Topic starter
11/07/2026 8:38 pm
TL;DR: Legacy VPN and firewall models leave audit gaps because they cannot continuously enforce context-aware, least-privilege access, according to Appgate’s webinar on modern compliance. The control problem is not just perimeter weakness; it is the mismatch between static access assumptions and dynamic regulatory expectations.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Beyond the Perimeter: How ZTNA Resolves the Top Compliance Gaps in Modern Access Control”.
Key questions
Q: What breaks when organisations rely on VPNs for modern remote access?
A: VPNs tend to extend network trust more broadly than modern risk models allow.
Q: Why do zero trust access controls help with audit and regulatory requirements?
A: Zero trust helps because it makes the access decision itself auditable.
Q: What signs suggest access control is too broad across business systems?
A: Look for identities that can move from one sensitive platform to another without a clear business reason, especially where ticketing, source control and employee data are reachable through the same entitlement set.
Practitioner guidance
- Replace network-wide trust with resource-level policy enforcement Map every protected application or data path to a policy that evaluates identity, device posture, role, and context before granting access.
- Inventory where audit evidence is still network-centric Review whether your current logs show only session establishment or whether they also capture who accessed which resource, under what conditions, and why access was granted.
- Tie endpoint posture to session continuity Require device health checks at connection time and re-check them when trust conditions change, including patch state, encryption, and management enrollment.
Bottom line: Legacy perimeter controls can no longer prove that access stayed within policy once a session begins.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:06 pm
Compliance now depends on access enforcement, not access policy alone: Static rules are no longer enough when regulators expect evidence that access was constrained continuously and contextually. The old assumption was that a login event proved sufficient trust for the whole session. That assumption breaks under zero trust because trust must be re-evaluated as conditions change, so practitioners need to treat access enforcement as an ongoing control plane, not a one-time gate.
A question worth separating out:
Q: How should security teams implement zero trust for regulatory compliance?
A: They should start by mapping each regulatory obligation to a specific identity, access, logging, or encryption control, then verify those controls in production. Zero trust only supports compliance when access is continuously checked, privilege is limited, and evidence can be produced quickly for audit or incident review.
👉 Read our full editorial: Zero trust access control is becoming a compliance requirement