2.8 Million Reasons Why You Can’t Trust Your VPN

There are 2.8 million IP addresses, meaning 2.8 million unique sources are currently hammering away at virtual private network (VPN) devices worldwide, trying to guess their way into corporate networks. Perimeter-based security’s poster child, the VPN, is under siege, and the numbers are staggering, with attack vectors originating across the globe.

Your company’s entire security posture shouldn’t collapse because someone guessed a password. Yet that’s exactly what perimeter-based security offers: Crack one set of credentials and you’ve breached the trusted zone.

Enter Zero Trust Security

The zero trust security model operates on a simple principle: never trust, always verify. Unlike traditional security models that trust anything inside the network perimeter, zero trust verifies every access request regardless of where it originates.

Think about getting on an airplane. At the airport, your every step is verified: Check-in confirms your booking, security screens you and your belongings, and gate agents ensure you’re boarding the right flight at the right time. Your boarding pass works for your one specific flight to your designated destination, not the entire airport or anywhere in the world. Try to enter the wrong gate or board too early? You’ll be stopped, even if you have valid credentials.

Continuous verification at every step. That’s zero trust security in a nutshell.

Now compare this to perimeter-based security: It’s like showing a stolen passport at the first point of entry in an airport, skipping all other checks and suddenly having access to every gate, plane and restricted area in the airport. No questions asked — because you’re already inside.

Sounds absurd? That’s exactly how perimeter security works. Check once, trust forever.

It’s All About Context

While VPNs create a secure tunnel and trust everything inside it, zero trust takes a fundamentally different approach through identity-aware proxies.

Every access request passes through this proxy, which evaluates:

• Who is making the request. (Identity)
• What they are trying to access. (Resource)
• Where they are connecting from. (Location)
• What device they are using. (Device posture)
• When are they making the request. (Time)

Think of it like this: A senior engineer’s credentials entered at 3 a.m. from an unknown device in a new country should raise flags, even if the password is correct.

Making Decisions

Behind the scenes, a policy engine processes these factors in real time, making instant decisions about access. Instead of maintaining complex firewall rules, you define simple, clear policies like: “Engineers can access production systems only during their on-call shifts, from managed devices with multifactor authentication.”

Microsegmentation

Rather than having broad network access, each application and service is protected individually.

This means:

• A compromise of one service doesn’t expose others.
• Access is granular and specific.
• Lateral movement is restricted by default.

Improved Security Posture on Day One

Identity-aware proxies can instantly modernize your security posture without touching your legacy applications. Some critical internal tools built years ago might not even support modern authentication methods like single sign on (SSO).

Adding an identity-aware proxy in front of these applications:

• Enforces strong authentication instantly.
• Adds SSO capabilities without application changes.
• Defines context-based access (device, role, etc.).
• Provides audit logs out of the box.
• Enables modern security policies.

Wrapping Up

The shift to zero trust isn’t just a security upgrade; it’s a fundamental rethinking of how we protect our most valuable digital assets. By moving away from perimeter-based models that create a false sense of security, organizations can build resilience against the evolving threat landscape. Whether you’re dealing with remote workers, cloud migrations or legacy applications, zero trust principles provide a flexible framework that grows with your needs while maintaining consistent security standards across your entire infrastructure.

There are 2.8 million reasons not to trust a VPN, and they’re all hammering networks worldwide right now. Zero trust offers a better way: Never trust, always verify — at every access, every time.

For more information, watch Pomerium’s YouTube short about zero trust.