For companies with 50 to 500 employees, the VPN box sitting on the edge of the network has quietly become one of the most attractive targets for ransomware crews. It is the first door many attackers try, and once it opens, it often opens onto everything. The alternative, known as zero trust network access, costs a few dollars per user each month and closes that door for good.
The difference between the two models comes down to how much trust is handed out once someone proves who they are. A traditional VPN authenticates a person once, at login, then places them inside the broader office network, where they can often reach far more than their job requires. Zero trust network access, or ZTNA, takes the opposite approach: it connects each person only to the specific applications they need, and it checks both the person and the device continuously, not just at sign-in. Firms comparing the options, including those researching providers through resources like this site, generally find that the sizing of the business matters less than the shape of its remote access, which is why the National Institute of Standards and Technology built its federal zero trust guidance around exactly this distinction.
The stakes are not theoretical. Cyber insurer Coalition reported that 58 percent of its 2024 ransomware claims began with a compromised VPN or firewall. The federal cybersecurity agency CISA maintains a running list of vulnerabilities that attackers have already exploited in the wild, and that list includes 60 flaws across the firewall and VPN products sold by Fortinet, Cisco, Ivanti and Palo Alto Networks. Roughly half of those flaws were used specifically in ransomware campaigns. When a batch of Ivanti appliances was compromised in early 2024, CISA's response was not a patch request but an order: federal agencies had to disconnect every affected box and rebuild it from scratch.
Why the VPN Door Is So Hard to Defend
A single flaw in an internet-facing VPN appliance can expose an entire corporate network, and attackers frequently exploit those flaws before a fix is even available. That turns patching into a race that even a disciplined IT team cannot always win. Multi-factor authentication helps, but it is not a complete answer. Some VPN vulnerabilities, including one disclosed in an Ivanti product in January 2024, allow attackers to bypass login screens entirely. Security engineers have also documented cases where accounts were taken over despite MFA being active. As one common assessment in the field puts it, MFA is a valuable tool, but it is not an end-all, be-all.
Where a VPN Still Makes Sense
Retiring the VPN does not mean eliminating it everywhere. Three narrow use cases remain legitimate. Site-to-site VPNs, the permanent links connecting a company's own offices, are a different tool entirely and can stay in place. Industrial equipment that must be reached remotely should, according to federal guidance, stay off the open internet and be accessed only through a VPN secured with a hardware security key or equivalent multi-factor authentication. And a small transitional group of staff can remain on a patched, MFA-protected VPN while their applications are migrated. Everyone else, from office administrators to field engineers, is better served by zero trust.
What the Move Actually Costs
Pricing varies by platform but stays modest. A pilot group under 50 users can often run free on Cloudflare's free tier. Microsoft's zero trust product, Entra Private Access, costs around $5 per user monthly for firms already on Business Premium, E3 or E5 plans. For a 120-person company, that works out to roughly $7,200 a year, a fraction of the average ransomware claim, which Coalition put at $269,000 in 2025. The practical path is a phased rollout over about a quarter: enable MFA immediately, inventory who connects remotely and to what, migrate one team as a pilot, then move the rest in waves before switching the VPN off entirely. Outside vendors deserve the same scrutiny as employees, with individual logins, MFA, and access limited strictly to the systems they support.
