Why VPN-based remote access is failing modern identity governance

At a glance

What this is: This is an editorial analysis of why VPNs and edge appliances have become frontline attack surfaces, and the key finding is that network-based access models no longer match how remote work and adversaries operate.

Why it matters: It matters because IAM, PAM, and NHI programmes all inherit the same structural problem when access is granted to a broad network instead of scoped to identities, devices, sessions, and applications.

By the numbers:

• According to Verizon's 2026 Data Breach Investigations Report, exploitation of software vulnerabilities accounted for 31% of breaches.
• Edge devices including VPN gateways accounted for 22% of breaches that began with exploitation.
• 43 days.
• Third-party involvement now factors into 48% of breaches.

👉 Read Island's analysis of why the VPN has become the front door attackers target

Context

VPNs were designed to extend a corporate perimeter to remote workers, but that model assumes the network itself can still be trusted once a user connects. In modern identity governance, that assumption breaks because access must account for who the user is, what device they are on, and whether the session should be allowed to reach anything beyond the specific application.

The primary issue is not a single product flaw, but the architectural habit of granting broad network reach as a proxy for trust. Once remote access becomes a tunnel into the internal environment, a compromised edge appliance can turn into a high-value entry point for ransomware, espionage, and lateral movement.

This is a human IAM problem at the surface, but it also affects contractor access, privileged workflows, and non-human access paths that rely on the same network trust assumptions. Organisations that still treat the VPN as the access control layer are defending the wrong boundary.

Key questions

Q: How should security teams reduce VPN risk without disrupting remote work?

A: Start by moving the highest-risk populations off the broad tunnel first, especially contractors, third parties, and privileged sessions. Then replace network-wide reach with application-scoped access that checks identity, device posture, and session context before granting entry. That reduces blast radius while keeping legitimate work moving.

Q: Why do VPNs and edge appliances keep showing up in breach paths?

A: Because they are internet-reachable, trusted by design, and often sit in front of broad internal access. Attackers do not need the whole environment if one exposed gateway can create a foothold. The pattern persists whenever broad network access is used as a proxy for trust.

Q: What do security teams get wrong about remote access trust?

A: Teams often assume that authenticated remote access is equivalent to trusted internal access. That is the mistake. Once a stolen credential succeeds, the attacker inherits session trust and can pivot into other systems unless the environment imposes additional authorization checks, segmentation, and monitoring for abnormal movement.

Q: Who should own the decision to retire broad VPN access?

A: Identity, infrastructure, and security leaders should own it together, because the issue spans authentication, network design, and operational access policy. The right decision is not a simple tool swap, but a governance change that limits what any successful remote session can reach.

Technical breakdown

Why internet-facing VPN gateways become high-value entry points

VPN gateways and remote access appliances concentrate trust at the edge. They are internet-reachable, widely deployed, and often granted broad downstream access once authentication succeeds. That combination makes them attractive to attackers because a single flaw can become a universal foothold. The issue is not only the vulnerability itself, but the design pattern that places identity validation in front of expansive network reach. Once inside, the gateway often collapses the distinction between a legitimate user and a malicious session, which is exactly what adversaries exploit.

Practical implication: treat edge appliances as exposure points, not trust boundaries, and reduce what a successful login can reach.

Why patching speed cannot close the remote access window

Patching remains necessary, but it does not solve the mismatch between exploitation speed and remediation speed. If attackers can weaponise a flaw in hours while organisations need days or weeks to identify, approve, and deploy fixes, the window stays open. This is especially true for appliances that sit outside normal endpoint telemetry and are harder to validate continuously. In practice, the control problem is not only whether a patch exists, but whether the architecture depends on a device that must remain exposed to the internet to function.

Practical implication: pair remediation with exposure reduction so a single unpatched device cannot define enterprise-wide risk.

How zero trust changes the access model for remote work

Zero trust shifts the question from 'can this user reach the network?' to 'should this identity reach this specific resource in this session?' That means identity, device posture, geolocation, and session context all influence access decisions, rather than a one-time tunnel grant. For remote work, the architectural change is important because it removes the assumption that network location is a meaningful trust signal. Access becomes application-scoped and continuously evaluated instead of broad and persistent.

Practical implication: move from network-wide connectivity to per-application access decisions backed by continuous verification.

