5 MIN READ
The legacy tunnel was designed in 1996, and the network perimeter it was built to protect has not existed in most enterprises since 2010. The remote work landscape is not 1996. A user is working from a coffee shop on a public network, accessing applications that live in a SaaS provider’s infrastructure rather than a corporate data centre. The VPN was designed to solve a problem that no longer matches the one organisations are trying to solve, and organisations are moving to four other approaches that match the problem better.
This piece is for the security orgs looking at a VPN renewal and asking whether to renew, and for the platform teams being asked to support the migration to whatever comes next. The answer, as is usually the case, is “it depends” with a long footnote.
1. Zero trust network access (ZTNA)
ZTNA runs as the direct replacement for the VPN, and the direct replacement is what most enterprises are converging on. The premise is straightforward. The user authenticates to an identity aware proxy, the proxy checks the device posture, the proxy grants access to the specific application the user is allowed to reach, and the proxy does not hand over the rest of the corporate network.
ZTNA fixes the two things the VPN got wrong, starting with over granting. The VPN hands the user access to the whole network. ZTNA hands the user access to the specific application. Implicit trust is the second issue. The tunnel trusts the user once they have authenticated. ZTNA re-authenticates on every request. The result is a posture that is closer to the way the modern enterprise actually works, and a posture the compliance side can defend in the audit.
Cloudflare Access, Zscaler ZPA, Palo Alto Prisma Access, Tailscale, and the open source equivalents are the vendors to evaluate. The buying decision comes down to integration with the rest of the stack more than the underlying technology. The field is mature across the board.
2. Browser based isolation (RBI)
Remote browser isolation runs the user’s browsing session in a remote container, streams the pixels back, and prevents any code from the remote site from running on the user’s device. The use case is the user who needs to access a legacy application that cannot be exposed to the internet, or the user who needs to handle untrusted content, or the user who needs to be protected from malicious content without an endpoint agent.
Menlo Security, Authentic8, and the island enterprise browsers are the vendors to evaluate. RBI sits as the right answer for a specific set of use cases, and the wrong answer as a general purpose replacement for the VPN. The general purpose replacement is ZTNA.
3. Software defined perimeter (SDP)
SDP sits as the closest cousin of ZTNA, and the difference comes down to deployment model. SDP is typically deployed as a controller and a set of clients, with the controller dynamically granting access to specific resources based on the user’s identity and the device’s posture. Zscaler, Cisco, and the open source equivalents (WireGuard based meshes) are the vendors to evaluate.
SDP is a strong choice for organisations with the in house networking expertise to manage the controller, and a less strong choice for those that would rather buy the management as a service.
4. The hybrid approach
Most enterprises are not picking one approach. They are picking a hybrid, and the hybrid usually looks like ZTNA for the new applications, RBI for the legacy applications that cannot be exposed, and the tunnel for the long tail of resources that nobody has gotten around to migrating. The hybrid stands as the right answer for the next three years, and the right answer for the year after that runs as the long tail finally being migrated off the VPN.
What to do about it
If you are evaluating a VPN renewal, the right move is to start a parallel ZTNA deployment for the highest value applications, and to migrate the user base over the course of the renewal period. The migration is not free. The licensing is different, the support model is different, the integration with the rest of the stack takes work, and the migration pays off in the year the renewal comes up.
If you are running a ZTNA already, the right move is to retire the tunnel for the applications that have been migrated, and to keep the tunnel for the long tail. The hybrid stands as the answer, and the hybrid is not a permanent answer. The hybrid runs as the bridge to the post tunnel world.
If you are still buying a new tunnel, the right move is to think hard about whether the business actually wants to be in the tunnel business for the next three years, or in the ZTNA business. The cost difference is smaller than the marketing decks suggest, and the operational difference is large.
The bottom line
The hybrid stands as the right answer for the next three years. ZTNA for the new applications, RBI for the legacy that cannot be exposed, tunnel for the long tail, and a written plan to shrink the long tail over the renewal cycle. Run the parallel deployment now, retire the tunnel for the migrated applications as each one crosses over, and stop calling the tunnel a strategic asset once the renewal cycle ends.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
