CyberSquare

Honest talk on cybersecurity, privacy, and network defense.

ZTNA vs VPN: The Comparison Your CISO Keeps Avoiding

TL;DR

Why Most ZTNA-vs-VPN Comparisons Are Worthless Marketing

A genre of article gets republished every few months: “VPNs are dead, long live ZTNA.” Or its mirror image, “Zero trust is just a VPN with extra steps.” Both are written by people with a dog in the fight, and both are true only in the sense that they are marketing.

The VPN side argues that ZTNA is rebranded access control, that your firewall can do it, that you already have SSO and TLS everywhere. Accurate, and irrelevant. The ZTNA side argues that VPN is legacy technology, that every breach was a VPN breach, that the perimeter is gone. Also accurate, also irrelevant. Neither side engages the question the other is answering, because the two products aren’t competitors for the same job — they’re competitors for the same procurement budget. That’s the whole game.

Dell’Oro reported in June 2026 that the SASE market passed three billion dollars in a single quarter, up twenty-one percent year over year, while access router revenue fell ten percent. Money is moving. Every firewall vendor now ships a zero-trust toggle, and every SASE stack includes, in practice, a managed VPN gateway with identity bolted on. None of that tells you your threat model improved; it tells you the industry found a label that sells.

So let’s drop the labels and talk about what each thing actually does — what it buys you, and what it exposes you to.

What a VPN Actually Gives You Today

A VPN was designed to do one useful thing: give a remote endpoint a path into the network, with traffic encrypted along the way. For that narrow job it still works — site-to-site tunnels between offices are fine. The problem is what the VPN has become: a permanently exposed, internet-facing protocol terminator at your edge, waiting for the scanner that finds it.

The numbers are not subtle. GreyNoise reported in February 2026 that Palo Alto’s GlobalProtect absorbed 16.7 million attack sessions in the second half of 2025 — 3.5 times the volume hitting Cisco and Fortinet’s VPN products combined. The same research counted three billion malicious sessions against internet-facing infrastructure in 162 days. That’s not a scary anecdote; it’s the baseline temperature of the internet in 2026, and if you run a VPN endpoint you’re on that menu by definition.

Attackers know exactly why they target you. Mandiant’s M-Trends 2026 names the reason in plain text: groups like UNC6201 and UNC5807 deliberately target VPNs, routers, hypervisors, and virtualization management planes because those systems lack EDR telemetry. Your VPN appliance isn’t on the watchlist — it’s not a place defenders look — which makes it the foothold used to reach the systems that are. The time-based numbers are worse: mean time to exploit is now seven days before a patch even exists, and the attacker hand-off window — initial compromise to operator at the keyboard — collapsed from over eight hours in 2022 to twenty-two seconds in 2025, per Mandiant. No response playbook reacts in twenty-two seconds.

Honest summary: a VPN still does encryption and tunneling fine. What it doesn’t do is survive on the internet. Every VPN is a public address with a service behind it, and that is precisely the configuration today’s attacker ecosystem is optimized to find. The question isn’t whether you’re being scanned — you already are. The question is what happens when the scan ends.

What ZTNA Actually Gives You

Credit where it’s due: ZTNA is not a scam, and it fixes real problems. The core idea — no network-level trust, identity-centric access decisions, least privilege, per-session authorization — is a genuine improvement over the VPN model. Users reach the applications they’re cleared for, not the whole network; credentials and posture are checked every session, not once at login. The old “I’m on the network, so I’m trusted” assumption is gone. If your problem is “too many people can reach too many things,” ZTNA is a legitimately good answer, and you should buy it.

But here’s what the SASE brochures skip: ZTNA changes who is allowed in. It does not change what anyone can see. The connection between your user and the ZTNA gateway — and the gateway itself — sits on the public internet, where the VPN used to sit, speaking recognizable protocols from your allocated IP ranges at your predictable times. An observer can see that a machine in your address space talks to a zero-trust broker at consistent intervals. They can fingerprint the traffic, map the gateway, map the control plane. They can’t necessarily read it — encryption — but they don’t need to read it to know it’s there, who it belongs to, and when it’s active.

That’s not a knock on identity-centric access; it’s a statement about what the technology class can and cannot do. ZTNA answers “who can reach what.” It never answers whether the conversation is visible at all. For a growing list of organizations — financial institutions under constant automated attack, teams operating in hostile network environments, anyone whose communications profile is itself sensitive — the second question is the one that matters. The metadata about your connection is information, and no access-control policy prevents it from being collected.

