Zero Trust: from buzzword to workable strategy – and what becomes of the VPN

2026-08-07 · by SECURITYSQUAD

Few terms in information security are used as often, and explained as rarely, as zero trust. It is not a product category you buy but a stance: no access counts as trustworthy merely because it comes from the "internal" network.

Why the castle model no longer holds

For a long time security worked like a castle: a wall on the outside, free movement within. But once people work from home, data sits in the cloud and service providers need access, the line between inside and outside blurs. Anyone who gets past the wall has an easy time of it.

This is precisely where the classic VPN falls short. It is the workhorse of remote access: an encrypted tunnel into the corporate network, and the home office works as if it were in the building. That equivalence is the problem. After a successful login the user lands inside the internal network, often with far-reaching access. That holds as long as the boundary is unambiguous. When it is not – because a device was compromised, credentials fell into the wrong hands, or a provider is connected too – the tunnel becomes the door opener. An attacker with valid access moves sideways through the network (lateral movement) and reaches systems that have nothing to do with their actual task.

The core of it in one sentence: the VPN checks whether someone may enter, hardly what they reach.

VPN and zero trust compared

| | Classic VPN | Zero trust | |---|---|---| | Basis of trust | Location in the network | Identity, device state, context | | Scope of access | Network segment, often broad | Individual application | | When it is checked | Once at login | Continuously, on every access | | If credentials are stolen | The attacker is "inside" | Access stays limited to what is needed | | Lateral movement | Barely slowed | Impeded by segmentation |

This is not a holy war. The VPN will not vanish overnight – it should simply no longer be the only guard between a stolen password and your most important systems.

The load-bearing principles

The US standards body NIST set out the model as a reference in SP 800-207, "Zero Trust Architecture". Its core idea: protection is aimed at resources – applications, data, services, accounts – rather than network segments, because location in the network is no longer a sound security property. Four principles follow.

Identity first. Every access requires a proven identity. In practice that means multi-factor authentication on all relevant entry points – not only the VPN, but mailboxes, admin interfaces and cloud services too.

Least privilege. Accounts and systems get exactly the permissions they need. The most common breach of this is not an error but history: access grown over years that nobody ever withdrew.

Segmentation. The network is divided into zones so an incident cannot spread unchecked. Segmentation is the difference between an affected server and an affected company.

Assume breach. You plan as though an attack were already under way, and put the emphasis on rapid detection and containment rather than defence alone.

ZTNA: access to the application, not the network

In practice, broad network access gives way to application-level access, usually called **Zero Trust Network Access (ZTNA). A user reaches exactly the application they need – not the network segment behind it. Verification is continuous and takes the state of the device into account: is the disk encrypted, are updates applied, is endpoint protection running?

A practical benefit: ZTNA can be introduced application by application. You do not have to switch off the VPN in order to start.

The realistic route

It starts not with technology but with an inventory. Which applications are business-critical, who accesses them from where, what data hangs off them? Those "crown jewels" move first; the rest follows by risk. An order that has proven itself:

Name the crown jewels – ten systems, not a hundred.
Enforce multi-factor authentication on them without exceptions for "the management" or "the provider".
Clean up permissions. Who has access, who still needs it? This step costs nothing but time and often yields the most.
Bring in device state, at least for the critical applications.
Segment, so that one compromised account does not open the whole building.
ZTNA** for the critical applications, while the VPN carries on for the rest.

Each of these steps reduces implicit trust on its own. You do not need a big bang – and should not plan one.

What zero trust is not

Not a product. No vendor sells you zero trust; they sell building blocks for it. Buying a licence and ticking the box achieves nothing.

Not a project with an end date. It is a way of thinking that seeps into operations and procurement. That is exactly why it is feasible on limited means: you start where the leverage is greatest and grow from there.

Not a substitute for the basics. Without maintained patching, backups and logging, even the finest access control achieves little.

The pressure will come from outside anyway

For many companies this stopped being voluntary some time ago. Germany's NIS2 implementation act has been in force since 6 December 2025 – with no general transition period – and requires risk management measures from the entities in scope, including access control and traceability. ISO 27001 likewise requires managed access control on a least-privilege basis. Fine-grained access has moved from optional to obligatory.

If you are unsure where your greatest leverage lies, a structured inventory is the cheapest first step.

As at August 2026. NIST SP 800-207 "Zero Trust Architecture" (August 2020) is the authoritative reference; the accompanying practice guide NIST SP 1800-35 was published in June 2025.