Does Zero Trust Architecture mean completely eliminating corporate VPNs?

Not entirely. Zero Trust Architecture changes the paradigm of VPN usage. Traditional VPNs that provide access to the entire internal network are replaced by Zero Trust Network Access (ZTNA) solutions, which offer application-specific, granular access. However, VPN technology itself, as a secure transport protocol, may still exist as an underlying connectivity component within a Zero Trust system, but the access control logic above it is entirely managed by the Zero Trust policy engine.

For an enterprise with existing traditional VPNs and firewalls, what is the first step towards Zero Trust migration?

The most practical first step is to establish a strong identity foundation. This includes deploying organization-wide Multi-Factor Authentication (MFA) and strengthening the Identity and Access Management (IAM) system. With reliable authentication in place, you can select one or a few critical business applications (e.g., CRM, financial systems) to pilot a ZTNA solution, replacing their traditional VPN access method. This process can be gradual, without needing to replace all VPN connections at once.

What are the primary new functions of proxy servers in a Zero Trust model?

In a Zero Trust model, proxy servers evolve from simple gateways to critical points for policy enforcement and risk assessment. Their key new functions include: serving as a unified secure entry point for all user access to the internet and cloud applications (part of the Security Service Edge); analyzing traffic, user behavior, and device posture in real-time to provide data for continuous authentication and risk assessment; and enforcing granular data security policies, such as Data Loss Prevention and content isolation.

The New Paradigm for Enterprise Secure Connectivity: How Zero Trust Architecture is Reshaping the Roles of VPNs and Proxies

3/29/2026 · 4 min

The Limitations of the Traditional Perimeter Security Model

For decades, enterprise cybersecurity has relied on a "castle-and-moist" perimeter defense model. The Virtual Private Network (VPN) is a quintessential tool of this era, creating encrypted tunnels between the trusted corporate network and remote users or devices. Network proxies have been primarily used for content filtering, access control, and anonymization. However, in the age of cloud computing, mobile workforces, and the Internet of Things (IoT), this model of defining trust based on network location reveals critical flaws. Once an attacker breaches the perimeter, they can move laterally with relative ease. Furthermore, it fails to continuously verify the trustworthiness of internal users or devices.

Core Principles of Zero Trust Architecture

Zero Trust Architecture (ZTA) rejects the default assumption that "inside is safe." Its foundational mantra is "never trust, always verify." It is built upon several key principles:

Least Privilege Access: Grant users and devices the minimum level of access necessary to perform a specific task, with permissions being dynamic and temporary.
Explicit Verification: Every access request must be rigorously authenticated and authorized, regardless of whether it originates from inside or outside the network.
Assume Breach: Operate under the assumption that the environment is already compromised, necessitating continuous monitoring and assessment of risk for users, devices, and sessions.
Microsegmentation: Segment the network into smaller, isolated zones to limit the lateral movement of threats.

The Evolution of VPNs and Proxies in a Zero Trust Context

Within a Zero Trust framework, VPNs and proxies are not made obsolete but are reassigned to new, more precise roles.

The Transformed Role of VPNs

Traditional VPNs provide broad network-layer access, effectively opening a gate to the entire internal network. In Zero Trust, the function of VPN is deconstructed and refined:

From Network Access to Application Access: Zero Trust Network Access (ZTNA) solutions replace traditional VPNs by providing identity- and context-aware, direct access to specific applications or services, not the entire network.
As a Connectivity Component: VPN technology may be relegated to a secure transport layer component for establishing encrypted links over untrusted networks, while the access control logic is entirely driven by the Zero Trust policy engine.

The Enhanced Role of Proxies

Proxy servers find a more central and expanded role in a Zero Trust architecture:

Critical Entry Point for Security Service Edge (SSE): Modern cloud proxies (like Secure Web Gateways and Cloud Access Security Brokers) become the frontline enforcement points for Zero Trust policies. All traffic, regardless of origin, is routed, inspected, and protected through these cloud-delivered security services.
Continuous Risk Assessment: Proxies can analyze user behavior, device health, and traffic content in real-time, providing dynamic risk assessment data to the policy engine for real-time access adjustments.
Data Security and Isolation: Proxies enable secure brokering and isolation of data between user devices and cloud applications, preventing data exfiltration.

Recommended Path for Implementing Zero Trust

Transitioning to Zero Trust is a journey, not a one-time project. A phased approach is recommended:

Identify and Classify: Begin by identifying and classifying critical data assets, applications, and user roles.
Establish a Strong Identity Foundation: Deploy Multi-Factor Authentication (MFA) and a unified Identity and Access Management (IAM) system. This is the cornerstone of Zero Trust.
Start with Critical Applications: Select a few high-value or high-risk applications and implement ZTNA for them first, replacing their traditional VPN access methods.
Adopt Cloud-Delivered Security Services: Gradually migrate proxy-like security functions (SWG, FWaaS) to the cloud to form a unified Security Service Edge.
Implement Network Microsegmentation: Begin implementing microsegmentation within data centers and cloud environments to restrict east-west traffic.
Integrate and Automate: Use a centralized policy management platform to integrate all security control points and leverage automation for continuous policy validation and adjustment.

Conclusion

Zero Trust Architecture is not a single product but a strategic security framework. It is transforming VPNs from broad network connectivity tools into optional transport components within a more granular, context-aware access control system. Simultaneously, it elevates proxies from simple traffic forwarders to intelligent gateways that enforce continuous verification and security policies. For enterprises, embracing Zero Trust means shifting from static perimeter-based defense to an identity-centric, dynamically adaptive security model. This evolution is essential for effectively countering increasingly sophisticated cyber threats and supporting the flexible demands of modern business.