Topic starter
01/08/2026 8:53 pm
TL;DR: VPNs and edge appliances are now a primary entry path because exploitation is outrunning remediation, according to Island, with Verizon's 2026 DBIR showing 31% of breaches began with vulnerability exploitation and 22% involved edge devices. The real failure is architectural: network reach is no longer a valid access control boundary, so identity and session context have to replace tunnel trust.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “The Tunnel Became the Target: Why It's Time to Retire the VPN”.
Key questions
Q: What breaks when VPN access is granted once at the edge and then trusted across the network?
A: A single successful login becomes a standing network foothold.
Q: Why do edge VPN appliances create outsized identity risk?
A: They sit at the boundary between public traffic and internal trust, so any authentication weakness can become direct access.
Q: What are the signs that remote access governance is failing in distributed environments?
A: Remote access governance is usually failing when access is fragmented across employees, contractors, and vendors, auditing is limited to basic logs, and no one can confidently identify remote users or their actions.
Practitioner guidance
- Reclassify VPN gateways as high-risk access brokers Inventory internet-facing remote-access appliances, identify the business functions they front, and assign them the same governance scrutiny used for other privileged entry points.
- Scope remote access to applications, not subnets Replace broad network reach with application-level authorisation so a session can only reach the specific resource justified by role and context.
- Prioritise contractors and third parties for tunnel reduction Move external users off broad VPN access first, because their sessions usually have the weakest ongoing business justification and the hardest offboarding path.
Bottom line: VPNs fail modern identity governance because they grant network trust where modern access decisions need to be session-scoped and context-aware.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
Network trust has become an access control liability: VPNs were built for a world where work lived inside a perimeter, but that premise no longer matches how access is actually consumed. Once the tunnel becomes the main trust signal, any compromise of the gateway inherits internal reach. The implication is that modern governance must move from network admission to resource-scoped authorisation.
A question worth separating out:
Q: When should organisations move from VPN access to context-aware access?
A: When remote work, contractor access, or privileged sessions depend on assumptions that no longer hold, such as stable devices, known locations, or a fixed perimeter. Context-aware access becomes the better choice when the organisation needs to limit exposure to the exact application and session, rather than grant entry to the whole network.
👉 Read our full editorial: Why VPN-based remote access is failing modern identity governance