Why do VPNs and bastions increase lateral movement risk?

Why This Matters for Security Teams

VPNs and bastions are often deployed to reduce exposure, but they can unintentionally create high-value choke points where one authenticated session unlocks broad internal reach. That is exactly why lateral movement risk increases: the access path is trusted too much after login. When combined with stolen credentials, weak segmentation, or over-privileged accounts, the channel becomes a traversal mechanism rather than a control.

The issue is not the technology itself, but the network-level trust model behind it. Guidance from the NIST Cybersecurity Framework 2.0 and attack-path mapping in the MITRE ATT&CK Enterprise Matrix both reflect a simple reality: once an adversary gets inside a trusted tunnel, they can often enumerate, pivot, and escalate far faster than defenders expect. NHIMG research on Ultimate Guide to NHIs — Key Challenges and Risks shows how excessive privilege and weak visibility compound that blast radius across environments.

In practice, many security teams discover the problem only after a valid VPN credential or bastion session is used to move laterally, rather than through intentional segmentation testing.

How It Works in Practice

VPNs and bastions increase lateral movement risk because they collapse many internal trust decisions into one access event. After authentication, the user or workload often receives broad reachability to subnets, administrative endpoints, or jump-host pathways that were designed for convenience, not for fine-grained control. If the session is hijacked, the adversary inherits that reach.

That risk is amplified when remote access is used as a substitute for identity-aware authorization. Current best practice is evolving toward Zero Trust Architecture, where the tunnel itself is not enough to grant useful access. Instead, teams combine strong authentication with device posture, role scope, segmentation, and request-level policy evaluation. NHIMG’s Top 10 NHI Issues highlights the same structural pattern in non-human access: excessive privilege and poor lifecycle control create easy pivot points once an identity is compromised.

Practical controls usually include:

• Replacing broad VPN access with application-level or service-level access where possible.
• Segmenting bastions so they reach only the systems required for the task.
• Using just-in-time elevation for administrative paths instead of standing access.
• Logging session activity, command execution, and destination hops for fast containment.
• Restricting shared jump hosts, because shared trust hides attribution and speeds compromise spread.

For systems handling secrets or NHI automation, the lessons from the 52 NHI Breaches Analysis are direct: once one identity is abused, defenders must assume nearby identities, tokens, and network paths will be probed next. These controls tend to break down in flat networks with shared admin tooling because a single authenticated session can still traverse too many hosts.

Common Variations and Edge Cases

Tighter remote-access controls often increase operational overhead, requiring organisations to balance usability against containment. That tradeoff is especially sharp for incident response, third-party support, and legacy infrastructure, where operators still need controlled reach into many systems at once.

There is no universal standard for this yet, but current guidance suggests treating bastions as monitored gateways rather than implicit trust brokers. In some environments, a bastion is still necessary for protocol constraints or regulated administration. In others, a ZTA-aligned broker, short-lived session access, or privilege elevation workflow is a better fit. The right choice depends on how much lateral reach the access path creates.

Edge cases matter. A VPN with strong MFA can still be dangerous if it lands users on a flat internal network. A bastion can still accelerate compromise if it is reused for many administrators, accepts persistent credentials, or exposes downstream secrets. NHIMG’s OWASP NHI Top 10 is a useful reference when access is being granted to automation, service accounts, or agentic workloads because the same lateral-movement logic applies: broad trust plus long-lived access creates unnecessary blast radius.

Related resources from NHI Mgmt Group

• Why do perimeter VPNs increase lateral movement risk in enterprise networks?
• Why do shared VPNs and jump boxes increase lateral movement risk in OT networks?
• Why do legacy VPNs increase the risk of lateral movement after a successful login?
• Why do SSO environments increase the risk of lateral movement?