Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/infrastructure

The Corporate VPN (1996 to Dying)

The VPN was the moat around the castle. Then everyone left the castle. Zero Trust networks do not have moats.

Born 1996 · Still dying, projected end 2028 · Status: dying

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

The Corporate VPN

Born
1996
Died
Not yet
Age
30+

Cause of death

Remote work plus SaaS adoption made the perimeter model indefensible

Survived by

ZTNA platforms, Cloudflare Access, Tailscale, Twingate, SASE stacks

Invented by

Gurdeep Singh-Pall at Microsoft (PPTP, 1996)

Status: DyingProjected final breath: 2028

Filed by D. Gupta · guptadeepak.com

The hook

Ivanti, Fortinet, Cisco. All three had VPN appliance flaws exploited in the wild in 2024. Different vendors, same root cause: the assumption that the VPN tunnel makes the user trusted.

Thesis. The VPN solved a 1996 problem (extending the office network) with a 1996 solution. Both the problem and the solution stopped making sense around 2018.

The story

The origin

PPTP at Microsoft, 1996. The point was making remote employees feel like they were 'in' the office network. A handful of road warriors, a few hours per week, a tolerable security model.

The peak

March 2020. Overnight, millions of office workers VPN'd into work. Hardware shortages. License crunches. The model held by sheer necessity, not because it was the right architecture for what was now the default work pattern.

The cracks

SaaS adoption. Office 365, Salesforce, Slack. The apps were not inside the perimeter anymore. The VPN protected nothing of value, just routed traffic in a circle.

The breach pattern

2024. Ivanti Connect Secure (formerly Pulse Secure), Fortinet's SSL VPN, and Cisco's ASA firewalls all had flaws exploited in the wild. Same root cause: the appliance trust model puts a high-value target on the public internet with credentials that grant lateral movement inside.

The migration

Zero Trust Network Access. Cloudflare Access, Zscaler, and others put an identity-aware proxy in front of each app. Tailscale should not exist as a commercial product (WireGuard is open source), but its growth proves the VPN model is broken in a way the open-source protocol does not fix on its own.

Key data points

  • Microsoft PPTP: 1996
  • Fortinet SSL VPN flaw exploited in the wild: CVE-2024-21762, February 2024
  • Major 2024 VPN breaches: Ivanti Connect Secure CVE-2023-46805 / CVE-2024-21887
  • Cisco ASA flaws exploited in the ArcaneDoor campaign: April 2024
  • Tailscale: founded 2019

Contrarian angle

Every CISO presentation since 2018 has said 'VPNs are dead.' Most enterprises kept renewing the license. The 2024 breach wave was the bill coming due.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

◆ Technology Rewired

See the full evolution in Technology Rewired:

FAQ

Is Zero Trust the same as a software-defined perimeter?

Overlapping but not identical. SDP is one architecture for Zero Trust. ZTNA is a market category. SASE bundles ZTNA with cloud-delivered networking and security functions. All three reject the implicit-trust-by-network-position model.

Do I still need a VPN for accessing internal databases?

For greenfield deployments, no. Use identity-aware proxies and short-lived database credentials issued per session. For legacy databases that cannot be fronted by a proxy, a VPN bridge is sometimes the pragmatic interim.

Why is Tailscale growing if VPNs are dying?

Tailscale is a mesh overlay using WireGuard with cloud-managed identity. It replaces the broken enterprise VPN appliance with a model closer to ZTNA. The category collapse is about appliances, not encrypted tunnels.

More from guptadeepak.com

Further reading

Related obituaries

More from the infrastructure graveyard.