A single unpatched VPN box can hand an attacker the keys to an entire company network, and that reality is pushing small and midsize firms toward a different model of remote access. For organizations with roughly 50 to 500 employees, the calculation increasingly favors zero trust network access over traditional VPNs. The internet-facing VPN appliance that lets staff work remotely is also one of the first targets attackers probe when hunting for a way in, and the fix does not require a large security budget.
The distinction between the two approaches is structural, not cosmetic. A VPN, once a user signs in, typically places that person on the broader office network, with access governed largely by what the network itself allows. Zero trust network access, or ZTNA, works differently: it connects each user only to the specific applications they are authorized to use, and it checks both the person and the device at every session rather than once at login. That per-session verification model is the foundation of the federal zero trust guidance issued by the National Institute of Standards and Technology, and it reflects a broader shift in cybersecurity thinking away from "trust once, verify never" toward continuous verification. Firms exploring the switch can find where to compare the plans across providers before committing to one architecture. where to compare the plans
Why the VPN Box Became a Liability
The core problem with perimeter VPNs is concentration of risk. One flaw in the box that faces the internet can expose the whole network behind it, and attackers frequently exploit these vulnerabilities before a patch exists. That turns routine maintenance into a race against time that even disciplined IT teams cannot always win. Cyber insurer Coalition has reported that more than half of its 2024 ransomware claims traced back to a compromised VPN or firewall. The federal Cybersecurity and Infrastructure Security Agency maintains a running catalogue of vulnerabilities that have already been exploited in the wild, and it includes dozens of entries tied to VPN and firewall products from major vendors, many linked directly to ransomware incidents. When one widely used vendor's devices were compromised in early 2024, CISA directed federal agencies to disconnect and rebuild every affected unit rather than simply patch it.
Where a VPN Still Makes Sense
Retiring VPN access entirely is not realistic for every scenario, and three exceptions remain legitimate. Site-to-site VPNs, the always-on links between a company's own offices, serve a different purpose and can stay in place. Industrial equipment that must be reachable from outside should remain off the open internet and behind a VPN secured with hardware-based multi-factor authentication, in line with federal guidance for operational technology. And a short-term bridge VPN, protected by MFA and kept patched, can support a small group of users while their applications are migrated to zero trust. Outside of these narrow cases, most employees are better served by a zero trust model.
Cost, Timeline and the MFA Gap
Zero trust access typically costs a few dollars per user each month, a modest sum next to the average ransomware claim insurers now report. Firms can pilot the approach at no cost on smaller plans before scaling up, and the transition can be managed over roughly a quarter, moving one team at a time while the existing VPN stays operational. Multi-factor authentication helps but does not eliminate risk entirely: some VPN vulnerabilities allow attackers to bypass login screens altogether, and security teams have documented account takeovers even where MFA was active. Treating outside vendors and contractors with the same scrutiny as employees, including individual logins and restricted access scoped to the equipment they actually support, closes another gap that generic remote-access policies tend to leave open.