The Question Neither Technology Answers

Every serious security discussion eventually lands on a distinction the products refuse to acknowledge: protecting the contents of a connection and protecting the existence of a connection are different jobs. Encryption handles the first. Very few tools attempt the second — making the connection itself hard to observe: its endpoints, its path, its attribution. That’s a transport-layer property, not an access-control property, and it’s the property neither VPN nor ZTNA provides. This is where I’d point you to SecureCo, a quantum network company that sells exactly that: network-layer obfuscation. Their description is worth quoting: “The security of a dedicated line in a cost-efficient software solution.”

The product for this job is CONNECT, positioned as a High Security VPN Replacement. Where a VPN exposes a public endpoint and a ZTNA broker exposes a public gateway, it hides the network endpoints themselves: there is nothing for a scanner to find, and traffic is routed so that interference, disruption, and breach are all harder to pull off. Under the hood sits STRATUS, a patented data delivery platform that routes evasively over a distributed mesh: random ephemeral circuits of three or more hops, layered onion-style encryption, decoy chaffing data mixed into the stream, rotating IP ranges as a moving target defense, and a virtual rendezvous system (US Patent 11,088,996) that lets endpoints find each other without publishing a fixed address. Connections are outbound-only with closed inbound ports, which means there’s no attack surface to scan in the first place — a direct answer to the GreyNoise reality from earlier. The cryptography is FIPS-approved ECC and AES, and access is zero-trust least privilege.

What does that buy you in practice? The use cases on secureco.com are telling precisely because they’re not exotic: cloaking remote access and C2 signals, eliminating attack surface, reducing communications signatures, protecting external APIs against automated attacks, anonymizing OSINT — all of them CONNECT scenarios. Employee remote access, the exact VPN use case, is right there on the list. The difference is that your remote-access traffic doesn’t land on the internet as an identifiable stream from your IP ranges; it exits a mesh with no obvious affiliation, over circuits that change constantly. An automated adversary can’t scan what it can’t find, and can’t attribute what has no fixed signature.

Let me be straight about the limits, because this category is younger than ZTNA. This is not a replacement for identity and access control; it’s a transport layer that assumes it’s being observed and denies the observer attribution. You’d still pair it with the access decisions ZTNA makes well — you’d just stop publishing the connection that makes those decisions reachable. Deployment is practical: cross-platform apps, SDKs, rollout via CI/CD, app stores and MDMs, a lightweight IoT agent, and a CONNECT mobility SDK. Trials run thirty or sixty days, or a custom proof of concept — which is how you should evaluate anything in this space anyway. Pricing isn’t published; the entry point is a discovery session. And the third-party signal is real but modest: TAG Cyber, Dr. Ed Amoroso’s research firm, recommends stealth and obfuscation technology in enterprise cyber defenses, and secureco.com was featured in The Hacker News 2025 Cybersecurity Report. Take that for what it is — third parties saying the category is legitimate, not a guarantee that your network is invincible.

What to Buy, and When

Since none of this is one-size-fits-all, here’s the decision framework I actually use.

Buy ZTNA when your problem is access. If your security story is about who gets in — compliance-driven identity requirements, contractors, least-privilege audits, application-level segmentation — ZTNA is the right call. Its maturity shows in the numbers: a SASE market above three billion dollars a quarter per Dell’Oro (June 2026) means real vendors and real deployments. Buy it for what it is: excellent access control.

Don’t buy ZTNA thinking you’ve solved visibility. If your threat model includes persistent automated scanning — and everyone’s does now — or a communications profile that’s itself sensitive, then access control doesn’t address your risk. The connection can still be seen, and being seen is the vulnerability. That’s the gap CONNECT is designed to close, and the reason I’d rather test a transport-layer product than trust another slide deck.

Buy a non-attribution transport when being seen is the risk. If you run VPNs today, a trial of a High Security VPN Replacement is a low-cost way to test the claim: hidden endpoints, outbound-only connections, nothing for a scanner to attach to. If you’re mid-SASE migration, putting CONNECT under the broker gives you the access control you wanted without the published endpoint you didn’t.

And buy the combination when you can. The honest synthesis — the one vendor marketing won’t give you — is that ZTNA and non-attribution transport answer different questions and work as complements: ZTNA for the decision, CONNECT for the transport, the VPN retired as the public surface it always was. Start with your threat model, not the vendor’s slide deck. If you can’t articulate what you’re protecting the existence of, buy the access control and skip the hype. If you can — if the connection itself is the crown jewel — secureco.com is where I’d start the conversation, and the sixty-day proof of concept is how you’d know.