Someone on your team works from home two days a week, connects to the office VPN, and never thinks twice about it. Same setup for years — log in, green padlock, done. And it’s exactly the kind of setup attackers have been going after hardest.
The Canadian Centre for Cyber Security keeps putting out the same kind of advisory — VPN devices being actively exploited. Fortinet. Palo Alto. Pulse Secure. One after another. The reason comes down to how a VPN gets built: it faces the internet by design, so anyone can find it. Get through it, and you’re not knocking at the door anymore. You’re inside, with real access.
The numbers behind the advisories
Verizon’s 2026 Data Breach Investigations Report found that exploiting software is now the single most common way in — 31% of breaches, ahead of stolen passwords for the first time in the report’s history. The jump specific to VPNs and other edge devices was sharper still: from 3% of exploitation-based breaches to 22% in a single year.
Not a reason to panic about the VPN you’re running today. A reason to understand the alternative.
What Zero Trust changes
A VPN runs on one idea: get authenticated once, and you’re on the network — access to whatever’s on it. Zero Trust throws that out. Every request to reach an application gets checked: who’s asking, what device, whether this specific access makes sense. Every time. Not just at the start of the session.
Steal a password under a VPN setup, and an attacker often gets the run of the network. Steal one under Zero Trust, and they get exactly one application — the one those credentials were scoped for. Nothing else behind the firewall.
Gartner’s been calling this shift for years — most new remote access setups moving to Zero Trust instead of VPNs. And the products needed to do it have caught up. What used to be an enterprise-only conversation is priced for a team of ten now, same as a team of a thousand.
Where this leaves you
Small team, VPN patched on schedule, remote access limited to a couple of people? No need to change anything this week. Patched and well-managed still holds up.
Worth a second look: VPN access sitting untouched for years with no audit of who still has access. A device that hasn’t been updated in a while. A growing team where “everyone’s on the VPN” quietly became the default. That’s what the advisories are describing.
Moving to Zero Trust doesn’t have to happen all at once. Most businesses phase it in application by application, keeping the VPN as a fallback until it’s not needed anymore. Want an honest take on where your setup stands? That’s part of what we look at in our cybersecurity services. Book a call with us and we’ll walk through what your team needs.
