www.simplify-data.de
For remote access to company data, the traditional VPN has been the standard for years. Increasingly, though, offers and articles mention zero trust network access (ZTNA). Both connect employees to internal applications, but they follow different logic. This article compares them in concrete terms and shows which questions to answer before deciding.
How a traditional VPN works
A VPN (virtual private network) builds an encrypted tunnel between an employee's device and the company network. After login, the device behaves as if it were in the office. It receives an internal IP address and can, in principle, reach every system that is reachable on the local network.
This model follows the principle "inside is trusted, outside is not". The check happens once at the entrance, when the connection is established. After that, the device is largely trusted.
That has practical advantages: VPNs are familiar, well documented and work with almost any application because they operate at network level. The weaknesses show when something goes wrong:
- Overly broad access: a compromised laptop with a VPN connection can see the entire network, not just the application the user needs.
- Lateral movement: attackers who get into the network can move from system to system.
- Exposed entry points: VPN gateways are reachable from the internet and therefore a popular target. Vulnerabilities in VPN products need to be patched quickly.
How zero trust network access works
ZTNA applies the zero trust principle to remote access. The core idea: no access is granted simply because a device sits in a particular network. Every connection to an application is checked individually based on identity, device and policy.
The US National Institute of Standards and Technology (NIST) describes this architecture in publication SP 800-207. Two ideas are central:
- Least privilege: every user and device only gets the rights needed for the task at hand. Accounting reaches the finance software, but not the development server.
- Per-resource access: instead of access to the whole network, users get access to individual applications or services. Everything else stays invisible to them.
Technically, a policy enforcement component sits between user and application. Depending on the solution, this is a gateway, a proxy or a client that only allows specific connections. Internal applications do not have to be directly exposed to the internet.
Side-by-side comparison
| Criterion | Traditional VPN | ZTNA |
|---|---|---|
| Core principle | trust after successful login | every connection is checked |
| Scope of access | usually the whole network or large subnets | individual applications and services |
| When checks happen | at connection setup | on each access or continuously |
| Device checks | often absent | frequently part of the policy |
| Lateral movement | easily possible | strongly restricted |
| Visibility of internal services | visible inside the tunnel | only approved services |
| Rollout | simple, familiar | requires more planning |
| Application support | almost any protocol | depends on the solution |
Common misconceptions
"ZTNA replaces encryption": No. ZTNA solutions also use encrypted connections, often built on VPN protocols such as WireGuard or on TLS. The difference is not the encryption but who may access what.
"A VPN is automatically insecure": Not true either. A well-configured VPN with multi-factor authentication, segmented networks and restrictive firewall rules can already implement many zero trust ideas. Conversely, a poorly maintained ZTNA solution offers no protection.
"ZTNA is only for large enterprises": Smaller companies with a few clearly defined applications can often define access rules in a very manageable way.
"Zero trust means trusting nobody": What it means is that trust is not granted wholesale but justified for each access.
Which approach fits when
A traditional VPN can still make sense when a few people need administrative access to an entire network or legacy applications only work at network level. In that case, access should be limited to a small group and well secured.
ZTNA has the edge when many employees work remotely, external service providers need access, or different groups use different systems. Fine-grained permissions also help when you need to demonstrate controls such as access management and multi-factor authentication, for example under NIS2.
In practice, the transition is gradual. Many companies start with a VPN and restrict access step by step until every user can only reach their own applications.
Questions for vendors and service providers
Whether a product is marketed as VPN or ZTNA says little about its actual security. Ask concrete questions when comparing offers:
- At what level is access controlled: per network, per host or per application?
- How are identities connected, and is multi-factor authentication mandatory?
- How quickly can access for a device or person be revoked?
- Which access events are logged, and who can view the logs?
- Where is management data stored and operated?
- Which components are reachable from the internet?
Steps for the transition
- List applications: record every system that needs to be reachable remotely.
- Define user groups: map which role actually needs which application.
- Secure identities: introduce multi-factor authentication for all remote access.
- Include devices: decide which devices are allowed and what minimum state they need, such as current updates.
- Start with a pilot group: test the new rules with a small group and one manageable application.
- Retire old access: close broad network access only once the new access paths work reliably.
- Log and review: analyse access regularly and remove permissions that are no longer needed.
Zero trust network from Simplify Data
Simplify Data operates a zero trust network for companies based on WireGuard. It combines the encryption of a modern VPN protocol with access rules based on least privilege. If you would like to review your current remote access, get in touch. View zero trust VPN