Insights · Field note · Security assurance and compliance
Secure remote access after VPNs
The VPN put remote users on the network. The replacement puts them in front of the application they need and nowhere else.
A VPN extends the network to a remote user; once connected, the user is inside and reaches whatever the network allows. Secure remote access after VPNs grants each request to each application on the identity, the device’s posture and the context, without placing the user on the network at all. A phished credential then yields one identity’s applications on a checked device, with every request logged, rather than the network. The transition moves applications behind an access layer one at a time, keeps the VPN for the few cases that need network connectivity, and begins with phishing-resistant authentication because both models fail when the identity is trivially stolen.
In detail
What the evidence shows.
What changes
Access is per application, not per network. The access layer verifies identity with phishing-resistant MFA, checks device posture, applies policy by context and proxies the connection. The user sees the application; the network is not exposed. NIST SP 800-207 describes the architecture and its components.
Why it contains breaches
Attackers target VPN credentials and appliances because success puts them inside the perimeter. With per-application access there is no inside to reach. A compromised identity reaches what that identity was permitted, on a device that passed posture, with the requests recorded.
The transition
Inventory applications and who needs them. Put an identity platform and device posture in place. Move applications behind the access layer starting with the ones attackers target: email, remote desktop, administrative consoles, file shares. Retire VPN access per application as it moves. Keep the VPN only for site-to-site connections, legacy protocols and operational technology that genuinely need network-level connectivity.
Vendors and contractors
Third-party access is the first candidate for the new model: a named identity, a specific application, a time-limited grant, logged. See secure remote access, zero trust versus VPN and device posture and conditional access.
Sources
Primary references.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days