Topic starter
24/10/2026 8:51 pm
TL;DR: SMBs and MSPs remain exposed when remote access still depends on perimeter appliances, according to Todyl. Identity, device posture, and per-application access become the stronger control path as broad network admission falls away.
Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “SASE for SMBs: Enterprise-Grade Security Without Enterprise Complexity”.
By the numbers:
- 58% of the ransomware claims it saw in 2024 started with attackers compromising a perimeter security appliance, according to Coalition's Cyber Threat Index 2025 cited by Todyl.
Key questions
Q: Why do perimeter appliances increase ransomware risk in SMB environments?
A: They combine public exposure with high trust.
Q: How should security teams decide between ZTNA and VPNs for remote access?
A: Security teams should choose ZTNA when they need resource specific access, strong least privilege enforcement, and better cloud alignment.
Q: What breaks when small businesses keep using VPNs as their main remote access control?
A: The failure mode is broad network admission.
Practitioner guidance
- Inventory every remote access path Map which users, applications, and office resources still depend on VPN access before changing anything, then translate those connections into explicit application-level rules.
- Replace subnet access with application publishing Publish only the applications each user group needs and block everything else by default, including management interfaces and legacy admin paths.
- Enforce device posture on every remote session Require compliant devices for access so valid credentials alone do not open the internal network from unmanaged endpoints.
Bottom line: SMB remote access is vulnerable when the network boundary is still defined by a VPN or firewall appliance that grants broad internal reach.
Glossary terms: Zero Trust Network, Secure Access Service Edge, Perimeter Appliance, Device Posture
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Perimeter-centric remote access is now a governance liability: the appliance model turns patch latency into access risk, because every unpatched VPN or firewall extends the time an attacker has to find a way in. The control failure is not just technical exposure, but the assumption that the office edge is still the correct place to concentrate trust. For SMBs and MSPs, that assumption no longer holds.
A question worth separating out:
Q: What should MSPs prove before retiring a client VPN?
A: They should prove that every required application has been mapped, that each user group has a replacement access rule, and that the VPN listener is fully gone after cutover. The test is not whether users complain less, but whether there is no longer a public entry point that broadens internal trust.
👉 Read our full editorial: SASE for SMBs shifts remote access from appliances to policy
This post was modified 7 days ago by NHI Mgmt Group