Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Zero-Trust Network Access Is Replacing VPNs
Transcript
- Lucas: So, Luna, let me ask you something. When was the last time your company made you connect through a VPN to access internal systems? Luna: Honestly? It's been a while. We switched to a zero-trust model about a year ago. But I still remember the days of wrestling with the VPN client every morning. Lucas: Right. And that's exactly what a lot of enterprises are moving away from. I want to talk about zero-trust network access — ZTNA — and why it's fundamentally replacing the VPN. Not just in theory, but in practice. Luna: Let's start with the why. What's wrong with VPNs? Lucas: Well, the traditional VPN model gives users broad access to the entire corporate network once they're authenticated. If an attacker steals those credentials — or exploits a vulnerability in the VPN appliance — they can move laterally across the network. We've seen that play out in major breaches: the Colonial Pipeline attack in 2021 started with a compromised VPN password. Luna: That's the 'castle and moat' model, right? Hard perimeter on the outside, but once you're in, you're trusted. Lucas: Exactly. And the castle and moat approach breaks down when your workforce is distributed and your applications live in the cloud. You can't shove all traffic back through a data centre just to enforce policies. ZTNA flips that: it grants access to specific applications, not the whole network. Access is based on identity, device posture, and context — every request is verified. Luna: So it's 'never trust, always verify' in a very granular way. Lucas: Precisely. And there's a real catalyst that accelerated this migration. You might remember the CrowdStrike outage in July 2024 — that faulty update that crashed millions of Windows systems. What's less talked about is that it also exposed how many organizations were still relying on VPNs for remote access. During that outage, many VPNs went down too, or were overwhelmed by support calls. Luna: I remember that. There were reports of companies unable to connect their remote workforce for days. Lucas: Right. And that became a board-level conversation. CISOs started asking: 'If our VPN is a single point of failure, what's the alternative?' The answer for many was ZTNA. According to Gartner, by 2026 — that's this year — 60% of enterprises will phase out their VPNs in favor of ZTNA. We're right in the middle of that shift. Luna: Let's talk about a concrete example. Zscaler is one of the big players in that space. How does their model differ from a VPN? Lucas: Zscaler operates on a cloud-native, multi-tenant platform. Instead of connecting users to a corporate VPN concentrator in a data centre, users connect to the nearest Zscaler edge node. From there, policies are enforced based on the user's identity and the application they're trying to reach. The user never touches the corporate network directly — they access the application through a secure tunnel that terminates at the application level. Luna: So it's essentially application-specific tunnels rather than network-level access. Lucas: Yes. And that has huge security implications. With a VPN, if an attacker compromises a user's laptop, they have a tunnel into the corporate network. With ZTNA, even if the laptop is compromised, the attacker can only reach the specific applications that user is authorized to access — and those applications are often hidden behind a gateway, not exposed to the internet at all. Luna: That's the 'dark cloud' concept. You don't even know an application exists unless you have the right credentials. Lucas: Exactly. And it's not just Zscaler. Cloudflare has Cloudflare Access, Netskope has their Private Access, and Microsoft has Azure AD Application Proxy. The market is crowded, but the architecture is consistent: no network-level access, only application-level. Luna: Is there data on how much this actually reduces breach risk? Lucas: There is. The IBM and Ponemon Institute's Cost of a Data Breach report from last year — 2025 — found that organizations that had fully deployed a ZTNA architecture saved an average of $1.5 million in breach costs compared to those that relied on traditional VPNs. That's a 40% reduction. And the main driver was limiting lateral movement: breaches were contained faster. Luna: That's a significant number. But I imagine migration isn't trivial. What are the pain points? Lucas: The biggest challenge is application compatibility. Some legacy applications — especially old client-server apps — don't work well with ZTNA because they expect direct network connectivity. You often need a connector or agent on the application side. Then there's the user experience shift: moving from a VPN client to a ZTNA client can be confusing at first, but once it's set up, most users find it simpler because they don't have to manually connect and disconnect. Luna: What about latency? I'd heard early ZTNA implementations added noticeable lag. Lucas: That was true a few years ago, but the architectures have matured. With cloud edge nodes, you can actually get lower latency than VPNs that hairpin traffic through a central data centre. Zscaler claims a median