VPN vs ZTNA: Why VPNs Are Losing Enterprise Security

📅 August 3, 2026  |  🏷 Ai Generated  |  Cyber Security, Information Security, Threat Management

A penetration tester at a major European bank recently demonstrated something that made the CISO’s stomach drop: using a single compromised VPN credential purchased for $47 on a dark web forum, she moved laterally through 14 internal systems in under six hours — all while appearing as a fully authenticated, trusted user. The VPN saw nothing wrong. The firewall logged nothing suspicious. The SIEM generated zero alerts. The organization had spent $2.3 million on VPN infrastructure over five years and was, functionally, wide open.

This is not a hypothetical. Variants of this scenario have played out at MGM Resorts, Ivanti customers worldwide, and dozens of mid-market enterprises whose breach disclosures quietly note “unauthorized VPN access” as the initial attack vector. According to Zscaler’s 2025 VPN Risk Report, 56% of organizations experienced a cyberattack that exploited a VPN vulnerability in the prior 12 months — a figure that climbs every year. The architecture that secured enterprise networks for three decades is now one of the most reliably exploitable surfaces in modern IT infrastructure.

Zero Trust Network Access (ZTNA) has moved from theoretical framework to operational imperative. The question for security architects and CISOs is no longer whether to transition, but how to execute that transition without creating the gaps that inevitably appear when complex security tooling is replaced mid-flight. This analysis breaks down exactly why VPNs are structurally failing, what ZTNA does differently at the protocol and policy level, and how organizations can stage a credible migration.

The Structural Vulnerabilities of VPN Architecture

Virtual Private Networks were designed in an era when the enterprise perimeter was a physical concept — a hard edge between trusted internal networks and untrusted external ones. The implicit security contract was simple: authenticate once at the perimeter, and you earn access to everything behind it. That contract made sense when “everything behind it” meant a few file servers and an ERP system sitting in a building you controlled.

The architecture has not meaningfully changed. What has changed is everything else.

Implicit Trust and the Lateral Movement Problem

The core failure mode of VPN is what security engineers call “implicit trust post-authentication.” Once a user or device authenticates to a VPN concentrator, the network typically grants broad access to the internal segment. Access control lists (ACLs) can theoretically constrain this, but in practice, poorly maintained ACLs, overly permissive firewall rules, and the operational complexity of managing thousands of rules across a large organization create a flat network that skilled attackers navigate freely.

The 2024 Ivanti Connect Secure vulnerabilities (CVE-2023-46805 and CVE-2024-21887) are instructive. Chinese state-sponsored threat actors exploited authentication bypass and command injection flaws to deploy webshells across thousands of Ivanti VPN appliances. The attack did not require valid credentials — it bypassed the authentication entirely. Ivanti’s own Integrity Checker Tool failed to detect some compromises. Organizations that believed they were protected by MFA and strong credential policies were exposed by a flaw in the VPN software itself. CISA issued multiple emergency directives. The Cybersecurity and Infrastructure Security Agency’s retrospective analysis found that many affected organizations had not applied patches within the recommended window — a chronic VPN management failure that emerges repeatedly in post-incident reviews.

Attack Surface Expansion Through Public-Facing Appliances

Every VPN concentrator that must be reachable from the public internet is, by definition, an internet-facing attack surface. These appliances run complex software stacks — operating systems, TLS stacks, proprietary daemons — and must process unauthenticated traffic before they can reject it. That processing window is where most VPN CVEs live. From Pulse Secure to Fortinet to Cisco AnyConnect to Palo Alto GlobalProtect, virtually every major VPN vendor has issued critical severity patches for pre-authentication remote code execution vulnerabilities in the past three years.

The patch management challenge is compounded by the fact that VPN appliances are often treated as network infrastructure rather than application servers — meaning they fall outside standard vulnerability management cadences. Security teams that patch their Windows endpoints within 72 hours of a critical advisory may leave VPN firmware untouched for months.

What ZTNA Actually Does Differently

Zero Trust Network Access is not a product category so much as an architectural philosophy operationalized through specific technical controls. The foundational principle — never trust, always verify — sounds abstract until you understand the concrete mechanisms that implement it.

Identity-Aware Proxies and Continuous Verification

Where a VPN authenticates a user once and grants network-level access, ZTNA solutions authenticate every session and often every request against a dynamic policy engine. Access decisions are made by evaluating a combination of identity attributes (user, device, certificate), context signals (location, time of day, behavioral baseline), and resource sensitivity — and those decisions are re-evaluated continuously, not just at tunnel establishment.

