What is a VPN, and why should you care?
Quick answer: a VPN (virtual private network) creates an encrypted tunnel from a device to a private network so traffic looks like it originated inside that network — historically the standard way to give remote staff access to internal systems, but it grants broad network-level access rather than access to a specific app, which is exactly the weakness Zero Trust/Access models were built to fix.
How a VPN actually works
When you connect to a VPN, your device negotiates an encrypted tunnel to a VPN gateway/concentrator sitting at the edge of the private network. Once that tunnel is up, your device is effectively handed an IP address on the private network and can route traffic to it as if it were plugged in on-site. Everything between your device and the gateway is encrypted, so it is safe to use over an untrusted network like home Wi-Fi or a coffee shop hotspot.
Why it mattered
Before VPNs, "remote access" meant either nothing, or something bespoke and fragile (dial-up, leased lines). A VPN gave every remote worker a standard, encrypted way to reach internal file shares, internal apps, and internal databases without those systems ever being exposed directly to the public internet. For two decades this was the default model for remote access, and most consumer VPN services (marketed for privacy) are the same underlying idea, just tunnelling to a provider's network instead of an employer's.
Where it breaks down
The problem is what "on the network" actually grants. Once a device is on the VPN, it typically has network-level reach to a wide swathe of internal infrastructure — not just the one app the person needed. A compromised laptop, a leaked credential, or a departed contractor whose VPN account was never revoked all become a foothold onto everything reachable from that tunnel, not just one system. Split-tunnel VPNs (only some traffic goes through the tunnel) help performance but widen the blast radius further, since the device is simultaneously on the open internet and on the trusted network.
What replaces it
Zero Trust Network Access (ZTNA) — Cloudflare Access being one implementation — flips the model: instead of granting network access and hoping the app layer sorts out authorisation, each request to each specific application is authenticated and authorised on its own, with no implicit trust just because a device is "inside." There is no tunnel to compromise and no lateral reach if a credential leaks, because access was only ever scoped to the one app, not the network segment it lives on. See Private network vs public network: how does this affect developer access? for how that access model changes for a typical 3-tier application.
Practical takeaway
If you are still running a traditional VPN for remote access, the question worth asking isn't "is our VPN secure" (most are, cryptographically) — it's "how much can a single compromised VPN account reach." If the answer is "most of the internal network," that is the seat-inflation-shaped risk Zero Trust/Access licensing is priced to fix — and also exactly why over-provisioned or stale VPN/Zero Trust seats are worth auditing. If that resonates, there is a free seat-audit waitlist for exactly this check.