Your VPN Is a Liability. Here's What Zero Trust Actually Fixes.

A colleague of mine worked in IT security at a mid-sized financial firm. In 2022, they got breached. Not through some exotic zero-day exploit, but through a stolen VPN credential. The attacker authenticated, got onto the network, and spent three weeks quietly moving sideways before anyone noticed. Three weeks. By then, they’d touched payroll systems, client records, and internal communications. My colleague spent the next six months cleaning it up. The VPN had done exactly what it was designed to do: it let someone in. It just had no idea who that someone really was.

Why Traditional Security Has a Structural Problem

The model that has dominated corporate security for two decades is called perimeter security, or sometimes the ‘castle and moat’ approach. The idea is simple: build a strong wall around your network, and everyone inside it is trusted. Firewalls, VPNs, and access gateways formed that wall.

The problem is that the castle model assumes your enemy is outside. But modern attackers don’t storm the gate: they steal the keys. Password phishing, credential stuffing, and insider threats are now the dominant attack vectors. Once someone has valid credentials and gets through the VPN, the castle model has nothing left to offer. They’re inside, and they’re ‘trusted.’

Meanwhile, the perimeter itself has dissolved. Employees work from coffee shops, home offices, and hotel lobbies. Applications live in AWS, Azure, and SaaS platforms, not in the data centre. The concept of ‘inside the network’ barely exists anymore for most organisations. Protecting a perimeter that isn’t there is not a security strategy.

What Zero Trust Network Access Actually Means

Zero Trust Network Access (ZTNA) is a security framework built on one foundational principle: never trust, always verify. It doesn’t matter where a user is, what device they’re on, or whether they successfully logged in five minutes ago. Every access request is treated as potentially untrusted and evaluated in real time.

The key shift is this: instead of granting access to a network, ZTNA grants access to specific applications, and nothing else. A user working on your CRM cannot see your payroll system. A contractor accessing your project management tool cannot browse your internal file shares. Each application is isolated, and each access decision is made independently.

Access decisions factor in multiple signals simultaneously: user identity, device security posture, geographic location, network conditions, time of day, behavioural patterns, and the sensitivity of the resource being requested. Only when all conditions are satisfied is access granted, and even then, it’s monitored continuously.

How a ZTNA Session Actually Works

Here’s what happens behind the scenes every time a user connects under a ZTNA architecture:

1. User requests access: Identity is verified. MFA required, no exceptions.
2. Device is checked: OS patch level, encryption status, and compliance are assessed in real time.
3. Context is evaluated: Location, time of day, network, and risk score are factored in.
4. Policy decision: Access is granted or denied based on all signals, not just a password.
5. App-only connection: The user reaches that specific application. The rest of the network stays invisible.
6. Session monitored: Behaviour is tracked throughout. Anomalies trigger re-authentication or disconnect.

Notice what never happens: the user never gets ‘onto the network.’ They get a connection to one application. The network itself stays dark.

VPN vs. ZTNA: An Honest Comparison

VPNs aren’t going away overnight; they still have legitimate uses, particularly for connecting geographically distributed offices at the network level. But for user access in a hybrid or cloud-first environment, the comparison is increasingly one-sided.

• Access model: VPN: full network access once authenticated. ZTNA: per-app access only, nothing else visible.
• Trust assumption: VPN: trusted after login, session-wide. ZTNA: never trusted; verified continuously.
• Lateral movement: VPN: high risk; an attacker roams freely. ZTNA: blocked, each app requires fresh verification.
• Device check: VPN: one-time at connection. ZTNA: ongoing throughout the session.
• Remote/cloud fit: VPN: built for on-prem; struggles with cloud. ZTNA: designed for hybrid, remote, and cloud-first.
• Attack surface: VPN: large (the entire network is exposed). ZTNA: minimal, application-level isolation.

Why This Matters More Right Now Than Ever

Three things are converging in 2026 that make ZTNA less of a ‘nice to have’ and more of a baseline expectation.

• Regulatory pressure is increasing. The US Department of Defense now requires every DoD contractor to achieve Zero Trust compliance by FY 2027. That mandate is cascading outward: defence suppliers, government contractors, and their partners are all being pulled into compliance requirements whether they sought it or not.
• AI is creating new attack surfaces. According to IBM’s 2025 Cost of a Data Breach Report, organisations with ungoverned AI in their environments paid roughly $670,000 more per breach on average. The fastest-growing ZTNA use case in 2026 is applying Zero Trust controls to AI model endpoints and data pipelines, not just human users.
• The market is moving fast. Global ZTNA adoption rose 53% in 2025 alone, with 80% of organisations embracing Zero Trust frameworks to secure cloud migrations and hybrid workforces. That 60% improvement in threat detection that organisations are reporting? That’s what shifting from ‘perimeter trusted’ to ‘always verified’ actually looks like.

Who Is Adopting ZTNA, and Why

ZTNA isn’t a one-size-fits-all solution, but certain sectors are driving adoption harder than others, and for very specific reasons.

