Topic starter
02/08/2026 11:51 am
TL;DR: A Forrester Total Economic Impact study commissioned by Tailscale models a 3,000-employee enterprise and reports 213% ROI, payback in under six months, $1.2 million in present value from retiring legacy VPN and remote access infrastructure, and a 70% reduction in exposure to breach costs for addressable attacks. The governance shift is not about faster networking, but about replacing layered access with identity-based control that reduces friction, overhead, and blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Tailscale: “The hidden costs of “good enough” network access”.
By the numbers:
- The study models a 3,000-employee enterprise.
- Tailscale reports 213% ROI with payback in under six months.
- The study models a 70% reduction in exposure to breach costs for addressable attacks.
Key questions
Q: How should teams implement identity-based networking without recreating VPN sprawl?
A: Start by making the access decision explicit for each session, then remove network-wide reach wherever a narrower resource path will do.
Q: Why does broad remote access increase blast radius even when logins are authenticated?
A: Authentication proves an identity, not the scope of damage that identity can cause.
Q: Where do identity-based networking controls usually fail in practice?
A: They fail when organisations keep legacy infrastructure in place as an exception path.
Practitioner guidance
- Map every remote access dependency Document VPNs, load balancers, NAT layers, routing exceptions, and support workflows so the full cost and control surface of remote access is visible.
- Enforce connection-level least privilege Require explicit policy for each session so users and systems can only reach the resources needed for the task, not the whole network.
- Separate human and machine access paths Review whether service accounts, workloads, and administrators share the same connectivity model, then restrict machine access to task-scoped destinations.
Bottom line: The article argues that the real problem is not connectivity itself but the operational and security cost of preserving broad network reach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:00 pm
Identity-based networking is really an access governance problem, not a networking feature discussion. The article’s core finding is that broad connectivity hides risk inside operational convenience. When access is tied to identity and device context at the connection layer, organisations can stop treating network reach as an entitlement that persists by default. The practitioner conclusion is that access design should be governed as tightly as privileged access.
A question worth separating out:
Q: What should IAM teams do when service account access is broader than the workload needs?
A: IAM teams should reduce the entitlement to the minimum runtime function the workload requires and then revalidate the dependency with the technical owner. Broad service account access usually persists because teams optimise for deployment convenience, not governance. Tightening scope reduces blast radius and makes later audit and offboarding decisions far easier.
👉 Read our full editorial: Identity-based networking shows why “good enough” access is costly