For twenty years, giving staff remote access meant one thing: a VPN. It still works, millions of businesses still rely on it, and there is nothing inherently broken about the idea of an encrypted tunnel. What has changed is the threat - and the realisation that the VPN's core assumption, 'once you are in, you are trusted', is exactly what attackers exploit. Zero trust network access is the answer to that flaw. Here is the difference, in business terms.
How a VPN works, and its one big assumption
A VPN - virtual private network - builds an encrypted tunnel from a remote device back to your office network, so a laptop at home behaves as if it were plugged in at the office. If you want the basics first, our plain-English guide to business VPNs covers them.
The catch is what happens after connection. A traditional VPN drops the user onto the network and, by default, trusts them broadly - they can often reach far more than the one app they actually needed. The model is 'authenticate once at the door, then roam the building'. That was fine when threats were outside the walls. It is dangerous now, because a single phished password or one compromised laptop hands an attacker that same broad, trusted access.
What zero trust network access does differently
ZTNA flips the assumption. Instead of 'connect to the network, then you are trusted', it is 'never trust by default, verify every time, and grant access only to the specific application you are entitled to - nothing more'. The guiding idea behind it is covered in zero trust, simply explained.
In practice, a user is connected to one application at a time, after their identity and often the health of their device are checked - and they never see the wider network at all. The other apps, servers and shares are invisible to them, which means invisible to an attacker who steals their login too. Access is continuously evaluated, not granted once and forgotten.
- •VPN: connects you to the network, then largely trusts you to roam it.
- •ZTNA: connects you to one named application, after verifying who and what you are, every time.
- •VPN exposes the network's existence; ZTNA hides everything you are not explicitly allowed to use.
Why this matters for an ordinary UK business
The shift is not academic - it maps directly onto how breaches actually happen. Most start with stolen credentials or a compromised device. With a VPN, that foothold often means lateral movement: the attacker spreads sideways across a flat, trusted network towards your servers and data.
With ZTNA, the same stolen login reaches only the single app that user was permitted, and even that is gated by device checks and continuous verification. The blast radius shrinks from 'the whole network' to 'one application'. For a firm that has rolled out multi-factor authentication and is thinking seriously about securing remote and hybrid workers, ZTNA is the logical next layer.
The honest trade-offs
ZTNA is not automatically better for everyone on day one, and pretending otherwise leads to disappointment. A VPN you already own and understand is cheap, familiar and good enough for low-risk, occasional access by a handful of trusted staff.
ZTNA usually means a new service to adopt and configure, often delivered from the cloud, and it leans heavily on having your identity and device management in order first - it is far less useful if you do not know who your users are or what state their devices are in. It also shines brightest where you have many remote users, sensitive systems, or compliance pressure. The pay-off is real, but it is a project, not a switch you flip.
What to actually do
You do not have to rip out your VPN this quarter. The sensible path for most UK businesses is staged: tighten the VPN you have now, then move application by application to zero trust where the risk justifies it.
Start by switching on MFA for VPN access and narrowing what each user can reach once connected. Then identify the handful of sensitive apps that most deserve per-app, verify-every-time access, and pilot ZTNA there. Our VPN-to-ZTNA migration guide walks through the technical move, ZTNA usually arrives bundled with cloud-delivered security in the platforms we compare in our SASE platform guide, and our zero trust service can help you sequence it without breaking how people work.