Topic starter
23/06/2026 7:09 pm
TL;DR: VPNs hide IP addresses and encrypt traffic, but they do not eliminate tracking, endpoint risk, or the broader trust assumptions built into remote access, according to DigiCert. For identity teams, the real question is how VPN use fits into access governance, device trust, and zero-trust control design.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “What is a VPN?”.
Key questions
Q: How should security teams govern VPN use in a zero trust architecture?
A: Security teams should treat VPNs as transport controls, not as proof of trust.
Q: Why do VPNs not solve the identity trust problem for remote access?
A: VPNs protect traffic in transit, but they do not verify whether the user, device, or session should be trusted.
Q: What breaks when organisations rely on VPNs for modern remote access?
A: VPNs tend to extend network trust more broadly than modern risk models allow.
Practitioner guidance
- Separate tunnel security from access trust Keep VPN encryption and IP masking in the transport layer, but require identity and device assurance before granting internal access.
- Treat device posture as a gate Use endpoint health, managed-device status, and session context as explicit conditions for remote access, not as after-the-fact signals.
- Review whether VPN presence is acting as an authorisation proxy Check whether internal applications, jump paths, or legacy policies still grant access simply because the connection arrives through the tunnel.
Bottom line: VPNs reduce exposure in transit, but they do not solve the access governance problem that determines whether a remote session should be trusted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:00 am
VPN transport security and identity trust are not the same control. Encrypted tunnelling reduces interception risk, but it does not answer the governance question of whether the session should be trusted at all. In identity programmes, that means the control objective shifts from hiding traffic to validating the user, the device, and the session state before access is granted.
A question worth separating out:
Q: What is the difference between VPN privacy and access assurance?
A: VPN privacy protects data in transit and obscures the source network, while access assurance determines whether a user or device should be allowed to reach a resource at all. They solve different problems, and one cannot replace the other in a modern identity programme.
👉 Read our full editorial: VPNs solve privacy, but not the identity trust problem