VPN vs ZTNA: Beyond the Network Perimeter
The VPN was designed for a world that no longer exists — a trusted office network, a few remote workers dialling in, a hard perimeter around it all. Today the workforce is remote by default, applications live in someone else's cloud, and the perimeter is a fiction. Zero Trust Network Access grew up to replace the VPN's core assumption. The distinction is deceptively simple: a VPN connects you to a network; ZTNA connects you to a resource. Everything else follows from that.
When you connect to a corporate VPN, you are placed on the internal network. Your laptop gets an internal address and, absent segmentation, can now reach whatever that network reaches. The VPN authenticated you once, at the door, and then trusted you broadly. That is fine until your credentials are phished or your device is compromised — at which point the attacker inherits the same broad network access you were granted. The VPN's model is 'authenticate, then trust the network position', and network position is exactly what an attacker wants.
What zero trust actually changes
ZTNA never puts you on the network. Instead, a broker sits between you and each application; for every request it evaluates who you are, what device you are on, and whether policy permits that identity to reach that specific application. Access is granted per-resource, continuously, and the applications themselves are not exposed to the network at all — they are dark until an authorised, verified request arrives through the broker. A compromised user reaches the handful of apps their policy allows, not a whole internal subnet.
- Reachability. VPN: once connected, broad network access. ZTNA: only the specific applications policy allows — everything else is invisible.
- Trust model. VPN: authenticate at the door, trust thereafter. ZTNA: verify identity and device posture continuously, per request.
- Exposure. VPN concentrators are internet-facing and have themselves been prime targets. ZTNA keeps applications unpublished behind the broker.
- Lateral movement. VPN gives an intruder a network position to pivot from. ZTNA denies that position by design — there is no 'internal network' to be on.
- Granularity. VPN access is coarse and network-shaped; ZTNA policy is identity- and context-shaped and far easier to scope to least privilege.
Where the honesty is needed
ZTNA is not a product you buy and finish. Its security depends entirely on the quality of the policies and the trust of the signals feeding it. If device posture is not actually checked, or policies default to broad allow, or the identity provider behind it can be phished, ZTNA becomes a more expensive VPN with better marketing. The model is stronger, but it moves the hard work to identity and policy — which is where it belonged all along. And some legacy protocols and flat internal systems simply do not fit the per-app model without redesign, so most organisations run both for a long transition.
The migration mindset
The pragmatic path is not a big-bang cutover but a steady shrinking of what the VPN can reach. Move the highest-value applications behind ZTNA first, tighten the VPN's remaining scope aggressively, and treat every application still reachable by broad VPN access as a known risk with a migration date. The endpoint of the journey is not 'we bought ZTNA' — it is 'no stolen credential grants network position anywhere'.
- Connect through your remote-access solution as a standard user and see how much of the internal network you can reach. Broad reachability means you are running a VPN trust model regardless of the label on it.
- Check whether access to one internal app depends on device posture (managed, patched, healthy) or only on a successful login. Login-only is the VPN assumption in disguise.
These checks probe the trust model at one point; validating that policy and posture actually hold across every app and identity is what our assessment examines.
Whether you keep a VPN or move to ZTNA, you can only protect the applications you know are exposed — and shadow services reachable over the VPN are the ones that surprise you. Access control starts with knowing what is reachable: you can't gate what you haven't discovered.