Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Zero Trust Network Access
Transcript
- Lucas: So earlier this week I was talking to a CISO at a mid-sized financial services firm — about eight hundred employees — and he told me they shut down their VPN last month. Completely. Switched to a Zero Trust Network Access model, or ZTNA. Luna: That is a big step. Most companies I talk to are still running VPNs for remote access, even if they hate them. Lucas: Right, and the reason they hate them is the same reason attackers love them. A VPN gives you a key to the entire corporate network. Once you're in, you can move laterally, scan for vulnerabilities, poke around. ZTNA flips that model — it grants access to a specific application, not the network. Luna: So it's more like a per-app tunnel rather than a network-level gateway. Lucas: Exactly. And the authentication is continuous. With a VPN, you log in once and you're trusted for the session. ZTNA checks identity, device posture, location — every request, every time. That CISO told me they saw an 80 percent reduction in their attack surface after the switch. Luna: Eighty percent — that's dramatic. Was it hard to get users on board? People are used to the VPN client just working. Lucas: That's actually the interesting part. Modern ZTNA solutions use a software-defined perimeter — essentially a broker that sits in front of the applications. The user authenticates via single sign-on, the broker checks device compliance — is the antivirus running, is the OS patched — and if everything passes, it creates a direct, encrypted connection to the specific app. The user never sees a network. They just open their browser, log in, and the app is there. Luna: So the user experience can actually be better than VPN — no more connecting to a virtual adapter, no more routing all traffic through the corporate gateway. Lucas: Right. And that's a huge selling point internally. The CISO I spoke with said login times dropped from about 15 seconds with the VPN to under two seconds with ZTNA. That's because the broker is cloud-delivered, so there's no backhauling traffic through a data center. Luna: I've heard that cloud-delivered ZTNA is the dominant model now — something like 70 percent of new deployments are cloud-based rather than on-prem. Lucas: Yeah, Gartner's latest forecast puts cloud-delivered ZTNA at about 60 percent of the market by the end of this year. The on-prem version still exists for heavily regulated industries — defense, critical infrastructure — but the cloud model scales better and costs less upfront. Luna: And that cost question — what are we talking per user? I've seen numbers ranging from $10 to $30 a month. Lucas: For a cloud ZTNA service, you're looking at roughly $15 to $25 per user per month, depending on features. That's comparable to a good VPN service, but you're not paying for the VPN concentrators, the maintenance, the patching. One estimate I saw from a Forrester study showed that organizations save about 30 percent in operational costs over three years by moving to ZTNA. Luna: And those savings don't even factor in the cost of a breach. The average vpn related breach last year — I think the IBM cost of a data breach report put it at over $4 million. Lucas: It was $4.35 million for breaches where compromised credentials were the initial vector. And VPNs are a favorite target for credential stuffing and brute force. ZTNA eliminates that because there's no public-facing VPN endpoint to attack. The broker is designed to be invisible to scanners. Luna: So the broker doesn't respond to port scans or connection attempts unless the device is authenticated first. Lucas: Exactly. It's a core principle of the software-defined perimeter — 'black cloud' approach. The server is dark until the client proves it's allowed to talk. This is why the NSA actually recommended ZTNA in their recent guidance on securing remote access. Luna: I didn't know that. So it's not just a commercial trend — it's being baked into national security recommendations. Lucas: Absolutely. And the same CISO I talked to said one of the biggest surprises was how much easier it made compliance. Their auditors used to want logs of every VPN connection — who connected, from where, for how long. With ZTNA, the broker logs every application session automatically, so they can produce a report in minutes instead of days. Luna: That is a nice side benefit. Before we go deeper — and this is something I've been thinking about — I want to mention that if these conversations are useful for what you're building or running, listener support is what keeps this show ad-free and independent. You can help at buymeacoffee.com/fexingo. Lucas: Thanks for that, Luna. And yeah, it's a small way to keep the episodes focused on the substance rather than on sponsors. So back to ZTNA — one thing I want to clarify is that ZTNA is not a product you buy from one vendor and install. It's an architecture. You typically need an identity provider, a device management system, and the ZTNA broker itself. Luna: Right. And many organizations already have the identity piece — they're using Azure AD or Okta. So the ZTNA layer integrates with that. Lucas: Exactly. The broker just adds the access control logic. And there are different implementation models. The two main ones are client-initiated and service-initiated. Client-initiated is what I described — the user's device runs a small agent or uses a browser that talks to the broker. Service-initiated is more common for data center workloads, where the broker reaches out to the application on behalf of the user. Luna: So service-initiated is more for server to server communication, not end-user remote access. Lucas: Right. For remote employees, client-initiated is the standard. And the agent is usually lightweight — a few megabytes, no constant updates. Some vendors offer a fully browser-based experience where you don't even need an agent. Luna: That browser-based approach is becoming more popular, especially for contractors or third-party vendors who shouldn't have a corporate agent on their personal device. Lucas: That's a perfect use case. And it ties into another trend — the idea of a 'zero-trust architecture' that includes ZTNA plus microsegmentation plus continuous monitoring. ZTNA handles the remote access piece, but once you're inside the data center, microsegmentation ensures that even if an attacker compromises one app, they can't pivot to another. Luna: So ZTNA is really the entry point for zero trust, not the whole picture. Lucas: Exactly. But it's the piece that most organizations start with because remote access is such a clear pain point. And the ROI is easy to measure — fewer vpn related incidents, lower operational costs, happier users. That CISO told me his help desk tickets for VPN issues dropped by 90 percent. Luna: Wow. That frees up a lot of IT time for higher-value work. Lucas: And that's the kind of metric that gets CFOs on board. I think we're going to see ZTNA become the default for remote access within the next three years, just like we saw cloud email gateways replace on-prem spam filters. Luna: I think you're right. And for companies still on the fence, the key takeaway is: start with a pilot for a single application, measure the user experience and the security impact, and then expand from there. Lucas: That's exactly what the firm we talked about did. They started with their CRM — one app, fifty users — and within a month, they knew they wanted to move everything. So if you're listening and you're still running that old VPN, maybe that's the first step. Luna: And maybe the next episode we can talk about how microsegmentation works in practice — because that's the next logical layer. Lucas: I'd love that. Let's do it.