Why VPN-based remote access is failing modern identity governance

At a glance

What this is: VPN-based remote access now creates a governance gap because edge exposure and broad tunnel trust make the network itself the control point attackers target first.

Why it matters: IAM, PAM, and NHI teams need to treat remote access as identity- and session-scoped governance, not as a perimeter problem, or compromised gateways will keep widening blast radius.

Context

VPN-based remote access still assumes that once a user reaches the network, trust can be granted broadly enough to make the session useful. That assumption breaks when work sits in SaaS, contractors connect from unmanaged devices, and edge appliances become internet-facing targets rather than neutral conduits.

The article frames the problem as identity governance, not transport security. The question is no longer how to harden a tunnel, but how to scope access to the exact application, device, and context that justify it.

The same pattern increasingly affects contractor and third-party access, where broad remote-access paths expand exposure faster than teams can certify or revoke them. That makes remote access a lifecycle and policy problem as much as a connectivity problem.

Key questions

Q: What breaks when VPN access is granted once at the edge and then trusted across the network?

A: A single successful login becomes a standing network foothold. That breaks the assumption that authentication at the perimeter is enough to keep users safe after the first check. When the session is accepted broadly, any bypass or stolen token can expose more systems than the original application intended, which is why edge trust creates oversized blast radius.

Q: Why do edge VPN appliances create outsized identity risk?

A: They sit at the boundary between public traffic and internal trust, so any authentication weakness can become direct access. When the device issues a trusted session, it acts like an identity broker. If that trust path is weak, the attacker bypasses the perimeter and lands inside the network.

Q: What are the signs that remote access governance is failing in distributed environments?

A: Remote access governance is usually failing when access is fragmented across employees, contractors, and vendors, auditing is limited to basic logs, and no one can confidently identify remote users or their actions. Other warning signs include excessive reliance on persistent credentials, slow provisioning, weak deprovisioning, and inconsistent policies across teams and tools.

Q: When should organisations move from VPN access to context-aware access?

A: When remote work, contractor access, or privileged sessions depend on assumptions that no longer hold, such as stable devices, known locations, or a fixed perimeter. Context-aware access becomes the better choice when the organisation needs to limit exposure to the exact application and session, rather than grant entry to the whole network.

Technical breakdown

Why the VPN trust model no longer holds

A VPN was designed to extend a corporate perimeter, then place the user inside that perimeter with broad reach. That model assumes the network can be trusted once entry succeeds, but modern work patterns destroy that assumption because identity, device posture, and location vary from session to session. When the control boundary is the tunnel, every successful login inherits network trust it has not earned. The result is not just broader access, but broader attack surface whenever an internet-facing gateway is compromised or abused.

Practical implication: Treat network location as insufficient for authorisation and move enforcement to identity, device, and session context.

Why edge appliances become high-value entry points

Edge devices such as VPN gateways are both reachable from the internet and trusted by internal systems, which makes them unusually attractive. A single authentication-bypass flaw or exposed weakness can convert an appliance into a bridge from the internet to the internal network. That bridge matters because it collapses the difference between initial access and lateral movement: once the edge device is trusted, the attacker inherits more than a login, they inherit path reach. This is why patching alone does not remove the structural risk.

Practical implication: Reduce dependence on internet-facing gateways so a single appliance flaw cannot expose the broader environment.

Why context-aware access beats broad tunnel access

Context-aware access changes the decision point from network admission to application authorisation. Instead of granting a user a general network foothold, the control evaluates who they are, what device they are on, and the current session context before exposing only the application or resource required. That is the practical Zero Trust move described by NIST SP 800-207: trust should not be implied by network position. For remote access, this also gives practitioners a cleaner way to limit contractor, privileged, and third-party sessions without expanding the blast radius.

Practical implication: Scope access to applications and sessions, not to internal network segments.

Threat narrative

Attacker objective: The objective is to turn remote-access infrastructure into a trusted entry path that can be used for lateral movement and high-impact compromise.

1. Entry begins at the internet-facing edge, where attackers target VPN gateways and other remote-access appliances because they are both exposed and trusted.
2. Privilege or foothold expansion follows when a flaw, bypass, or stolen credential turns that gateway into a path into the internal network.
3. Impact occurs when the attacker uses that network reach to move laterally, reach sensitive systems, or launch ransomware from inside the trusted boundary.

