In short: a VPN trusts people once they're connected, hands them broad access to the network, and has to have an external-facing surface, which attackers can and do probe constantly. It usually works alongside MPLS, and both were built for a world where everything lived in the data centre, so they drag cloud and SaaS traffic the long way round, adding cost and lag. Zero Trust replaces both: verified people on healthy devices reach the specific apps they need, never the whole network. And the move doesn't have to happen all at once.
Few IT leaders would describe their VPN as a favourite part of the estate. It mostly does its job, but it also drives a patching schedule that rarely lets up. So why are so many of the IT teams we speak to planning its retirement?
Because the world it was built for has gone. Twenty years ago the VPN answered a simple question: how do people outside the office get to what's inside it? MPLS answered the next one: how do our sites reach the data centre?
Today your apps are split across the data centre, Azure or AWS and a growing list of SaaS tools. Your people work from home, from client sites and on the move. A growing chunk of their day runs through AI tools that never go anywhere near your network. And yet remote access is often still built around one big house with a single front door. That front door is now attracting a great deal of attention from attackers.
Is a VPN still secure?
A VPN still does a good job of encrypting traffic. But that’s about it.
Once a user has authenticated, they are largely trusted. They’re dumped, quite happily, onto a network segment they can explore, and while exploring they can see everything else on that segment. Think of a guest let in through the front door and left to wander from room to room. That creates three problems, starting with the most common compromise of all: credential theft.
One stolen login opens a lot of doors. A phishing email, a reused password or a hijacked session gives an attacker identical trusted access to the user they’ve compromised. Their first task, therefore, is to elevate that user’s permissions. Permissions are power, after all.
The gateway is necessarily external, and attackers know it. To accept connections from anywhere, it must be reachable from anywhere, which puts it near the top of every attacker's list. In September 2025, Cisco, the UK's National Cyber Security Centre (NCSC) and the US agency CISA reported a state-sponsored campaign exploiting vulnerabilities in Cisco firewall VPN services. In September 2026, the Dutch NCSC warned that it expected attackers to exploit two critical flaws in Check Point VPN gateways imminently. Every one of those warnings means another urgent patch window for your team.
Access is too blunt. Your finance analyst and a third-party contractor often end up in the same broad segment, because building granular VPN rules across several firewalls is slow and difficult to maintain.
None of this is a criticism of the people running VPNs. They're doing their best with an architecture designed for a "trusted inside, untrusted outside" world, in a business that doesn't really have an inside any more. It’s a bit like the big bi-fold doors you fitted because Kirstie and Phil said inside and outside spaces should be connected… probably the reason they’re not in cybersecurity.
What do VPN and MPLS really cost?
More than the invoice suggests. The cost hides in hardware, circuits and the long way round, and it keeps coming back every year:
Backhauling. Traffic from people and sites travels to a central data centre, only to head straight back out to SaaS and cloud. That adds lag and eats bandwidth on MPLS circuits priced for a different era.
Refresh cycles. Concentrators, firewalls, load balancers and proxies sized for peak demand, each licensed, patched and supported separately.
Workarounds. When access is slow, people find other ways to get their work done, and those ways are rarely more secure.
The savings from modernising are very real. When we helped Hargreaves Services move from fully managed private MPLS networks and physical data centres to SD-WAN and cloud, their annual IT infrastructure spend fell by 66%. The same foundation meant hundreds of employees could switch to remote working virtually overnight when lockdown arrived.
What's the difference between ZTNA and a VPN?
The simplest way to put it: a VPN connects a person to a network, while Zero Trust Network Access (ZTNA) connects a verified person to a specific app, and keeps checking they should still be there. In house terms, a VPN hands over a key to the front door; ZTNA shows a known guest to the one room they need. In practice that looks like this:
Identity comes first. Access starts with who someone is and their context (device health, location, risk), not which IP range they happen to be on. If you already use Okta or Microsoft Entra, you've already got the foundation.
People connect to apps, not networks. Your applications are never exposed to the internet, and nobody lands on the network, so there's nothing for attackers to scan and much less room to move around.
Trust is checked all the time. Device posture and behaviour are checked throughout the session, so access changes if the risk does.
Traffic takes the shortest safe route. Security is delivered from the cloud, close to the user, so nothing needs dragging back through head office. That includes traffic to AI tools and SaaS, which a VPN often can't see at all.
There's a simplification benefit too. VPN concentrators, web proxies and branch firewalls are often separate products with separate consoles. A single cloud-delivered platform such as Zscaler can replace several of them. That means fewer things to buy, patch and manage, and a smaller target for attackers.
SSE, SASE or SD-WAN: which do you actually need?
The terms are often used interchangeably, so here's the plain-English version. Most organisations need secure access first and smarter connectivity second.
SD-WAN (software-defined wide area network) replaces MPLS with managed internet connectivity between your sites. It's great for performance and cost, but on its own it doesn't stop an attacker moving around or control how people reach your apps.
SSE (Security Service Edge) is the cloud-delivered security layer: ZTNA for your private apps, a secure web gateway for internet traffic and cloud access security for SaaS. This is the bit that replaces the VPN.
SASE (Secure Access Service Edge) is simply SSE and SD-WAN working together as one design.
If your MPLS contract or VPN hardware is up for renewal in the next 12 to 18 months, that's the perfect moment to look at all three together, rather than renewing another multi-year contract by default.
What do the first 90 days look like?
The good news is that you don't need a big-bang cutover. The projects that go well start small, run alongside the old setup and only switch things off once everyone's confident. A realistic first 90 days looks something like this.
Days 1 to 30: discover
Map the apps people actually use, group by group, including contractors and third parties. Base your policies on what really happens, not what the old diagram says. It's also the moment to check identity basics like MFA coverage and stale accounts, because everything else builds on them.
Days 31 to 60: pilot
Pick one well-defined group. Contractors or a single business unit work well. Connect your identity provider, publish their apps through ZTNA and gather their feedback on the experience.
Days 61 to 90: expand and plan the switch-off
Bring in more groups and apps, tighten the policies and agree what "done" looks like: which use cases are left on the VPN, and when the MPLS contracts end.
After that, the VPN shrinks to a handful of exceptions before it's finally switched off, along with the hardware and circuits behind it.
This is the route Hill Dickinson took. The firm moved from MPLS and legacy VPN to internet-based SD-WAN and a Security Service Edge through a phased replacement of its WAN and security infrastructure, and it can now open new sites or bring in acquisitions faster. Its people say access "just works". As Keith Feeny, CTO, puts it: "They have helped us remove friction and build resilience into every layer of our infrastructure."
Then comes the part many programmes overlook. Zero Trust isn't something you install and leave; it's something you operate. Policies need tuning as apps, people and threats change. That ongoing care is where the real value shows up, and it's where many projects stall once the implementation partner has moved on.
Where should you start?
Start with the renewal dates. If your VPN hardware or MPLS contract is up in the next year or so, that's the natural moment to take stock: which apps people actually use, how much access they really need, and what the current setup costs you once backhaul, refreshes and patching are added up.
If it helps to see how a phased move works in practice, we've set out how we replace VPN and MPLS with Zero Trust. Our architects are always happy to talk it through, and a free Zero Trust Architecture & Posture Assessment is a good way to get an independent view of where you are today.