The main alternatives to a traditional VPN are zero trust network access, identity aware application proxies, bastion or jump hosts with short lived credentials, and per application tunnels. All of them grant access to one resource at a time after checking who and what is asking, instead of placing the user on the whole network.
Why look beyond the VPN at all?
A classic remote access VPN puts a laptop onto an internal network. From there, anything reachable by routing is reachable by the user, and by anyone who steals the session. The VPN gateway is also an internet facing device that needs patching.
NIST SP 800-207 describes the alternative. Zero trust, in its words, assumes no implicit trust based on network location or asset ownership, and treats authentication and authorization of both user and device as separate steps performed before a session to a resource starts. It names remote users, bring your own device and cloud assets outside the enterprise network as the trends driving the change.
What are the main options?
Zero trust network access. A broker sits in front of applications. The user and device are checked, a policy decides which application they may reach, and the broker connects them to that application only. Nothing else is routable.
Identity aware proxy. For web applications, a reverse proxy requires single sign on and device signals on every request. No client software is needed, which suits contractors.
Bastion or jump host. For servers, an administrator connects to one hardened host and from there to targets. Pair it with short lived certificates or session recording so there are no standing keys.
Per application tunnel. A small agent next to the application makes an outbound connection to a broker. The application has no inbound port open to the internet.
A VPN with better scoping. Sometimes the right move is to keep the VPN and tighten it: split access by group, require phishing resistant multifactor authentication, and keep the gateway patched.
How do the options compare?
- Blast radius: ZTNA, proxies and tunnels are narrow by design. A VPN is wide unless you segment it.
- Legacy protocols: VPNs and some ZTNA products handle arbitrary traffic. Web proxies handle HTTP only.
- Operations: a bastion is simple but manual. A broker needs policy upkeep.
- User experience: proxies need nothing installed. Agents and VPN clients do.
The Selecting and Hardening Remote Access VPN Solutions guidance from the NSA and CISA is worth reading if you keep a VPN. The page I tried to fetch for it returned an error today, so check the agency site for the current copy before relying on details.
A constructed example
A 60 person software company has a VPN that gives every engineer access to the staging network, the build servers and the database subnet. A contractor leaves; their account stays active for three weeks.
The team moves in three steps. Web tools such as the wiki and the build dashboard go behind an identity aware proxy that checks group membership. Server administration moves to a jump host with certificates that expire after eight hours. The database becomes reachable only through a per application tunnel for the two services that need it. The VPN is switched off for staff after a month of parallel running.
How to check or apply this
- Inventory what people reach over the VPN today, by application and by group. Gateway logs usually give this.
- Sort applications into web, server shell, database and legacy.
- Pick one pattern per group, and start with web applications because they are the easiest.
- Require multifactor authentication and a device check on every path.
- Replace standing SSH keys with short lived credentials.
- Run old and new in parallel, compare logs, then remove VPN access group by group.
- Keep a break glass path with alerting, so an outage does not lock you out.
Quick check
Is ZTNA just a VPN with a new name?
No. The difference is scope. A VPN joins you to a network. ZTNA connects you to a named application after checking policy, so lateral movement is far harder.
Can small teams do this without buying a product?
Often yes. A jump host with short lived certificates and an identity aware proxy in front of web tools covers a lot, using components many teams already run.
Sources
Last reviewed: 18 October 2026.
