Topic starter
11/07/2026 8:37 pm
TL;DR: Legacy VPNs leave hybrid access with broader trust than modern governance can justify, according to Appgate. Identity-scoped access and continuous evaluation narrow lateral movement and reduce dependence on patch cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “The SonicWall VPN Wake-Up Call: 5 Takeaways for IT Leaders”.
Key questions
Q: Why do legacy VPN models create compliance risk?
A: Legacy VPNs often grant broad connectivity after a single login event, which makes it hard to prove least privilege, segmentation, and continuous enforcement.
Q: What are the signs that permissive remote-access policies have become a hidden risk?
A: A clear sign is when temporary remote-access exceptions remain in place long after the reason for them has passed.
Q: What breaks when organisations rely on VPNs for modern remote access?
A: VPNs tend to extend network trust more broadly than modern risk models allow.
Practitioner guidance
- Inventory VPN-dependent access paths Map which users, contractors, service accounts and admin workflows still rely on VPN entry, and classify the resources each path can reach today.
- Shrink post-authentication reach Replace broad tunnel-based reach with resource-specific authorization so each session only exposes the applications, data sets or management planes it actually needs.
- Prioritise end-of-life remediation Create a migration plan for remote access platforms nearing end-of-support, including risk acceptance thresholds and scheduled replacement milestones.
Bottom line: Traditional VPNs still assume that network placement is a trustworthy signal, and that assumption no longer holds in hybrid environments.
Glossary terms: Zero Trust Network, End-of-Life Risk, Lateral Movement, Intent-Scoped Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
11/07/2026 9:05 pm
VPN governance is now an identity problem, not a connectivity problem. The core weakness is not encrypted transport, but the oversized trust granted after authentication. In hybrid environments, that creates a mismatch between the access path and the entitlement model, which is why IAM and PAM teams need to treat remote access as part of identity governance rather than as a separate network control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when VPN access and zero trust overlap?
A: Treat VPN as a transport layer, not as a trust decision. Access should still be explicitly authorized based on identity, session context, and resource sensitivity. If the VPN becomes the reason access is allowed, the zero trust model has not actually replaced perimeter trust.
👉 Read our full editorial: Traditional VPN risk is outpacing hybrid access governance