Why do traditional VPN and perimeter models fail for modern access control?

Why Traditional VPN and Perimeter Models Fail for Modern Access Control

VPNs and perimeter-centric controls were built for a world where location implied trust and network membership was a useful proxy for legitimacy. That model breaks down when users, contractors, workloads, and agents connect from unmanaged devices, multiple cloud environments, and rapidly changing risk conditions. Modern access control has to decide based on identity, device posture, workload context, and the exact action requested, not just on whether traffic entered a private tunnel. Guidance from the OWASP Non-Human Identity Top 10 and NHIMG’s Ultimate Guide to NHIs both reflect this shift from network trust to identity trust.

The practical failure is not just over-broad access. Once a session is established, perimeter tools often struggle to re-evaluate risk fast enough when credentials leak, devices drift out of compliance, or attackers move laterally after initial entry. NHIMG’s LLMjacking research shows how quickly exposed credentials can be abused, with attacker attempts beginning in minutes rather than days. In practice, many security teams discover the weakness only after a credential, tunnel, or trusted session has already been used as the path of least resistance.

How It Works in Practice

Replacing perimeter trust starts with making access decisions at request time. Rather than granting broad network reach, organisations define policy around who or what is asking, from where, for which resource, and under what conditions. For human access this often means ZTNA. For workloads and agents, the better primitive is workload identity, because cryptographic identity can be evaluated continuously even when the software moves across hosts, containers, or clouds. The key challenges and risks section in NHIMG’s guide is useful here because it frames the access problem as lifecycle and governance, not just authentication.

In mature environments, access is usually enforced through a combination of short-lived credentials, context-aware policy, and strong auditability. That means:

• Issuing just-in-time credentials for the minimum task window instead of long-lived shared secrets.
• Binding access to workload identity such as SPIFFE-style identities or signed OIDC assertions, so policy can distinguish the caller precisely.
• Evaluating policy at runtime with tools such as policy-as-code engines, rather than relying only on static role mappings.
• Revoking or narrowing access automatically when device posture, location, or behavioural context changes.

This is especially important for agentic systems, where an agent may chain tools, request new privileges mid-task, or retry actions in ways humans would not predict. Current guidance suggests perimeter models can still help with segmentation, but they are not sufficient as the primary authorisation control. These controls tend to break down in highly dynamic cloud-native environments with service-to-service traffic, because network location no longer represents trust and long-lived sessions outlive the risk signal that justified them.

Common Variations and Edge Cases

Tighter identity-based access often increases operational overhead, requiring organisations to balance security gains against policy complexity, secret lifecycle management, and user experience. That tradeoff becomes visible in hybrid workplaces, merger environments, and third-party integrations where legacy VPN patterns are still embedded in workflows. In those cases, teams may keep a VPN for segmentation while moving sensitive applications behind conditional access controls, but best practice is evolving toward shrinking the VPN’s role rather than expanding it.

There is no universal standard for this yet across all environments, especially for legacy protocols, batch jobs, and industrial systems that cannot easily support short-lived tokens or continuous policy checks. For those cases, compensating controls matter: isolate the segment, narrow entitlements, increase monitoring, and remove standing secrets wherever possible. PCI environments in particular often need more deliberate control mapping, and PCI DSS v4.0 reinforces the need to limit access and validate it continuously rather than assuming network placement is enough. The practical lesson from 52 NHI Breaches Analysis is that identity compromise, not network entry, is usually what turns a perimeter gap into a real incident.

Related resources from NHI Mgmt Group

• Why do LLMs complicate traditional access control models?
• Why does policy-based access control matter more than traditional role-based access in modern IAM?
• Why do access control models still fail in mature IAM programmes?
• How should security teams decide whether JIT access is safe for non-human identities?