Topic starter
06/09/2026 9:01 am
TL;DR: VPNs were designed for a network-centric world, but modern remote work now depends on cloud apps, SaaS, and hosted systems, so broad tunnel access can expose far more than users need, according to CyberFOX. SASE shifts access to preapproved applications and services, narrowing blast radius and aligning remote access with least privilege.
Editorial analysis by NHI Mgmt Group, based on content published by CyberFOX: “SASE vs. VPN: The Case for Modern Network Security”.
Key questions
Q: How should security teams reduce risk when remote users still need broad application access?
A: Scope access to the specific applications and services a role needs, then enforce that policy at session creation rather than at network entry.
Q: Why do vpn tunnels create lateral movement risk in cloud-first environments?
A: Because a tunnel often places the user inside a broader trusted network than the task requires.
Q: What are the signs that remote access controls are too broad for sensitive internal systems?
A: Remote access is too broad when users can reach more systems, files, or functions than their job requires, especially if clipboard, file transfer, or unrestricted shell access is left open by default.
Practitioner guidance
- Replace network-wide VPN entitlements with application-scoped access Limit each remote user or contractor to the specific cloud apps, SaaS services, and hosted systems required for the role.
- Map contractor and vendor access separately Create distinct policies for third-party access so external support cannot inherit broader internal reach than employees need.
- Log destination-level access for audit review Record which user reached which application, along with policy context, so reviews can prove least privilege rather than assume it.
Bottom line: VPN-based remote access remains too broad for cloud-first work because one authenticated session can still expose systems far beyond the user’s role.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:02 am
Remote access is becoming an entitlement problem, not a connectivity problem. The article’s core logic is that network tunnels were designed for a world where the network itself was the trust boundary. Cloud applications, SaaS services, and hosted systems invert that model, so the real control question is which applications a user may reach after authentication. For IAM and PAM teams, that means remote access policy must be managed like any other high-risk entitlement.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations do when contractors need temporary access to internal systems?
A: Treat contractor access as a separately governed entitlement with narrower scope, explicit expiry, and destination-level logging. External users usually need task-specific reach, not general network presence, so their access should be easier to isolate and remove than employee access.
👉 Read our full editorial: SASE vs vpn: why least-privilege remote access is replacing tunnels