Breaches seen in the wild

• CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Network trust has become an access control liability: VPNs were built for a world where work lived inside a perimeter, but that premise no longer matches how access is actually consumed. Once the tunnel becomes the main trust signal, any compromise of the gateway inherits internal reach. The implication is that modern governance must move from network admission to resource-scoped authorisation.

Edge exposure is now a governance problem, not just a hardening problem: Internet-facing VPN appliances are attractive because they combine reachability with organisational trust. That combination makes them structurally different from ordinary infrastructure. Practitioners should treat them as high-risk access brokers whose compromise can invalidate upstream controls, not as simple remote-work utilities.

Blast radius is determined at the session boundary: The control issue is no longer whether a user can connect, but how much they can reach once connected. When access is granted to a network instead of a specific application or task, a single compromised path can expose far more than the original use case required. The field should reframe remote access around bounded session authority.

Context-aware access is the real zero trust decision: Identity alone is not enough if access is still mapped to network location. The governance shift is to make device state, user context, and session purpose part of the authorisation decision, because those are the variables that actually change risk at runtime. That is where modern remote-access policy belongs.

Contractor and third-party access exposes the weakest assumption in tunnel-based design: Broad VPN access assumes outside users need network membership when they usually need only a few applications. That assumption creates unnecessary persistence, broader certification scope, and more difficult offboarding. The practical conclusion is that third-party access should be minimised at the network layer and narrowed at the application layer.

What this signals

Identity-aware remote access is becoming a governance baseline: Teams should expect broader pressure to replace network membership with session-scoped authorisation, especially for contractors, administrators, and third parties. The programme question is no longer whether the tunnel is encrypted, but whether the access path is narrower than the blast radius it creates.

Assumption collapse: Least privilege was designed for access decisions made before a session inherits broad network reach. That assumption fails when the transport layer itself grants trust, because the user receives a perimeter rather than a task-scoped entitlement. Practitioners need to rethink where authorisation actually happens.

Edge exposure has to be managed as part of access governance: Internet-facing gateways are no longer just infrastructure to patch, they are policy enforcement points that can amplify every remote-access mistake. That shifts priority toward reducing the number of sessions that ever need broad tunnel access and toward verifying context at the point of use.

For practitioners

• Reclassify VPN gateways as high-risk access brokers Inventory internet-facing remote-access appliances, identify the business functions they front, and assign them the same governance scrutiny used for other privileged entry points.
• Scope remote access to applications, not subnets Replace broad network reach with application-level authorisation so a session can only reach the specific resource justified by role and context.
• Prioritise contractors and third parties for tunnel reduction Move external users off broad VPN access first, because their sessions usually have the weakest ongoing business justification and the hardest offboarding path.
• Tie authorisation to device and session context Use device posture, geolocation, and session purpose as authorisation inputs so a successful login does not automatically inherit internal trust.

Key takeaways

• VPNs fail modern identity governance because they grant network trust where modern access decisions need to be session-scoped and context-aware.
• The article ties that failure to current exploitation pressure, including 31% of breaches beginning with vulnerability exploitation and 22% involving edge devices.
• The practical response is to narrow access to applications and sessions, starting with contractors, third parties, and privileged remote users.

Key terms

• Context-aware access mapping: The practice of linking an identity’s permissions to the task, system state, and runtime behaviour that justify those permissions. For AI native engineering, this is more useful than relying only on fixed roles because access can change quickly and may be shared across different actor types.
• Edge appliance: An edge appliance is an internet-facing device that sits between external users and internal services, such as a VPN gateway or remote-access controller. Because it is both exposed and trusted, compromise of the appliance can create a high-value path into the environment.
• Object-Scoped Authorisation: An access control model that binds permissions to specific records, resources, or business objects rather than to the endpoint alone. It requires the application to verify the subject, the object, and the transaction context before data is returned or modified.
• Tunnel trust: Tunnel trust is the assumption that once a user is connected through a VPN or similar path, the network can safely infer legitimacy. That assumption is increasingly unsafe because modern threat actors target the tunnel itself, and because work patterns no longer map cleanly to perimeter-based controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.