For companies with 50 to 500 employees, the internet-facing VPN box has become one of the most reliable entry points attackers probe first. The alternative, zero trust network access, closes that door for a few dollars per user each month, and the shift is now a practical, near-term project rather than a distant upgrade.
A traditional VPN works on an old assumption: once someone signs in, they are inside the office network, trusted by default. Zero trust rejects that premise entirely. Instead of handing over the whole network, it connects each person only to the specific applications they need, and it checks both the user and the device on every session rather than once at login. That distinction, outlined in federal zero trust guidance from NIST, is the heart of the debate. It also matters for everyday usability - remote staff weighing the switch often ask about how much a VPN slows down your connection, since routing all traffic through a central office box can add latency that a direct, app-specific zero trust connection avoids.
The Math Behind the Risk
The appeal of a VPN was always simplicity: one login, full access. That simplicity is also its weakness. A single unpatched flaw in the VPN appliance can expose an entire network, and attackers frequently exploit these flaws before a vendor even issues a fix. Cyber insurer Coalition reported that 58% of its 2024 ransomware claims began with a compromised VPN or firewall. The federal cybersecurity agency CISA maintains a running list of vulnerabilities already exploited in the wild, and it includes 60 separate flaws across VPN and firewall products from Fortinet, Cisco, Ivanti and Palo Alto Networks - half of them tied directly to ransomware incidents. When Ivanti's devices were compromised in early 2024, CISA's response was blunt: disconnect every affected box and rebuild it from scratch. That is not a patch cycle; that is a full teardown.
Where a VPN Still Makes Sense
Retiring the remote-access VPN does not mean eliminating VPN technology altogether. A site-to-site VPN linking two of a company's own offices is a different tool with a different risk profile, and it can stay. Industrial or plant equipment that must be reached from outside should also remain off the open internet, protected by a VPN that requires a physical security key or similar multi-factor authentication. And a small group of staff can reasonably stay on a patched, MFA-protected VPN as a temporary bridge while their applications migrate. Beyond those narrow cases, though, most employees - office staff, managers, field teams - are better served by zero trust from day one.
Planning the Move Without Disruption
The transition does not need to happen overnight, and it should not. A realistic timeline runs about a quarter: turn on MFA for the existing VPN immediately, inventory who connects remotely and which applications they use, pilot the move with one team and one application, then roll out in waves while the VPN keeps running in parallel. Nobody loses access on a Monday morning. Pricing is modest - Cloudflare offers a free tier for smaller pilot groups, while Microsoft's Entra Private Access runs around $5 per user monthly for eligible 365 plans, or roughly $7,200 a year for a 120-person firm. Set against Coalition's reported average ransomware claim of $269,000 in 2025, that cost looks less like an expense and more like insurance that also happens to improve daily usability.