For a company with 50 to 500 employees, the internet-facing VPN box is one of the first targets an attacker will probe. That single point of entry, once compromised, can expose an entire office network. The emerging consensus among security practitioners is straightforward: zero trust access has become the more defensible default, and the shift costs little more than a few dollars per user each month.
The mechanics explain why. A traditional VPN authenticates a user once, at login, then grants broad access to the internal network as though the person were sitting at a desk in the office. Zero trust network access, or ZTNA, works differently: it connects each user only to the specific applications they need, and it re-verifies both the person and the device on every session rather than just at sign-in. That distinction, laid out in the federal government's own zero trust guidance from NIST, is the difference between opening a single door and handing someone the keys to the building. Firms comparing providers and approaches can check it out before committing to a migration path, since pricing and feature sets vary across vendors. check it out
The Numbers Behind the Risk
The exposure is not theoretical. Cyber insurer Coalition reported that 58 percent of its 2024 ransomware claims began with a compromised VPN or firewall device. CISA, the federal cybersecurity agency, maintains a running catalog of vulnerabilities that attackers have already exploited in the wild. That list includes 60 known flaws across the firewall and VPN products sold by Fortinet, Cisco, Ivanti and Palo Alto Networks, roughly half of which were used in ransomware campaigns. When Ivanti's appliances were breached in early 2024, CISA's response was not a patch request but an order for federal agencies to disconnect every affected box and rebuild it from scratch.
That pattern reflects a structural problem rather than a one-off failure. A single flaw in a VPN appliance can open an entire network, and attackers frequently exploit those weaknesses before a vendor has shipped a fix. Multi-factor authentication helps, but it does not close every gap. Some VPN vulnerabilities, including one of Ivanti's from January 2024, allowed attackers to bypass authentication entirely. Investigators at Mandiant found that three of the four most commonly exploited flaws in their 2024 caseload were used before any patch existed. MFA is a useful layer, not a guarantee.
Where a VPN Still Makes Sense
Retiring the VPN does not mean eliminating it everywhere. Three narrow use cases remain legitimate. Site-to-site VPNs, the always-on links between a company's own offices, are a different category of tool and can stay in place. Plant equipment that must be reached remotely should, under federal guidance, remain off the open internet and be accessed only through a VPN secured with a physical security key or equivalent MFA. And a small group of users can stay on a patched, MFA-protected VPN temporarily while their applications are migrated. None of these exceptions justifies delaying the broader move.
Planning the Migration
The practical path runs over roughly a quarter, moving one team at a time while the existing VPN keeps functioning, so nobody loses access overnight. The sequence typically starts with enabling MFA for every remote connection, including contractors and vendors, followed by an inventory of who connects from outside and which applications they use. One team and one application move first as a pilot, then the rest follow in waves before the VPN is switched off entirely.
- Pilot deployments for small teams are often available free on entry-level plans.
- Microsoft's Entra Private Access runs about $5 per user monthly on qualifying Microsoft 365 plans.
- For a 120-person company, that works out to roughly $7,200 annually, a modest sum next to the average ransomware claim, which Coalition put at $269,000 in 2025.
Outside vendors deserve the same scrutiny as employees: individual logins, mandatory MFA, and access restricted to only the systems they support. CISA has specifically warned that unrestricted vendor remote access introduces unnecessary risk. For manufacturers, federal guidance on plant equipment adds a further requirement, limiting remote access to the specific machine and role involved, and disabling accounts no longer in use. The underlying lesson holds across industries: the fewer doors left open to the internet, the smaller the target a company presents.