65% of organizations plan to replace their VPN within a year, 23% more than in the previous edition of the same survey, and 81% are adopting or planning a zero trust strategy (Zscaler ThreatLabz 2025 VPN Risk Report). The push is coming from attackers as much as from architects. Verizon’s 2025 DBIR found that edge devices and VPNs jumped from 3% to 22% of vulnerability exploitation activity, and Mandiant’s M-Trends 2026 ranks exploits as the top way into a network for the sixth straight year. Money is following: Dell’Oro Group put SASE revenue at $3.5 billion in Q2 2026, its fifth consecutive quarter of growth above 20%. For the consumer side of the market, see our VPN usage statistics. We aggregated data from Zscaler ThreatLabz and Cybersecurity Insiders, Dell’Oro Group, Verizon, Google Mandiant, CISA, Gartner, Okta, Gallup and the other primary sources listed in the methodology.
TL;DR
- 65% of organizations plan to replace VPN services within a year, up 23% from the prior survey (Zscaler ThreatLabz 2025 VPN Risk Report).
- 56% of organizations reported VPN-exploited breaches in the past year (Zscaler ThreatLabz 2025 VPN Risk Report).
- VPN CVEs grew 82.5% between 2020 and 2025, across 411 vulnerabilities analyzed (Zscaler ThreatLabz, 2025).
- Edge devices and VPNs rose from 3% to 22% of vulnerability exploitation activity, almost 8x (Verizon DBIR 2025).
- 31% of breaches now start with software vulnerabilities, ahead of stolen passwords (Verizon DBIR 2026).
- Exploits were the top initial infection vector for the sixth year in a row, at 32% (Mandiant M-Trends 2026).
- CISA ordered federal agencies to disconnect every Ivanti VPN appliance by February 2, 2024 (CISA ED 24-01).
- SASE revenue reached $3.5 billion in Q2 2026, above 20% growth for a fifth straight quarter (Dell’Oro Group, September 2026).
- SASE forecast to hit $24 billion by 2030 at a 15% CAGR (Dell’Oro Group, August 2026).
- Gartner predicted at least 70% of new remote access deployments would use ZTNA instead of VPN by 2025, from under 10% in 2021 (Gartner, via Data Center Knowledge).
- High-assurance MFA adoption grew from 41% to 58% (Okta Businesses at Work 2026).
- 52% of remote-capable US employees work hybrid and 26% fully remote (Gallup, May 2026).
1. VPN Replacement Intent: Most Firms Have Decided, Fewer Have Moved
The decision phase is over; the open question is how fast enterprises can execute. In the Zscaler ThreatLabz 2025 VPN Risk Report, produced with Cybersecurity Insiders from a survey of 632 IT and security professionals in early 2025, 65% of organizations said they plan to replace their VPN services within the year, a 23% jump over the previous report. 56% said security and compliance risks have made traditional VPNs obsolete, and 96% have implemented, planned or bought into a zero trust approach.
Intent has a long history of running ahead of reality here. Gartner predicted that by 2025 at least 70% of new remote access deployments would rely on ZTNA rather than VPN, up from less than 10% at the end of 2021, and forecast ZTNA spending growth of 31% in 2023 (Data Center Knowledge, October 2022). The key word is ‘new’: installed VPN concentrators keep running until a contract, an outage or a breach forces a change, which is why nearly two in three firms (65%) were still only planning a replacement in 2025.
| Metric | Value | Source |
|---|---|---|
| Organizations planning to replace VPN within a year | 65% (up 23% from prior report) | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 VPN Risk Report |
| Adopting or planning zero trust within 12 months / favoring zero trust overall | 81% / 96% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Say security and compliance risks made VPNs obsolete | 56% | Zscaler ThreatLabz, 2025 VPN Risk Report |
| New remote access deployments using ZTNA, 2025 (prediction) | At least 70%, from under 10% in 2021 | Gartner, via Data Center Knowledge, 2022 |
| ZTNA spending growth forecast, 2023 | 31% | Gartner, via Data Center Knowledge, 2022 |
| Interest in zero trust models (AFCOM survey) | 56% (2021) to 79% (2022) | AFCOM, via Data Center Knowledge, 2022 |
| North American organizations working on zero trust projects | 60% (40% globally), from 16% in 2019 | Okta State of Zero Trust Security, 2020 |
Context note: the Gartner and Okta figures are most recent available data (2020 to 2022) and are included as baselines. The Zscaler report is vendor-commissioned by a ZTNA provider, so its replacement-intent figures should be read as the direction of travel rather than a market census. Our zero trust security statistics cover the broader framework beyond remote access.
2. Where Enterprises Actually Are: Legacy Stacks and Rollout Stages
Under the headlines, most networks still look like 2015. 24% of organizations still grant open network access to any authenticated user, and another 28% rely on static network firewall rules (Cybersecurity Insiders, Zscaler ThreatLabz 2025 VPN Risk Report). That is the exact pattern ZTNA is designed to remove: once a VPN session is up, a flat network lets an attacker roam. Unsurprisingly, 71% of respondents rank lateral movement as a top concern, and Zscaler’s own summary of the survey puts the share worried about lateral movement at 89%.