The technical implementation typically involves an identity-aware proxy sitting between the user and the application. The user never receives a routable IP address into the internal network. Instead, the proxy brokers access to a specific application resource after verifying that the current session still meets policy requirements. If a user’s device posture degrades mid-session — say, an EDR agent detects suspicious process execution — the proxy can terminate or restrict that session in real time. VPN has no equivalent capability.

Gartner’s 2025 Market Guide for Zero Trust Network Access projects that by 2027, more than 70% of new remote access deployments will use ZTNA rather than VPN services, up from roughly 30% in 2023. The acceleration is being driven by a combination of cloud migration forcing architectural reconsideration and a growing board-level understanding that VPN incidents carry significant disclosure and regulatory liability.

Application-Level Segmentation vs. Network-Level Access

ZTNA grants access to applications, not to network segments. This distinction eliminates the lateral movement problem at the architectural level rather than trying to compensate for it with compensating controls. An attacker who compromises a ZTNA-brokered session gains access to the specific application that session was authorized for — not the subnet containing that application, not adjacent systems, not the network infrastructure.

This application-level segmentation is often called “microsegmentation” in ZTNA contexts, though the term is applied loosely. The practical effect is that the blast radius of a compromised credential or session is contained to a defined, policy-governed scope — something that VPN architectures can only approximate through complex and operationally burdensome network segmentation strategies.

The VPN Management Burden Nobody Talks About Openly

Security architects who have managed enterprise VPN infrastructure at scale will recognize a particular kind of technical debt: the accumulated complexity of split-tunnel policies, client software compatibility matrices, concentrator capacity planning, licensing tiers, client certificate management, and the operational nightmare of diagnosing VPN connectivity issues across diverse endpoint configurations.

A 2024 survey by Enterprise Strategy Group found that organizations with more than 5,000 endpoints spend an average of 2.3 full-time equivalent positions managing VPN infrastructure — a figure that excludes incident response activities related to VPN-originated breaches. For organizations that have deployed remote access at scale, VPN has become a tax on engineering time that produces diminishing security returns.

Licensing and Infrastructure Cost Comparisons

The total cost of ownership calculation for VPN versus ZTNA is more complex than vendors on either side present. VPN infrastructure requires physical or virtual concentrators with sufficient capacity to handle peak concurrent user loads — capacity that was dramatically underprovisioned at thousands of organizations during the rapid remote work expansion of 2020. Organizations responded by purchasing additional concentrator capacity, additional licensing, and in many cases deploying consumer-grade solutions like NordVPN at team or departmental level as emergency stopgaps. NordVPN’s team offerings served legitimate remote access purposes during that period, but they introduced credential management fragmentation and inconsistent policy enforcement that security teams are still cleaning up.

ZTNA delivered as a cloud service (the dominant deployment model for new implementations) trades capital expenditure for operational expenditure and shifts capacity planning responsibility to the vendor. It also eliminates the attack surface of the concentrator appliance itself. Domain registration and DNS infrastructure management — handled through providers like Namecheap for internal DNS delegation in some smaller deployments — still requires attention regardless of VPN or ZTNA choice, but the surface area is dramatically reduced when you remove the public-facing concentrator from the architecture.

Migration Realities: What a Credible ZTNA Transition Looks Like

The security industry has a tendency to present technology migrations as cleaner than they are. ZTNA adoption at enterprise scale involves genuine complexity, and organizations that treat it as a simple VPN replacement will encounter problems.

Application Discovery and Policy Mapping

The most consistently underestimated component of ZTNA migration is the application discovery phase. ZTNA requires explicit policies for every application that users need to access. This requires knowing — with specificity — what applications exist, who needs access, through what identity providers those users authenticate, what device posture requirements are appropriate for each application’s sensitivity, and what the network path looks like for each access pattern.

Many organizations discover during this phase that they have significant numbers of internal applications that are undocumented, maintained by shadow IT, or dependent on legacy protocols (NTLM, Kerberos delegation, SMB) that ZTNA proxies handle poorly or not at all. Legacy applications that require network-level access rather than application-level proxying present genuine architectural challenges that may require a hybrid approach — maintaining VPN access for specific application types while migrating the majority of use cases to ZTNA.

