Topic starter
10/07/2026 9:10 pm
TL;DR: More than half of organisations experienced at least one VPN-related cyberattack in the past year, while public vulnerability data shows over 21,500 CVEs by mid-2025 and a large share tied to edge and VPN appliances, according to Appgate and public advisories. VPN dependence is now a governance decision because implicit network trust no longer matches attacker behaviour or Zero Trust expectations.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “The VPN Security Crisis: Why Your 2026 Access Strategy Needs ZTNA Now”.
Key questions
Q: What breaks when VPN access is granted once at the edge and then trusted across the network?
A: A single successful login becomes a standing network foothold.
Q: Why do VPN gateways increase breach risk in modern environments?
A: VPN gateways increase breach risk because they combine internet exposure, authentication, and patch timing in one high-value target.
Q: What do security teams get wrong about replacing VPNs with ZTNA?
A: Teams often assume that changing the access technology automatically changes the trust model.
Practitioner guidance
- Define remote access by entitlement scope Map every VPN use case to the minimum application set it actually needs and identify where broad tunnel access persists after authentication.
- Inventory edge trust anchors List VPN gateways, concentrators, and other perimeter devices that still act as primary trust boundaries, then classify which business flows depend on them.
- Enforce identity and device context before access Require authentication, device posture checks, and contextual policy evaluation before any remote session can reach internal services.
Bottom line: VPN replacement is now an identity governance problem because the tunnel itself determines how much trust a remote user receives after authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:33 pm
VPN replacement is an identity governance decision, not a transport decision: The article is right to frame remote access as a governance problem because the tunnel itself becomes an authorisation boundary. When the boundary is coarse, the identity programme inherits broad reach, weak session containment, and poor blast-radius control. Practitioners should stop treating VPN migration as infrastructure refresh and instead evaluate what identity control is actually being preserved at the point of access.
A question worth separating out:
Q: What should remote access teams prioritise after a major VPN vulnerability?
A: Remote access teams should prioritise inventory, exposure reduction, and entitlement review before they focus on cosmetic migration work. If the vulnerable gateway still defines who can reach internal resources, then patching alone leaves the underlying trust model intact and the organisation remains dependent on the same attack surface.
👉 Read our full editorial: VPN replacement is now an identity governance decision