Notifications
Clear all
Topic starter
11/07/2026 1:54 pm
TL;DR: Legacy VPN, firewall-centric segmentation, and cloud-routed access models are creating compliance, resilience, and performance friction for financial services organisations that must prove least privilege continuously while adapting to acquisitions, cloud migrations, and third-party integrations, according to Appgate. The core issue is not tooling volume but an access architecture built for static networks rather than regulated speed.
NHIMG editorial — based on content published by Appgate: legacy access models in financial services and the shift toward regulated-speed access
Questions worth separating out
Q: How should security teams modernise access control in regulated financial environments?
A: They should move from perimeter-centric enforcement to identity-aware policy that can be applied continuously across users, devices, and sessions.
Q: Why do VPNs and firewall segmentation create compliance risk in financial services?
A: They create risk because they often turn access governance into a manual change process that lags behind business change.
Q: What do organisations get wrong about Zero Trust in regulated networks?
A: They often assume Zero Trust is a product layer rather than an operating model.
Practitioner guidance
- Map access paths to control owners Inventory which teams own VPN policy, firewall segmentation, cloud routing, and identity policy so exceptions do not disappear into shared accountability gaps.
- Replace static network exceptions with identity-aware policy Move high-risk access decisions to rules that use user, device, and session context rather than broad network reach.
- Test audit evidence before the next change event Validate that least privilege, segmentation, and access enforcement can be demonstrated after an acquisition, cloud migration, or third-party onboarding.
What's in the full article
Appgate's full analysis covers the operational detail this post intentionally leaves for the source:
- The article's full discussion of direct-routed access architecture and how it differs from perimeter-based VPN design.
- The source's framing of compliance obligations across PCI-DSS, SOX, GLBA, NYDFS 23 NYCRR Part 500, and the FTC Safeguards Rule.
- The vendor's explanation of how latency, centralised routing, and single points of failure affect regulated workloads.
- The specific Appgate ZTNA positioning that maps identity-centric access to financial services performance and audit requirements.
👉 Read Appgate's analysis of regulated access control for financial services →
Financial services access control: why legacy models are breaking down?
Explore further
11/07/2026 2:04 pm
Legacy access debt is a governance problem, not a network inconvenience. The article shows how firewall rework, VPN dependency, and routing bottlenecks turn policy into a slow manual exercise. In regulated financial environments, that delay becomes control drift because access expands faster than enforcement can be updated. Practitioners should treat access architecture as an auditability issue, not just an operations issue.
A question worth separating out:
Q: Who is accountable when access controls fail to meet audit expectations?
A: Accountability sits with the teams that own access policy, identity governance, and the network paths used to enforce it. In practice, that means IAM, PAM, infrastructure, and security leaders need a shared evidence model for least privilege, segmentation, and session-level control, especially in regulated financial services.
👉 Read our full editorial: Legacy access models are failing regulated speed in financial services
