Topic starter
11/07/2026 2:01 pm
TL;DR: VPNs were built for office-centric access, but in cloud-heavy hybrid environments they create performance bottlenecks, broad trust assumptions, and credential risk, according to eMudhra. Zero Trust shifts access decisions toward continuous verification, least privilege, and device trust, making the old network perimeter less relevant.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “From VPN Fatigue to Breach-Proof Security: Why Zero Trust Is the Future in Malaysia”.
Key questions
A: Security teams should verify the identity of every user and device before granting access, then apply granular, per-request policies instead of trusting network location.
Q: Why do VPNs create more risk in cloud-heavy environments?
A: Because VPNs assume that connectivity from inside the tunnel implies trust.
Q: What breaks when third-party remote access is not tightly scoped?
A: When vendor access is not tied to a specific purpose and expiry, organisations lose control over who can reach sensitive systems, what they can touch, and how long the access remains valid.
Practitioner guidance
- Reclassify VPN as a transport control Use the VPN only for encrypted connectivity and move the real trust decision to application-level identity and device policy.
- Bind remote access to device trust Require endpoint posture checks and certificate-backed trust before any sensitive application is reachable from a remote session.
- Shrink standing access after login Review the entitlements that follow a successful remote session and cut any broad network reach that is not tied to a named business task.
Bottom line: VPN-based remote access still encrypts traffic, but it leaves too much trust attached to a successful login in hybrid and cloud-heavy environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:11 pm
VPN fatigue is not just a user-experience complaint. It is a sign that remote access design is still treating network entry as the main security decision, even when applications, data and users are now distributed across clouds and devices. That model creates a trust gap between authentication and actual authorisation. Practitioners should read the fatigue signal as a governance failure, not a performance issue.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What should IAM teams prioritise when Zero Trust rollout stalls?
A: They should prioritise closing control-plane gaps before adding more tools or more policy language. The first fix is usually not another product but a clearer enforcement model that connects identity, device posture, privileged access, and telemetry. Without that alignment, each new control just adds another silo to coordinate.
👉 Read our full editorial: Zero trust exposes the limits of VPN-first remote access