The VPN made sense in a world where the office was the network and remote access was the exception. You dialled into the perimeter, and once inside, you were trusted.
That model has three problems, and all three have got worse.
It gives away too much
A traditional VPN puts the user on the network. Not on an application, on the network. Someone who needs one line-of-business system gets a route to every device on the subnet, including the ones nobody has patched since installation.
This is why VPN credentials are such a prize. A single compromised login does not get an attacker a foothold, it gets them the inside of your network with the perimeter already behind them.
It is slow in a way people route around
Traffic is backhauled to a concentrator and then back out again. For a user in Cape Town reaching a system in Cape Town through a concentrator somewhere else, the detour is pure added latency. Slow tools do not get used carefully, they get avoided, and the workaround is usually worse than the thing it replaced.
It is a single point of failure you own
The appliance has to be sized, licensed, patched and replaced. When it goes down, nobody works. When a critical vulnerability is published for it, you are in a race with people scanning the internet for exactly that appliance.
What replaces it
Zero Trust Network Access inverts the model. Instead of admitting a user to a network, it connects a specific verified user on a specific verified device to a specific application. Nothing else is reachable, and nothing is reachable by default.
- Access is granted per application, so a compromised account exposes what that account could reach and no more.
- Connections are direct and encrypted peer-to-peer, so there is no concentrator to backhaul through and no appliance to fail.
- Policy follows the user and the device rather than the network they happen to be on.
- You get a usable audit trail of who reached what and when, which matters when compliance asks.
The honest caveats
Zero Trust is not a product you buy and finish. It needs you to know which applications exist and who should reach them, and that inventory is often the hard part. Some legacy systems will need a gateway in front of them. And a badly configured Zero Trust deployment that grants everyone access to everything is just a VPN with better marketing.
Done properly it is faster for users and considerably smaller as an attack surface.
Cloud29 ZTNA is built on NetBird, with the management plane hosted on our own infrastructure in South Africa. We set it up with you, including the part where we work out what should reach what.