• Healthcare: Patient records are among the most valuable data on the black market. HIPAA compliance combined with a shift to cloud-hosted EHR systems makes per-application access control a practical necessity, not just a best practice.
• Financial services: The combination of regulatory scrutiny (SOC 2, PCI-DSS) and high-value targets makes financial firms natural early adopters. ZTNA’s granular audit trail also simplifies compliance reporting considerably.
• Government and defence: The DoD Zero Trust mandate is the headline, but state and local agencies are following. Securing access for distributed workforces without exposing classified or sensitive systems is a problem ZTNA was built for.
• Technology companies: Engineering teams that operate across multiple cloud environments with contractors, freelancers, and third-party integrations benefit from ZTNA’s application-level isolation. A compromised freelancer credential stops at one repository, not the whole infrastructure.
• Education: Remote learning, BYOD policies, and sprawling SaaS environments create significant exposure. ZTNA lets institutions grant students and staff access to what they need without opening the broader network.

What Nobody Tells You About Implementing ZTNA

Here’s where most blog posts stop telling the truth. ZTNA is genuinely better than what it replaces, but the path to getting there is not frictionless.

• Legacy systems don’t cooperate gracefully. If your organisation runs applications from 2008 that weren’t built with APIs, granular access controls become a complex engineering problem. You may need a phased approach rather than a wholesale replacement.
• Policy complexity is real work. ZTNA requires you to define, explicitly, who should access what, under what conditions. That sounds straightforward until you actually try to map it across 200 applications, 15 contractor types, and five office locations. Budget time for this.
• User experience can regress if you’re not careful. Frequent re-authentication prompts, slower initial connections, and unfamiliar workflows can cause friction. The best deployments invest as much in user experience as in security policy. An IT team that implements ZTNA without communicating why will face pushback.
• Vendor lock-in is a risk. ZTNA is increasingly bundled into SASE platforms (Secure Access Service Edge), which is powerful but can make you dependent on a single vendor’s ecosystem. Evaluate portability before you commit.
• Cultural change takes longer than the technology. The hardest part of ‘never trust, always verify’ isn’t technical. It’s getting leadership to understand why a senior executive’s credentials need the same scrutiny as an intern’s.

A Practical Implementation Checklist

If you’re beginning (or re-evaluating) a ZTNA rollout, here’s what actually needs to happen:

1. Start with identity. Multi-factor authentication is non-negotiable and should come first. Microsoft’s data shows phishing-resistant MFA stops more than 99% of identity attacks, even when an attacker already has valid credentials. No MFA, no ZTNA.
2. Audit your application inventory. You cannot apply least-privilege access to applications you haven’t mapped. Before any technical deployment, document what applications exist, who uses them, and what data they touch.
3. Define access policies per application. Work with application owners, not just IT. They know who actually needs access and at what level. ZTNA policy without business context produces policies that are either too permissive or too restrictive.
4. Pilot with a low-risk application first. Don’t start with your ERP or payroll system. Find a medium-sensitivity application with a defined user group and use it to work out the policy, user experience, and operational kinks before scaling.
5. Implement continuous monitoring from day one. ZTNA without session monitoring is half a security model. Set up logging, alerting for anomalous behaviour, and automated response rules (e.g., session termination if device compliance drops).
6. Communicate to users before you deploy. Explain what’s changing, why, and what they’ll experience differently. A single well-written internal post prevents most of the support tickets that follow a surprise security rollout.
7. Review and refine policies quarterly. Access requirements change as teams change. A policy set in January will have gaps by June. Schedule regular reviews and assign an owner for each application’s access policy.

Where ZTNA Is Heading

The ZTNA market is growing at 25.5% CAGR through 2030, and it’s not growing in isolation. Several converging trends are shaping what Zero Trust looks like over the next few years.

• AI-driven risk scoring. Instead of static policies, next-generation ZTNA systems use machine learning to assess risk dynamically, detecting unusual behaviour patterns that no human-written rule would catch.
• SASE convergence. ZTNA is increasingly bundled with cloud security gateways, SD-WAN, and CASB into unified Secure Access Service Edge platforms. Single-vendor SASE is becoming the dominant procurement pattern for enterprise security teams.
• Zero Trust for AI workloads. As AI agents gain the ability to access systems autonomously, applying Zero Trust principles to agent credentials, model endpoints, and data pipelines is becoming the fastest-growing new use case.
• Behavioural authentication. Continuous biometric and behavioural analysis (typing cadence, mouse movement, app usage patterns) is being layered into ZTNA to authenticate users passively throughout a session without friction.

Final Thought

My colleague from the opening story (the one who spent six months cleaning up after a VPN breach) has an organisation that has since deployed ZTNA. The thing they said stuck with me: ‘The hardest part wasn’t the technology. It was accepting that the old model was broken and that we’d been comfortable with a false sense of security.’

That’s really what Zero Trust is: an honest reckoning with how security actually fails. Not through dramatic hacks, but through a stolen password and three weeks of quiet, lateral movement through a network that had no reason to notice.

Never trust, always verify isn’t a vendor tagline. It’s just an accurate description of how careful organisations need to be right now.

Sources & Further Reading

• MarketsandMarkets: Zero Trust Network Access Market Report 2025–2030
• SNS Insider: ZTNA Market Valuation & Forecast 2025–2033
• Microsoft: Digital Defense Report 2025 (Identity Attack Data)
• IBM: Cost of a Data Breach Report 2025 (AI & Shadow Risk)
• Gartner: Remote Access Deployment Forecast 2025
• Zscaler: ZTNA Overview & VPN Replacement Research
• CISA: VPN Vulnerability Alerts & Zero Trust Guidance
• Swif.ai: Zero Trust Statistics 2026: Adoption, ROI & Federal Mandates
• Cato Networks: ZTNA vs VPN Security Comparison 2025
• US Department of Defense: Zero Trust Strategy & FY2027 Compliance Targets