Topic starter
07/03/2026 1:03 am
TL;DR: VPNs still create a broad trust zone after authentication, while zero trust continuously verifies users, devices, and policy conditions, according to Beyond Identity’s analysis. For IAM and NHI practitioners, the real shift is from network reachability to task-scoped access that limits blast radius and forces stronger identity checks.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “Zero Trust vs VPN: Is it Time to Ditch VPNs?”.
Key questions
Q: What breaks when organisations rely on VPNs for modern remote access?
A: VPNs tend to extend network trust more broadly than modern risk models allow.
Q: Why does browser-based zero trust reduce risk compared with broad VPN access for remote users?
A: Browser-based zero trust reduces risk because it narrows access to specific applications and sessions instead of exposing the wider network.
Q: How do security teams know whether zero-trust remote access is actually working in practice?
A: Security teams should look for evidence that users only reach approved resources, sessions are brokered through controlled gateways, and access decisions are enforced consistently across cloud and on-prem systems.
Practitioner guidance
- Audit perimeter assumptions in remote access Map where VPN connectivity still grants broader reach than the task requires, especially for applications, file shares, and third-party connections.
- Move access decisions to the resource layer Require policy checks at the application or service level so authentication to the network does not automatically imply entitlement to data or systems.
- Review privileged and stale accounts first Identify unused, old, or highly privileged accounts that still benefit from broad VPN reach and narrow or remove those entitlements before expanding zero-trust controls.
Bottom line: VPNs remain risky because they convert authentication into broad post-login reach, which is too much trust for modern cloud and remote access patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:04 pm
Perimeter trust is the wrong security assumption for modern access. VPNs still model access as if entry into the network is the meaningful security boundary, but cloud services, third-party integrations, and remote work have broken that premise. The article shows that once access is granted at the tunnel, the control environment becomes too coarse to reflect actual task need. Practitioners should treat this as a boundary failure in governance, not just a transport problem.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between Zero Trust and VPN for privileged access?
A: Zero Trust narrows privileged access to the specific request, while a VPN usually grants a broader network path after login. For privileged operations, the difference is whether access is continuously checked and time-bound or simply inherited for the life of the session.
👉 Read our full editorial: Zero trust vs VPN: why perimeter access no longer fits modern IAM