Remote work stopped being the exception years ago. Today employees connect from home, from client sites, from airports, using corporate laptops, personal devices and networks that nobody in your company controls. The security model we designed for an office with a clear perimeter no longer fits that reality.
VPN was the answer for decades. Zero Trust is the alternative that has been gaining ground for years. But neither is universally better: they are different tools that solve different problems, and the right choice depends on how your company works, what systems it protects and what resources it has to manage it.
How each model works
VPN · Virtual Private Network
- Creates an encrypted tunnel between the user's device and the corporate network
- Once connected, the user has access to the whole network (or a broad segment)
- Verification happens at connection time: username + password (and sometimes MFA)
- The VPN server lives in your infrastructure or in the cloud
- The model assumes everything inside the network is trusted
Zero Trust · Never Trust, Always Verify
- There is no "trusted network": every access is verified individually
- Access is granted resource by resource, not to the whole network
- Continuously verifies: identity, device, location and behaviour
- Works equally for office, cloud or SaaS resources
- The principle: never trust, always verify
The fundamental difference is the scope of access after authentication. With a VPN, connecting is like entering a building: once inside, you can move fairly freely. With Zero Trust, every door in the building has its own access control and is checked every time you pass through it.
The real problem with VPNs today
VPNs are not insecure by design, but they have limitations that become more apparent as companies adopt more cloud services and remote work becomes the norm:
Too broad access
The typical VPN model connects the user to a complete network segment. If an attacker compromises any employee's credentials, they have access to everything that employee can see from the VPN. In environments where critical resources are all on the same network, the blast radius of a compromise is very large.
Not designed for the cloud
If your applications are on AWS, Google Workspace, Microsoft 365 or any SaaS, your employees' traffic makes an unnecessary journey: from the device to the VPN server, from the VPN server to the cloud service, and back. That detour introduces latency and adds no security when the final destination is outside your network anyway.
Scalability and performance
The VPN server is a bottleneck. With many users connected simultaneously, the capacity of the VPN concentrator limits the performance of the whole organisation. Scaling means buying more hardware or more cloud capacity.
Unmanaged devices
A VPN authenticates users, not devices. If an employee connects from their personal computer with outdated software or malware, that device has the same access as a well-configured corporate one.
Relevant data: according to multiple 2026 cybersecurity reports, more than 60% of unauthorised access incidents in European SMEs occurred through compromised VPN credentials, not technical vulnerabilities in the VPN server itself.
What Zero Trust means in practice
Zero Trust is a security principle, not a specific product. It is implemented through a combination of tools that together ensure every access is verified based on multiple factors:
- Verified identity: mandatory multi-factor authentication, always
- Device posture: only compliant devices can access (up-to-date updates, active antivirus, disk encryption)
- Access context: location, time and the user's usual behaviour influence whether access is granted or additional verification is required
- Least privilege: each user only accesses the resources they need for their job, nothing more
- Microsegmentation: resources are isolated from each other; compromising one doesn't give access to the rest
The most common practical implementation in SMEs is known as ZTNA (Zero Trust Network Access): it replaces the VPN for access to specific applications without needing to connect the device to the whole network.
Direct comparison
| Criterion | Traditional VPN | Zero Trust / ZTNA |
|---|---|---|
| Access granularity | Network or segment access | Per application/resource |
| Device visibility | Limited | Full (device posture) |
| User experience | Variable, sometimes slow | Transparent, direct access |
| SaaS/cloud compatibility | Poor (traffic detoured) | Native |
| Initial setup complexity | Low–medium | Medium–high |
| Cost for small teams | Low (free open-source solutions) | Medium (from ~€5–10/user/month) |
| Scalability | Limited by concentrator | High (distributed infrastructure) |
| Protection against stolen credentials | Low without MFA + segmentation | High (verifies device + context) |
Concrete scenarios: what to use in each case
If your applications are all SaaS (Microsoft 365, Google Workspace, cloud CRM, cloud ERP), a VPN adds no real value — there's no internal network to protect. What you need is robust identity management with MFA, conditional access policies and device posture control. Tools like Cloudflare Access or Tailscale cover this at very accessible cost.
If you have a file server, local ERP or internal applications that are not in the cloud, you need remote access to that infrastructure. A well-configured VPN with MFA is still a valid and economical solution. If you also handle sensitive data or have many remote users, ZTNA (e.g. with Tailscale or Cloudflare Tunnel) gives more control without much extra cost.
With geographically distributed teams, routing all traffic through a central VPN concentrator becomes an operational problem. ZTNA allows each user to access directly the resource they need from the nearest point of presence, without going through a central office.
OT/IT environments with industrial equipment, PLCs or SCADA systems rarely have the ability to integrate with modern ZTNA solutions. A VPN with strict network segmentation (access only to the industrial segment, not the whole network) remains the most practical and secure model for these environments.
Giving VPN access to third parties means giving them access to your network. With ZTNA you can give access only to the specific application they need, for the time they need, with device verification. It is much more secure and easy to revoke.
Tools: what's available and how much it costs
VPN
The modern VPN protocol par excellence. Faster, lighter and easier to audit than OpenVPN or IPSec. Can be installed on any Linux server in minutes. Ideal for companies with internal technical capability that want full control without licence costs. Also available in managed form via tools like Headscale (open source) or as the basis of Tailscale.
The historical standard of corporate VPN. Mature, well-supported and with clients for all operating systems. The Community version is free; OpenVPN Access Server (commercial version) charges per additional user. Suitable when you need compatibility with older devices or systems.
Zero Trust / ZTNA
The most accessible option to start with Zero Trust. Built on WireGuard, it creates an encrypted mesh network between all authorised devices. No port opening or firewall configuration required. Each device authenticates with an identity account (Google, Microsoft, GitHub). The admin console allows you to define which devices can access which resources. For small teams, the free tier may be sufficient.
Part of the Cloudflare Zero Trust ecosystem. Allows publishing internal applications (even on servers without a public IP) behind a Cloudflare proxy, with access policies based on identity, device and context. The free tier is very generous for SMEs. Integrates with any identity provider (Google Workspace, Azure AD, Okta).
Can I have both at once?
Yes, and it's more common than you might think. Many companies maintain a VPN for access to legacy or industrial systems where ZTNA is not viable, and use Zero Trust for the rest of remote accesses: web applications, cloud resources, SaaS tools. They are not mutually exclusive.
The most common strategy in transitioning SMEs is to maintain the existing VPN while implementing ZTNA for new use cases, and gradually migrate as the new model is validated.
Where to start if you're evaluating the change
If you currently use VPN and want to evaluate whether Zero Trust makes sense for your business, the starting point is answering three questions:
- Where are your applications? If most are cloud or SaaS, Zero Trust delivers more immediate value.
- How many external users (freelancers, suppliers) need access? The more external parties, the more sense Zero Trust makes.
- Have you had security incidents related to remote access? If yes, that's the most direct argument to review the current model.
There is no universal answer. What does exist is an honest assessment of what you protect, how your team works and what resources you have to manage the chosen system.
At EstructuraBit we audit SME remote access infrastructure and design the model that best fits your reality: from strengthening the existing VPN with MFA and segmentation, to implementing a full ZTNA solution. If you want to review how your remote system access is protected today, contact us.
Back to blog