Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Zero Trust Network Access
Transcript
- Lucas: If these conversations are useful for what you're building or running, I want to start today with a number that jumped out at me. The 2025 CrowdStrike Zero Trust Progress Report found that 73 percent of organizations have either implemented or are piloting Zero Trust Network Access — ZTNA — up from 41 percent just two years ago. Luna: That's a huge jump. And it's not like ZTNA is brand new — the term has been around since Forrester coined it in 2010. So what's driving this acceleration now? Lucas: Right. I think two things. First, the remote-work shift is permanent — but the VPN model that carried us through 2020 was never built for this scale. Every time a VPN gateway gets compromised, attackers get a beachhead inside the network. Second, the move to hybrid cloud means your corporate network boundary is basically imaginary. You've got workloads in AWS, Azure, a SaaS app, maybe a data center. ZTNA says: trust nothing, verify every request, regardless of where it comes from. Luna: So it's not just about replacing the VPN. It's a different philosophy altogether. Instead of 'you're inside the castle, so you're trusted,' it's 'you need to prove yourself for every single resource you touch.' Lucas: Exactly. And the market is responding. The ZTNA market was valued at roughly 4.5 billion dollars in 2024 and is projected to grow at a compound annual growth rate of over 24 percent through 2030. But I want to get specific about how it actually works, because the term gets thrown around a lot. Luna: Yeah, let's break that down. What is ZTNA doing differently under the hood? Lucas: In a traditional VPN, once you authenticate, you get an IP address on the corporate network. You can then probe for other machines, scan ports, move laterally. ZTNA flips that. It uses a per-session broker. You request access to a specific application — say, your ERP system — and the broker authenticates you, checks device posture, maybe checks location, and then creates a micro-tunnel just to that app. You never see the network. You never see other hosts. Luna: So it's replacing network-level access with application-level access. That feels like a meaningful reduction in attack surface. Lucas: It is. But here's the catch — and I'm glad you raised this — some critics argue that ZTNA just concentrates the attack surface on the broker itself. If someone compromises the ZTNA broker, they effectively control all access decisions. Luna: That's a real risk. We saw something similar with the Okta breach in 2024 — an identity provider compromise cascaded across hundreds of customers. If your ZTNA broker is the single throat to choke, you're creating a high-value target. Lucas: Right. And that's why the architecture matters. There are broadly three models. Cloud-delivered ZTNA — like Zscaler or Cloudflare Access — where the broker is in the cloud. On-premises ZTNA — like Palo Alto's Prisma Access. And peer to peer ZTNA — where the broker coordinates the connection but the data doesn't pass through it. Luna: The peer to peer model seems like it addresses the broker risk. Traffic never touches the broker, so even if it's compromised, the attacker can't intercept data. But does that make it harder to inspect traffic for threats? Lucas: That's the trade-off. With cloud-delivered, the broker can inspect all traffic for malware or data exfiltration. With peer to peer, you lose that visibility. So it's really about your threat model. If you're in finance or healthcare with strict compliance requirements, you might prefer the inspectability of cloud-delivered. If you're a tech company that values zero-trust data privacy, peer to peer might be worth the loss of deep inspection. Luna: And that's what I hear from security teams: ZTNA isn't a one-size-fits-all product. It's a design principle that you implement differently depending on your environment. Lucas: If today was actually useful to you, the way these stay ad-free is listener support. You can find that at buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small gesture that keeps us independent and focused on what's actually happening in the industry. Lucas: So back to the implementation question. I think the real world complexity is in the integration. Most enterprises don't start from scratch. They've got a legacy VPN, a bunch of on-prem apps that aren't built for ZTNA, and a mix of managed and unmanaged devices. How do you migrate? Luna: I've seen some organizations do a phased approach. Start with high-risk apps — maybe finance or HR systems that are accessed remotely — and leave internal-only apps on VPN for now. That way you prove the model without a rip and replace. Lucas: That's smart. And CrowdStrike's report actually found that the biggest barrier isn't technology — it's skills. 52 percent of respondents said they lack the internal expertise to deploy ZTNA correctly. Which makes sense. It's not just a new box to plug in; you need to map out every application dependency, define access policies, and continuously monitor. Luna: That's a huge gap. And it's a business problem, not just a technical one. If you can't staff it, you either pay a consultant a lot of money or you risk misconfiguring the whole thing. Lucas: Right. And misconfiguration is dangerous. In one case I read about — I think it was a manufacturing firm — they deployed ZTNA but left a legacy VPN as a backup. Attackers just went through the backup VPN. So the ZTNA was essentially a veneer. Luna: That's a good cautionary tale. You have to actually decommission the old stuff, not just overlay new stuff on top. Lucas: Exactly. And that brings us to the regulatory angle. The US federal government's zero trust mandate — Executive Order 14028 and the subsequent OMB memo — has pushed agencies to adopt ZTNA by 2027. That's creating a ripple effect in the private sector, especially for contractors. Luna: So compliance is becoming a driver. If you want to do business with the government, you need zero trust. That's going to accelerate adoption even more. Lucas: I think so. And we're starting to see insurance carriers ask about ZTNA in cyber insurance applications. Some are offering premium discounts for organizations that have implemented it. That's a powerful nudge. Luna: Do you think ZTNA will eventually make VPNs obsolete? Or will they coexist? Lucas: I think they coexist for a while, but the trend is clear. Gartner predicted that by 2025, 70 percent of new remote access deployments will be ZTNA rather than VPN. We're now halfway through 2026, and I'd say that's probably conservative. The only place VPNs will persist is for legacy apps that can't be proxied easily. Luna: And maybe for site to site connections between data centers. That's a different use case. Lucas: Good point. site to site VPNs aren't going away as fast. But for user to app access, ZTNA is becoming the default. The question is whether organizations can execute it well enough to actually realize the security gains. Luna: So what's the one thing you'd tell a CISO who's considering ZTNA right now? Lucas: Start small. Pick three applications that are critical and accessed remotely. Implement ZTNA for those. Measure the user experience, measure the security incidents. Then expand. Don't boil the ocean. And spend the money on training or hiring the right people — the technology is only as good as the policies around it. Luna: That's practical advice. I think a lot of CISOs feel pressure to check the 'zero trust' box, but it's really a journey, not a checkbox. Lucas: It is. And the vendors are making it easier — most of the major ZTNA platforms now offer free trials or proof of concept kits. So you can test without a big upfront commitment. I'd encourage any security leader to take advantage of that. Luna: Good place to start. Any final thought on where this is headed? Lucas: I think the next 18 months will see ZTNA become table stakes for enterprise security. The combination of remote work, cloud adoption, and regulatory pressure will make it a baseline requirement. But the real differentiator will be how well you integrate it with your identity management and endpoint detection. That's where the magic happens. Luna: Then let's hope organizations take the time to do it right. Thanks Lucas. Lucas: Thanks Luna. And to our listeners — if this topic is relevant to your work, I hope you found something useful. We'll be back with another episode soon.