latency increase of less than 10 milliseconds over direct internet access. And for most business applications, that's negligible. Luna: So it's a net positive for both security and performance. But I wonder — does this mean VPNs will completely disappear? Lucas: Not entirely. VPNs still make sense for certain use cases: site to site connectivity between offices, or for very small organizations that can't justify the cost of a ZTNA platform. And some regulators still require network-level segmentation that ZTNA doesn't directly provide. But for user to application access — which is the vast majority of remote work scenarios — the VPN's days are numbered. Luna: It's interesting, because this shift is also tied to cyber insurance. I've heard that some carriers now require ZTNA as a condition for coverage. Lucas: That's right. After the spate of ransomware attacks exploiting VPN vulnerabilities — like the ones on SonicWall and Pulse Secure a few years ago — insurers started asking tougher questions. If you're still using VPNs for all remote access, you're paying a higher premium — or you might not get coverage at all. That's a powerful incentive for CISOs to migrate. Luna: Speaking of incentives — we're talking about practical steps that security leaders are taking. And that's the kind of conversation we try to have on this show every week. If these discussions are useful for what you're building or running, we want to keep them going. Lucas: Yeah, this show is ad-free and listener-supported, which means it stays focused on what actually matters for practitioners — not on selling products. If you find value in episodes like this, you can support us at buy me a coffee dot com slash fexingo. It helps us keep the conversations independent. Luna: Exactly. And that support goes directly into research and production time. So thank you to anyone who's contributed. Lucas: Alright, back to the tech. One thing I find fascinating about ZTNA is how it intersects with the concept of microsegmentation. In a zero-trust world, you're not just segmenting the network — you're segmenting access at the application or even the API level. Luna: That's a good point. Microsegmentation traditionally was about firewall rules between subnets. ZTNA makes that identity-aware. Lucas: Exactly. And that's where the real value is. Consider a hospital: a doctor needs access to patient records, but not to the billing system. A nurse needs the medication administration system, but not the HR portal. With ZTNA, you can enforce those policies without building complex network zones. Luna: That also simplifies audits and compliance. You have a clear record of who accessed what, not just which IP address connected to which port. Lucas: Right. And that's a huge win for incident response. When a breach happens — and it will — being able to quickly identify the scope of access is critical. With VPN logs, you often only know that a user's IP connected to the network. With ZTNA logs, you know exactly which applications they accessed and with what device posture. Luna: Let's look forward. Where do you see ZTNA evolving in the next few years? Lucas: I think the biggest trend is the convergence of ZTNA with secure web gateways and cloud access security brokers — what the industry calls SASE. Secure Access Service Edge. It's basically networking and security delivered as a cloud service. Zscaler, Netskope, Palo Alto Networks — they're all building integrated platforms. The idea is that you don't need separate tools for VPN replacement, web filtering, and data loss prevention. Luna: So ZTNA becomes a feature of a broader security platform rather than a standalone product. Lucas: Exactly. And that makes it easier for organizations to adopt. You're not buying another box; you're enabling a capability within your existing stack. But the core principle remains: access decisions based on identity and context, not network location. Luna: One concern I've heard is about performance in real-time applications like video conferencing or VoIP. Does ZTNA handle that well? Lucas: It can, but it requires careful design. Some ZTNA solutions use a proxy model that can introduce jitter. But newer architectures use direct peer to peer tunnels — like Cloudflare's Argo Tunnel — which minimize latency. The key is to test with your actual workloads before full deployment. Luna: Good advice. So for our listeners who might be evaluating ZTNA — what's the first step? Lucas: Start with a pilot. Pick one application that's critical but not business-essential — maybe a CRM or a project management tool. Implement ZTNA for that application, migrate a small group of users, and measure the experience. Then expand from there. You don't have to flip a switch on the whole VPN overnight. Luna: And in that pilot, you can also test your incident response procedures. See how quickly you can revoke access if a device is lost. Lucas: Exactly. And that's the kind of practical, step-by-step approach that makes zero trust not just a buzzword but a real improvement in security posture. Luna, I think we've covered a lot. For anyone building a security roadmap in 2026, ZTNA should be a priority. Luna: Agreed. Thanks for the deep dive, Lucas.