A staged migration approach is standard: identify the highest-risk use cases (privileged administrative access, third-party vendor access, highly mobile workforce segments), migrate those to ZTNA first, measure the operational impact, then expand coverage. The CISA Zero Trust Maturity Model provides a reasonable framework for staging this work across five pillars: Identity, Devices, Networks, Applications & Workloads, and Data.

Identity Infrastructure as the Critical Dependency

ZTNA’s security guarantees are only as strong as the identity infrastructure they rely on. Organizations that have not implemented phishing-resistant MFA (FIDO2/WebAuthn), robust conditional access policies, and continuous device compliance monitoring cannot fully realize the security benefits of ZTNA — they are simply replacing a network-level trust assumption with an identity-level trust assumption that may be equally fragile.

This means that the ZTNA migration project is often concurrent with an identity modernization project: consolidating identity providers, deploying hardware security keys or passkeys for high-privilege accounts, implementing Privileged Access Workstations (PAWs) for administrative access, and integrating endpoint detection capabilities into the device compliance signal that feeds the ZTNA policy engine. Organizations that skip this identity hardening work may find that their ZTNA deployment provides architectural improvement but does not meaningfully improve their resistance to credential-based attacks.

ZTNA and the Regulatory Compliance Dimension

Compliance frameworks have begun explicitly recognizing zero trust architecture as a preferred or required approach. NIST SP 800-207 provides the foundational zero trust architecture guidance that ZTNA implementations reference. The U.S. Federal Zero Trust Strategy (OMB M-22-09) mandated that federal agencies reach specific zero trust maturity targets. DORA (Digital Operational Resilience Act), now fully in force for European financial entities, has provisions around network access controls and third-party risk that ZTNA architectures address more cleanly than VPN-based approaches.

Third-Party and Vendor Access: The Highest-Risk VPN Use Case

Third-party vendor access via VPN represents the single highest-risk use case in most enterprise security architectures. Vendors are issued VPN credentials, often with broad access, often without device posture requirements, and often with poor offboarding hygiene. The Target breach (2013) established this pattern; it has been repeated hundreds of times since. ZTNA’s application-scoped access model is architecturally suited to third-party access — vendors receive access to the specific application they need, for the duration they need it, with session recording and behavioral monitoring. The lateral movement risk that makes VPN-based vendor access so dangerous is eliminated at the architectural level.

Key Takeaways

• VPN’s implicit trust model is architecturally incompatible with modern threat environments. Compromised credentials or pre-authentication vulnerabilities provide attackers with broad network access that ZTNA’s application-scoped model structurally prevents.
• The patch management challenge for internet-facing VPN appliances is chronic and organizationally difficult to solve. Every major VPN vendor has issued critical pre-authentication RCE patches in the past three years; the attack surface exists regardless of operational hygiene.
• ZTNA migration requires an application discovery and policy mapping phase that most organizations underestimate. Legacy applications with protocol dependencies may require hybrid approaches rather than clean cutover.
• Identity infrastructure maturity is the binding constraint on ZTNA security benefit. Phishing-resistant MFA, device compliance monitoring, and robust conditional access policies must accompany ZTNA deployment to realize its security guarantees.
• Third-party vendor access is the highest-priority use case for ZTNA migration. The application-scoped access model eliminates the lateral movement risk that makes VPN-based vendor access consistently exploitable.

Conclusion: The Transition Window Is Closing

The security calculus on VPN is no longer ambiguous. The architecture carries a structural attack surface that is being actively exploited at scale, generates a management burden that consumes engineering resources without proportional security return, and is increasingly misaligned with both regulatory expectations and the cloud-distributed application environments that define modern enterprise IT.

ZTNA is not a perfect solution — no security architecture is. Legacy application compatibility, identity infrastructure dependencies, and the operational complexity of policy management at enterprise scale present real challenges that require deliberate engineering work. But these are solvable challenges. The lateral movement risk, the concentrator attack surface, and the implicit trust model of VPN are structural, not incidental.

If you are responsible for remote access security architecture at your organization, take three specific actions this quarter: conduct a VPN vulnerability audit against the current CVE database for your specific appliance firmware versions; initiate an application discovery exercise to scope what a ZTNA policy set would need to cover; and review your identity infrastructure for phishing-resistant MFA coverage across privileged accounts. These three steps will give you an honest picture of your current exposure and the minimum viable path to ZTNA migration. The threat actors exploiting VPN infrastructure are not waiting for your next budget cycle.