The way organisations work has changed dramatically. Employees now access business applications from home offices, customer sites, airports and coffee shops, often using a mix of corporate and personal devices. At the same time, critical applications are increasingly hosted in public cloud environments rather than traditional on-premises data centres.
Despite these changes, many organisations still rely on legacy Virtual Private Networks (VPNs) to provide remote access. While VPNs were once considered the gold standard for secure connectivity, they were designed for a very different era. In today’s hybrid, cloud-first world, they can introduce significant security risks and operational challenges.
The Problem with Traditional VPNs
Legacy VPNs follow a “trust but verify” approach. Once a user successfully authenticates, they are often granted broad access to the corporate network. While permissions may vary, the VPN’s primary function is to connect users to the network itself rather than limiting access to specific applications.
This creates a major security concern. If cybercriminals obtain valid credentials through phishing, credential theft or other attack methods, they can potentially gain access to the network and move laterally across systems in search of valuable data and critical infrastructure.
Adding to the risk, internet-facing VPN gateways remain a common target for cyberattacks. Cybercriminals actively scan for vulnerable VPN appliances, exploiting security flaws or stolen credentials as an entry point into organisations.
Unfortunately, many of the UK’s most high-profile ransomware incidents in recent years have involved compromised remote access solutions, including legacy VPN platforms. Once attackers gain a foothold inside the network, they can often move laterally, elevate privileges and compromise business-critical systems.
Enter Zero Trust Network Access (ZTNA)
HPE Aruba Networking Zero Trust Network Access (ZTNA) was built specifically to address the limitations of traditional VPNs.
Rather than assuming trust after a successful login, ZTNA operates on a simple principle:
Never trust, always verify.
Every user, device and application request is continuously authenticated and authorised before access is granted. Instead of connecting users to the network, ZTNA connects authorised users only to the applications they need.
This dramatically reduces risk by eliminating unnecessary network exposure and enforcing least-privilege access at all times.
Legacy VPN vs HPE Aruba Networking ZTNA
Trust Model
Legacy VPN: Trust is largely granted after authentication.
HPE Aruba Networking ZTNA: Continuous verification of every user, device and session ensures trust is never assumed.
Access Control
Legacy VPN: Provides broad network-level access.
HPE Aruba Networking ZTNA: Delivers least-privilege access at the application level, ensuring users can only access authorised resources.
Security Risk
Legacy VPN: Compromised credentials can enable lateral movement across the network.
HPE Aruba Networking ZTNA: Prevents lateral movement by hiding the network and exposing only authorised applications.
Attack Surface
Legacy VPN: Internet-facing VPN gateways present attractive targets for attackers.
HPE Aruba Networking ZTNA: Applications remain hidden from the public internet, significantly reducing exposure.
User Experience
Legacy VPN: VPN clients, manual connections and traffic backhauling can negatively impact performance and user experience.
HPE Aruba Networking ZTNA: Provides fast, seamless access with direct application connectivity and clientless options for many use cases.
Management and Visibility
Legacy VPN: Often requires multiple appliances, complex policy management and offers limited visibility.
HPE Aruba Networking ZTNA: Provides centralised cloud management, detailed auditing, identity-based policies and comprehensive visibility into user activity.
Flexibility for Every Access Scenario
One of the key advantages of HPE Aruba Networking ZTNA is its support for both agent-based and agentless access models.
The agent-based option provides continuous security validation and policy enforcement for managed corporate devices.
The agentless option is particularly valuable for contractors, suppliers and third-party users. In situations where deploying software agents onto external devices is impractical or undesirable, organisations can still provide secure remote access without compromising security standards.
This allows businesses to collaborate with external partners while maintaining strict control over who can access specific applications and resources.
A Modern Approach to Remote Access Security
As organisations continue their digital transformation journeys, remote access security must evolve alongside them. Legacy VPNs were designed to connect users to networks, but modern security strategies focus on connecting users securely to the applications and services they need.
HPE Aruba Networking ZTNA helps organisations reduce their attack surface, prevent lateral movement, improve visibility and deliver a better user experience—all while embracing a Zero Trust security model that is better suited to today’s threat landscape.
Don't Leave Your Business Exposed
Cybercriminals continue to target legacy remote access technologies as a way into corporate environments. If your organisation still relies on traditional VPNs, now is the time to assess whether they are providing the level of protection your business needs.
With HPE Aruba Networking ZTNA, you can modernise remote access security, strengthen your cyber resilience and provide secure, seamless access for employees, contractors and third-party users alike.
Don’t leave your company exposed with legacy VPNs. Talk to Kubus today about HPE Aruba Networking ZTNA and discover how a Zero Trust approach can help protect your organisation from modern cyber threats.
