Remote access is no longer just a VPN
The VPN remains useful, but it is no longer the only answer. Remote work, suppliers, SaaS applications, personal devices, phishing risks and compliance requirements are forcing companies to rethink remote access.
What the market shows about the shift to Zero Trust
The move towards approaches more modern than the classic VPN has clearly accelerated. As early as 2025, at least 70% of new remote access deployments were served mainly by ZTNA rather than traditional VPN services, compared with less than 10% at the end of 2021. The global ZTNA market is expected to grow from 1.34 billion dollars in 2025 to 4.18 billion in 2030, a growth rate of 25.5% a year.
The key figures:
New remote access deployments based on Zero Trust (Gartner, 2025): around 70%.
ZTNA share at the end of 2021, for reference: less than 10%.
Companies planning to replace their VPN with Zero Trust: 65%.
Organisations planning a Zero Trust strategy within 12 months: 81%.
These figures do not mean the VPN is disappearing, but that its role is changing: it remains relevant for simple, well-controlled uses, while ZTNA is becoming the benchmark for new remote access projects, particularly in organisations that have seen a sharp rise in remote work in recent years.
Three approaches come up often: VPN, VDI and ZTNA. They can complement each other, but they do not protect the same thing.
VPN: simple, but needs boundaries
A VPN connects a user to the company network. It suits simple uses, especially if devices are managed, up to date and protected. Its main risk: granting overly broad access to the internal network. A poorly segmented VPN can turn a compromised device into an entry point, a scenario companies increasingly seek to avoid by moving to per-application access models.
To check: MFA, segmentation, logging, supplier accounts, firewall rules, authorised devices. A properly segmented VPN, with access limited to only the resources each user profile really needs, remains a reasonable option even in 2026.
VDI: isolating the working environment
VDI publishes a desktop or applications from a centralised environment. Data stays on the infrastructure side, which is useful for line-of-business applications, suppliers or unmanaged devices. Cost and complexity are higher, but control is better.
To check: user experience, printing, peripherals, storage, licences, monitoring and support.
ZTNA: granting access to the application, not the network
Zero Trust Network Access rests on a strong idea: never implicitly trust the network. Access is granted according to the user, the device, the context and the application requested. The Zero Trust model formalised by NIST stresses authentication and authorisation before access to a resource. It is this granularity that clearly reduces the risk: the whole network is never exposed, only the strictly necessary application, to the strictly authorised user, in the expected context.
To check: identity, MFA, device posture, application compatibility, logs, per-application policy.
What Zero Trust changes in the configuration
Unlike a VPN, where access is decided once at connection and then remains valid for the whole session, a ZTNA architecture continuously re-evaluates each request to access an application against several combined signals: the user's identity, device compliance (encryption enabled, antivirus up to date, system patched), the location of the connection and the sensitivity of the resource requested. In practice, the same user may be granted access to their email from an unmanaged personal device, while being refused access to the accounting software from that same device, according to the policy defined for each resource. It is this granularity, impossible to reproduce with a classic VPN that opens global network access, that makes a compromise far less devastating: a hacked device no longer opens the whole network, only what its user was already entitled to.
How to choose
Small team, managed devices, simple need: a well-configured VPN.
Sensitive business applications or external devices: VDI or application publishing.
Internal web applications and a need for fine-grained control: ZTNA, the dominant trend in new deployments since 2025.
Suppliers: access limited by application and duration, with logging.
Highly sensitive data: avoid broad network access, favour VDI or ZTNA.
A gradual path
The right choice is not always a single one. A small business can keep a VPN for some uses, publish a critical application through VDI and introduce ZTNA on a web scope. What matters is to reduce overly broad access and document who accesses what, an approach consistent with the market trend in which 81% of organisations plan a Zero Trust strategy within the next twelve months, without abruptly abandoning their existing solutions.
The real obstacle for small businesses is complexity
On paper, Zero Trust is appealing; in a small business without a dedicated expert, it is intimidating. The main obstacle to adoption is not licence cost but perceived complexity and a lack of in-house skills in identity and access management. Defining policies per application, per device and per context requires a rigour not every team has, and a poorly configured architecture can quickly become unmanageable or, worse, leave gaps.
That is precisely why external support during the initial phase often makes the difference. The aim is not to deploy everything at once, but to lay the foundations properly, a first application, a first policy, a first group of users, then to broaden once the mechanics are mastered.
The case of older applications
One question comes up every time: what should you do with older internal applications, designed long before the cloud and Zero Trust? Not all of them can be published so easily. Some integrate effortlessly behind a ZTNA gateway; others, more stubborn, require a specific connector or even adaptation to be exposed without being rewritten. A few, finally, remain simpler to serve through VDI or strictly segmented network access.
Hence the value of an application compatibility audit beforehand. Discovering a technical blocker in the middle of a rollout costs time and credibility with users; spotting it beforehand lets you choose, for each application, the most suitable access route rather than imposing a single solution that will not suit everyone.
Choose by use, not by fashion
Zero Trust is where the market is heading, but following a trend has never protected anyone. The right reflex remains to start from real uses: which users, which applications, what level of sensitivity, which in-house skills. The right mix of VPN, VDI and ZTNA follows from those answers, not from a brochure argument. Reducing overly broad access and documenting who accesses what matters more than the name of the technology chosen.
SolidKern can support you with VDI virtual desktops, Parallels RAS deployment and an audit of your remote access. Contact us to define the path that suits your context.
Sources: Hodeitek, Why 65% of Companies Plan to Replace VPNs with Zero Trust · CIO, Why 81% of organizations plan to adopt zero trust by 2026 · NIST SP 800-207, Zero Trust Architecture