit, and easier to abuse. That is why short-lived certificates and explicit session boundaries matter more than perimeter convenience for cloud-native estates.

Auditability is now part of the access decision, not a separate reporting layer: programmes that cannot reconstruct commands, resource access, and session scope are operating with incomplete control evidence. For practitioners, the question is whether infrastructure access produces enough artefact detail to support incident response and compliance at the same time.

For practitioners

• Replace network-wide access with resource-scoped identity policy Map each infrastructure access path to a specific role, resource, and time-bound entitlement so users do not inherit broad network reach after authentication.
• Phase out static credentials for infrastructure access Inventory passwords, SSH keys, pre-shared keys, and other long-lived secrets used by VPN and bastion workflows, then prioritise the paths that still grant broad internal access.
• Enforce short-lived access for privileged sessions Use ephemeral certificates or equivalent short-lived credentials so infrastructure access expires automatically when the task ends rather than relying on manual revocation.
• Require session-level audit evidence Capture commands executed, resources accessed, and session context so investigations and compliance reviews can reconstruct privileged activity without relying on connection logs alone.

Key takeaways

• Legacy VPNs and bastions create governance gaps because they were built for stable networks, not ephemeral infrastructure.
• Static credentials and broad network permissions widen the blast radius when access is compromised or misused.
• Short-lived identity-bound access with full session evidence is the control pattern that best fits modern infrastructure.

Key terms

• Ephemeral Access: Ephemeral access is permission that exists only for the duration of a specific task or session. For agents, it reduces the lifetime of credentials and limits blast radius if a workflow is abused or misrouted. The control is only effective when issuance, expiry, and revocation are enforced automatically.
• Static Credential: A static credential is a long-lived secret such as an API key, password, token, or certificate that exists outside the moment of use. It creates persistent attack surface because it can be copied, stored, reused, and exposed across code, pipelines, configuration files, and third-party environments.
• Bastion Host: A bastion host is an intermediary system used to reach protected internal resources. It centralises entry but also concentrates trust and availability risk, which means the design only works well when logging, offboarding, and recovery are tightly controlled.
• Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.

What's in the full article

Teleport's full blog post covers the operational detail this post intentionally leaves for the source:

• Concrete examples of how VPNs and bastions slow distributed teams working across cloud environments
• The platform-side explanation of how identity-authenticated access replaces static credentials
• More detail on session recording, compliance reporting, and how access events are logged
• The vendor's comparison of direct resource access across SSH, Kubernetes, databases, and web apps

👉 Teleport's full post shows how ephemeral access, session recording, and zero trust controls are positioned against legacy VPN and bastion models.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.