# Does a VPN contradict zero trust?

A classic VPN does in one way: once connected, the user's device is usually inside the network with wide access, which is the trusted-because-inside model that zero trust moves away from. That does not mean the VPN must go tomorrow. You can bring it much closer to zero trust: require multi-factor authentication, give each group access only to the systems it needs, check that the device is a managed, updated company laptop before it connects, and log every session. Zero-trust network access (ZTNA) products take the next step and connect a user to one application at a time instead of to the network. Either way, assume that a VPN session can be abused and watch what it does. With a sensor on a SPAN or TAP port behind the VPN gateway, NetSenX flags scanning, lateral movement and beaconing from VPN users' devices, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/does-a-vpn-contradict-zero-trust

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is zero-trust network access (ZTNA)?](https://netsenx.com/en/faq/what-is-zero-trust-network-access-ztna)
- [Is a firewall still needed if we have zero trust or SASE?](https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase)
- [How do segmentation and least privilege limit lateral movement?](https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement)
- [Where do I start segmenting a flat office network?](https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network)
- [How do I segment IT and OT with VLANs and access lists?](https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls)