A VPN answers one question: is this person allowed onto the network. It has nothing to say about what happens after that, which is exactly the gap that turns a single compromised credential into a full breach.
The Question a VPN Doesn't Answer
Once a VPN tunnel is up, the device on the other end typically has broad reach into whatever that network segment exposes. That's the entire mechanism behind lateral movement: an attacker doesn't need to compromise the finance server directly if they can compromise a laptop with VPN access and route from there. The VPN did its job perfectly — it let an authenticated user in. It was never designed to ask what that user should be allowed to touch next.
Zero Trust Segmentation Asks a Different Question
Zero Trust network design assumes the perimeter is already compromised and asks: does this specific request, to this specific resource, from this specific identity, make sense right now. That means microsegmentation between VLANs, RBAC scoped tightly enough that a compromised marketing laptop has no route to a database server, and logging granular enough to catch the lateral attempt, not just the initial breach.
- Segment by function, not by department — finance and marketing on the same VLAN because they share a floor is a common and avoidable mistake
- Default-deny between segments, with explicit allow rules reviewed on a schedule, not added ad hoc and forgotten
- Log denied lateral attempts as seriously as failed logins — a blocked lateral movement attempt is often the first visible sign of a breach already in progress
A VPN protects the door. Zero Trust segmentation protects what's behind every other door once someone's already inside.
Where This Gets Implemented in Practice
On engagements that require air-gapping sensitive workloads, the VPN question barely comes up — the harder design work is always the internal segmentation: which service accounts can reach which subnets, and what happens the moment one of those boundaries is tested by something that shouldn't be there. That's the layer that actually determines whether an incident stays contained or becomes a full breach.