Topic starter
17/08/2026 4:40 pm
TL;DR: Teleport finds that legacy VPNs and bastion hosts create broad trust zones, depend on static credentials, and leave weak audit trails as infrastructure becomes cloud-native and distributed. That makes access control, revocation speed, and session visibility the real governance problem for modern IAM and NHI programmes.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Four Ways Teleport Overcomes the Limitations of VPNs and Bastions”.
Key questions
Q: What breaks when VPN and bastion access is used for cloud-native infrastructure?
A: They break when access is designed around stable networks instead of ephemeral workloads.
Q: Why do static credentials create more risk than short-lived access tokens?
A: Static credentials create more risk because they remain valid until someone finds and removes them, which gives attackers a durable entry path.
Q: How do teams know whether unauthorized access controls are actually working?
A: Look for fewer standing credentials, lower lateral movement potential, and faster revocation when access is no longer needed.
Practitioner guidance
- Replace network-wide access with resource-scoped identity policy Map each infrastructure access path to a specific role, resource, and time-bound entitlement so users do not inherit broad network reach after authentication.
- Phase out static credentials for infrastructure access Inventory passwords, SSH keys, pre-shared keys, and other long-lived secrets used by VPN and bastion workflows, then prioritise the paths that still grant broad internal access.
- Enforce short-lived access for privileged sessions Use ephemeral certificates or equivalent short-lived credentials so infrastructure access expires automatically when the task ends rather than relying on manual revocation.
Bottom line: Legacy VPNs and bastions create governance gaps because they were built for stable networks, not ephemeral infrastructure.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Concrete examples of how VPNs and bastions slow distributed teams working across cloud environments
- The platform-side explanation of how identity-authenticated access replaces static credentials
- More detail on session recording, compliance reporting, and how access events are logged
- The vendor's comparison of direct resource access across SSH, Kubernetes, databases, and web apps
👉 Read Teleport's analysis of VPN and bastion access gaps in modern infrastructure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Broad network access is the wrong unit of control for modern infrastructure. VPNs and bastions were designed around the assumption that access can be granted to a network zone and safely narrowed later. That assumption fails when workloads are ephemeral and endpoints change constantly. The implication is that access governance has to shift from perimeter reach to resource-specific identity policy.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Basic log collection records discrete events, such as a login or command, but often leaves gaps in context. Session recording captures the full interaction as it happened, then indexes the activity for search and replay. For privileged access investigations, that difference matters because teams can see the sequence, timing, and exact user actions instead of reconstructing events from partial records.
👉 Read our full editorial: VPNs and bastions create broad access and audit gaps