NHI Mgmt Group analysis

Broad network access is the wrong trust primitive for modern identity governance. The VPN model assumes that a user who passes an authentication step should inherit broad internal reach. That assumption was built for perimeter-era work patterns and fails when the internet is the access path and the corporate network is no longer the place where work happens. Practitioners should reframe VPNs as residual infrastructure, not the control plane for trust.

Identity controls cannot compensate for a topology that expands blast radius by design. A compromised edge appliance does not just expose a session, it can expose the network segment behind it. That is why network-centric access models keep turning local compromise into enterprise-wide impact. The governance lesson is that least privilege must apply to network reach, not only to user entitlements.

Contractor and third-party access magnify the tunnel problem. Outside users often receive the broadest connectivity because it is operationally convenient, yet that convenience creates the largest blast radius. With third-party access now embedded in a large share of breaches, the access model itself becomes part of the risk surface. Practitioners should treat broad tunnels for external users as an exception, not a default.

Identity governance now has to follow the point of work, not the point of connection. Access policies that live only at the network edge cannot express the session context needed for modern work. The real control opportunity is to verify identity, device, and context where the application is consumed. That shifts the programme from perimeter defence to operationally scoped access governance.

Network-based trust is the named concept this article exposes: access blast radius. When one tunnel can reach many systems, a single compromise spreads faster than remediation can keep up. The practical conclusion is not just to patch faster, but to narrow what any successful connection can touch in the first place.

From our research:

• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs , Key Challenges and Risks.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation lag can outlast exposure windows.
• For the broader access model, see Ultimate Guide to NHIs , Why NHI Security Matters Now for the case that exposure growth now outpaces traditional governance cycles.

What this signals

The next phase of remote access governance will be measured by how much of the network you can remove from the trust decision entirely. The more access decisions are tied to application scope, device posture, and session context, the less a single exposed appliance can define your blast radius.

Access blast radius: this is the more useful operating metric than VPN uptime or patch velocity. If a compromised tunnel can still reach broad internal segments, the programme has preserved the old risk model under a new label.

For teams that also govern non-human identities and privileged workflows, the same lesson applies. Identity controls that depend on a one-time trust grant cannot hold up when access must be continuously bounded at the point of work.

For practitioners

• Reduce broad tunnel dependence for high-risk access Move contractors, third parties, and privileged users off always-on VPN paths first, because those groups create the highest exposure if a gateway or credential is abused.
• Scope access to specific applications rather than networks Replace network reach with application-scoped policies that verify identity, device posture, and session context before allowing access to the resource that is actually needed.
• Treat edge appliances as exposed assets Place VPN gateways and remote access controllers into the same risk review cadence as other internet-facing assets, with stronger monitoring and a clear removal path when their role can be reduced.
• Consolidate third-party access into a single governed entry point Use one controlled access path for external users so revocation, logging, and policy enforcement are centralised instead of scattered across multiple tunnels and appliance profiles.

Key takeaways

• The core failure is architectural: broad network access is still being used as a trust signal even though remote work and attacker behaviour no longer justify it.
• Verizon's breach data shows why the problem is urgent, with vulnerability exploitation at 31% of breaches and edge devices at 22% of exploitation-driven incidents.
• The practical fix is to reduce blast radius by replacing network-wide tunnels with context-aware, application-scoped access.

Key terms

• Access Brokered Blast Radius: Access brokered blast radius is the amount of infrastructure a user can reach once a session is established through a broker or gateway. The smaller the reachable set, the less damage a compromised session or overbroad entitlement can cause.
• Context-aware access mapping: The practice of linking an identity’s permissions to the task, system state, and runtime behaviour that justify those permissions. For AI native engineering, this is more useful than relying only on fixed roles because access can change quickly and may be shared across different actor types.
• Session-Scoped Access: Session-scoped access is permission that exists only for a defined task or time window and is expected to end when the task ends. For NHI governance, it reduces lingering authority and makes AI-driven activity easier to review, revoke, and investigate when behaviour changes.

What's in the full article

Island's full blog post covers the operational detail this post intentionally leaves for the source:

• How the browser, desktop, and network layers are combined into a point-of-work access model.
• The contractor and third-party access scenario that motivated the 'one door' approach.
• The specific context signals used to decide whether a session is allowed.
• Why the vendor argues the tunnel model increases blast radius for remote work.

👉 Island's full post covers the remote access examples, contractor use case, and zero trust framing in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.