Topic starter
11/07/2026 8:43 pm
TL;DR: Traditional VPNs give remote users broad network access, expose internet-facing attack surfaces, and struggle with third-party risk, according to Zero Networks and Verizon’s 2025 DBIR, which reports zero-day exploits targeting edge devices and VPNs grew almost eightfold and 56% of organisations saw at least one VPN-related attack last year. The practical shift is from network trust to identity-aware, least-privilege access with continuous verification.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “VPN Alternatives: Modernizing Secure Remote Access”.
By the numbers:
- 91% of security leaders express concerns about VPNs leading to a security breach.
- 30% of breaches included third-party involvement of some sort last year, up 15% from the previous year.
Key questions
Q: What breaks when a VPN is used as the main remote access control in hybrid environments?
A: The main failure is that a VPN authenticates the user and then grants broad network reach, which makes lateral movement much easier than application-scoped access would.
Q: Why do legacy VPNs increase the risk of lateral movement after a successful login?
A: Legacy VPNs often place an authenticated user inside a trusted network zone, where internal segmentation is weaker than the access decision at the edge.
Q: How do teams know whether ZTNA is actually reducing remote access risk?
A: Look for three signals: internal resources are not internet-exposed, access is limited to named applications, and authorization still reflects identity and context during the session.
Practitioner guidance
- Define application-scoped access boundaries Map the remote access use cases that only need named applications or services, then remove any assumption that the full internal network must be reachable for those users or vendors.
- Require identity and device context at session start Make access decisions depend on user identity, device posture, and contextual policy so that a remote session is not treated as trusted once the tunnel opens.
- Eliminate open internet exposure for internal assets Prefer designs that keep internal systems invisible until policy is satisfied, rather than publishing ports and relying on post-connect filtering.
Bottom line: VPNs are increasingly misaligned with hybrid work because they grant broad network reach after a single authentication event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:11 pm
VPN-to-network trust is the governance problem, not just the transport mechanism: Traditional remote access converts identity proof into broad network reach, which means the access decision is made too early and too coarsely. That model works poorly when third parties, hybrid endpoints, and attacker-sourced credentials all share the same tunnel. The implication is that remote access governance now has to operate at the resource and session layer, not at the perimeter.
A question worth separating out:
Q: What is the difference between VPN access and application-level remote access?
A: VPN access grants a network tunnel, while application-level remote access grants entry to a specific service after policy checks. The first expands the trusted zone; the second keeps trust narrow and easier to govern.
👉 Read our full editorial: VPN replacement strategies for identity-aware remote access