Topic starter
06/11/2026 6:55 pm
TL;DR: ZTNA can still fail Zero Trust audits when some access paths bypass policy enforcement or when compromised sessions are not revoked fast enough, according to Forescout's analysis. Practitioners need evidence that verification, policy, and segmentation operate consistently across every path.
Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “I Replaced My VPN with ZTNA. Why Did I Fail My Zero Trust Audit?”.
Key questions
Q: Why does ZTNA still fail when internal systems keep direct connections?
A: ZTNA still fails when internal systems keep direct connections because policy is bypassed once a device, user, or workload can reach internal resources without passing the enforcement point.
Q: What is the difference between ZTNA and Zero Trust architecture?
A: ZTNA is a way to broker access to applications without exposing the full network.
Q: How should security teams replace VPN trust with zero trust access controls?
A: Start by defining access around the resource and the task, not the network location.
Practitioner guidance
- Map every access path to a policy enforcement point Inventory remote, on-premises, privileged, workload, and internal application routes, then identify which ones do not pass through centralized Zero Trust policy enforcement.
- Revoke sessions on risk change, not just at login Feed endpoint and identity telemetry into the access layer so posture changes can terminate active sessions before the current token or connection expires.
- Extend segmentation to east-west traffic Apply internal access policy to application servers, databases, domain controllers, and other dependent systems so the first allowed connection does not become a lateral movement path.
Bottom line: Zero Trust compliance depends on consistent enforcement across every access path, not on whether remote access has been moved from VPN to ZTNA.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Zero Trust audit failure is usually a control-consistency problem, not a tooling problem. Forescout's analysis shows that a ZTNA rollout can still leave auditors unconvinced when some access paths remain direct, some sessions are not revoked on new risk, and some internal routes bypass segmentation. The field mistake is treating Zero Trust as a procurement outcome instead of an architectural proof problem. Practitioners need evidence that every path is governed by the same decision logic.
A few things that frame the scale:
- More than 95% of infrastructure-as-a-service accounts use less than 3% of the entitlements they are granted, according to Gartner.
A question worth separating out:
Q: How do security teams know if their verification controls are actually working?
A: They work if high-risk requests cannot be completed through a single channel and if helpdesk or approval attempts leave a clear audit trail. Look for reductions in informal overrides, fewer password resets completed without corroboration, and lower success rates for phishing simulations that use synthetic audio or video.
👉 Read our full editorial: Zero Trust audits fail when access controls remain inconsistent