Notifications
Clear all
Topic starter
17/08/2026 4:40 pm
TL;DR: Legacy VPNs and bastion hosts struggle with cloud-native scale, broad network access, static credentials, and weak visibility, according to Teleport. For IAM and NHI teams, the core issue is that old perimeter access patterns still create oversized trust zones, slow revocation, and audit gaps that modern infrastructure cannot tolerate.
NHIMG editorial — based on content published by Teleport: Four Ways Teleport Overcomes the Limitations of VPNs and Bastions
By the numbers:
- 56% of organisations experienced cyberattacks leveraging VPN vulnerabilities in the past year.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: How should security teams replace VPN access without creating new operational gaps?
A: They should start by identifying which resources actually need reachable access, then move to identity-bound, resource-scoped sessions with short-lived credentials.
Q: Why do VPNs and bastions increase lateral movement risk?
A: Because they often grant broad network-level access once a user authenticates, so one stolen credential can open many internal paths.
Q: How do organisations know whether their access management controls are actually working?
A: Look for three signals: fewer unneeded entitlements, faster removal of access after role or employment changes, and a lower number of review exceptions left unresolved.
Practitioner guidance
- Inventory all persistent infrastructure access paths Map every VPN, bastion, and shared jump path to the systems it can reach, then rank them by breadth of access and credential lifetime.
- Replace network-wide reach with resource-scoped access Use role-based policies that limit access to specific clusters, servers, or databases instead of granting broad network entry.
- Shorten the credential lifecycle for infrastructure access Move toward short-lived certificates and explicit revocation workflows so access expires with the task, not the account.
What's in the full article
Teleport's full blog covers the operational detail this post intentionally leaves for the source:
- Direct comparison of VPN and bastion workflows across SSH, Kubernetes, databases, and web applications
- Platform-specific explanation of how short-lived certificates and session recording are implemented in practice
- Vendor walkthrough of audit logging and SIEM integration details for infrastructure access monitoring
- Additional examples of how distributed teams experience latency, maintenance overhead, and access friction
👉 Read Teleport's analysis of VPN and bastion limitations for modern infrastructure →
VPN and bastion limitations: are your access controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Broad network access is the wrong control model for modern infrastructure. VPNs and bastions were designed to extend trust across a network, but cloud-native infrastructure is built from transient resources that should not inherit persistent reach. That mismatch turns access into a perimeter problem when it is now an identity problem. The practical conclusion is that access should be resource-scoped, time-bound, and tied to the actual task boundary.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have already endured a successful cyberattack resulting from compromised non-human identities, which shows how quickly access governance failures become operational incidents.
A question worth separating out:
Q: Who is accountable when a bastion or VPN credential is abused?
A: Accountability usually sits with the team that owns credential lifecycle, access scope, and audit logging, not just the user who triggered the session. Governance frameworks such as NIST CSF and ISO 27001 expect traceable access control and evidence of review, so ownership must be explicit.
👉 Read our full editorial: VPNs and bastions create broad access and audit gaps