Zero trust rollout is real but staggered. Only 35% of organizations are already implementing zero trust, 24% plan a rollout within six months and 22% have a strategy for the following year. The firewall is still the default control, used by 84%. Identity is moving faster than the network: Okta’s Businesses at Work 2026 reports high-assurance MFA adoption grew from 41% to 58%, while threats grew 6.3x faster than high-assurance authentication adoption.
| Metric | Value | Source |
|---|---|---|
| Access model: open access for authenticated users / static firewall rules | 24% / 28% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Zero trust status: implementing now / within 6 months / next year | 35% / 24% / 22% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Defense tools deployed: firewalls / WAF / NAC / VPN | 84% / 58% / 54% / 43% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Rank lateral movement as a top concern | 71% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| High-assurance MFA adoption | 41% to 58% | Okta Businesses at Work 2026 |
| Threat growth vs high-assurance authentication adoption | 6.3x faster | Okta Businesses at Work 2026 |
| Share listing the network as a top access-decision factor | 55% (2019) to 20% (2020) | Okta State of Zero Trust Security, 2020 |
Context note: the 43% ‘rely on VPNs’ figure comes from a question about defense tools in use and does not mean 57% of respondents run no VPN; the survey targeted VPN-using organizations. The Okta 2020 network-factor data is older than three years (most recent available data).
3. The VPN Attack Surface: CVEs Keep Rising
The reason VPN replacement moved from IT roadmap to board agenda is the vulnerability count. Zscaler ThreatLabz analyzed 411 VPN CVEs published between 2020 and 2025 and found VPN CVEs grew 82.5% over the period, with roughly 60% of 2024’s vulnerabilities rated high or critical (Zscaler ThreatLabz blog, 2025). Remote code execution was the most common impact, with 149 CVEs across the five years and 32 in 2024 alone.
The mix matters more than the count. A VPN gateway is internet-facing by design, so a remote code execution flaw on it is a pre-authentication door into the corporate network, not a local bug. Denial-of-service CVEs tripled from 9 in 2020 to 27 in 2024, and privilege escalation CVEs grew 66.7%. Meanwhile CISA’s Known Exploited Vulnerabilities catalog listed 1,733 entries when we checked in October 2026, and the ThreatLabz blog points to one of them, the critical Ivanti flaw CVE-2025-22457, as a known-exploited VPN bug that agencies were told to patch. The breach-side consequences are tracked in our data breach statistics.
| Metric | Value | Source |
|---|---|---|
| VPN CVEs analyzed, 2020 to 2025 | 411 | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Growth in VPN CVEs, 2020 to 2025 | +82.5% | Zscaler ThreatLabz, 2025 VPN Risk Report |
| 2024 VPN CVEs rated high or critical | About 60% (83 CVEs); high/critical CVEs +38.9% vs 2020 | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Remote code execution VPN CVEs | 149 total, 32 in 2024 | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Denial-of-service VPN CVEs | 9 (2020) to 27 (2024), +200% | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Privilege escalation VPN CVEs | +66.7% | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Entries in CISA Known Exploited Vulnerabilities catalog | 1,733 (October 2026) | CISA KEV catalog |
Context note: these CVE rows are one ThreatLabz analysis and count as a single source. Zscaler sells the ZTNA product that replaces VPNs, so the analysis is not neutral, although CVE counts themselves are public and verifiable.
4. From Vulnerability to Breach: What Incident Data Shows
The CVE trend is not theoretical; it shows up in breach investigations. Verizon’s 2025 Data Breach Investigations Report found edge devices and VPNs went from 3% to 22% of vulnerability exploitation activity, almost an eightfold jump in one year, and only 54% of those edge vulnerabilities were fully remediated, taking a median 32 days (Eclypsium analysis of Verizon DBIR 2025). Verizon’s 2025 release also counts exploitation of vulnerabilities as an initial vector up 34%, at 20% of breaches versus 22% for credential abuse, across 12,195 confirmed breaches.
By the 2026 edition the crossover was complete: Verizon DBIR 2026 says 31% of breaches now start with software vulnerabilities, beating stolen passwords as the top entry point. Mandiant’s incident response data agrees. M-Trends 2026 ranks exploits as the most common initial infection vector for the sixth consecutive year at 32%, and reports that the BRICKSTORM espionage backdoor, which lives on network appliances, went undetected for nearly 400 days on average. Appliances that lack endpoint agents are where attackers hide longest.
| Metric | Value | Source |
|---|---|---|
| Edge device and VPN share of vulnerability exploitation | 3% to 22% (almost 8x) | Verizon DBIR 2025, via Eclypsium |
| Edge vulnerabilities fully remediated / median time to remediate | 54% / 32 days | Verizon DBIR 2025, via Eclypsium |
| Initial vector: credential abuse vs vulnerability exploitation | 22% vs 20% (exploitation +34%) | Verizon DBIR 2025 |
| Breaches starting with software vulnerabilities | 31% (top entry point) | Verizon DBIR 2026 |
| Breaches involving a third party | 30% (doubled from 15%) | Verizon DBIR 2025 |
| Exploits as initial infection vector | 33% (2024 investigations), 32% (2025) | Mandiant M-Trends 2025 and 2026 |
| Global median dwell time | 11 days (2024) to 14 days (2025) | Mandiant M-Trends 2025 and 2026 |
| BRICKSTORM backdoor dwell time on network appliances | Nearly 400 days | Mandiant M-Trends 2026 |
Context note: Verizon’s edge and VPN figures were read through Eclypsium’s analysis because the full DBIR is a gated download; the headline 2026 figures come from Verizon’s own landing page. Third-party access matters here because VPN accounts are often handed to contractors, and 93% of Zscaler’s respondents worry about backdoors via third-party VPN connections. Ransomware crews are the main beneficiaries, as our ransomware statistics show.
5. Government Response: Emergency Directives Aimed at VPN Gateways
Regulators now treat VPN appliances as emergency-grade risk. On January 19, 2024, CISA issued Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure, covering three CVEs, and a supplemental direction ordered agencies to disconnect every Ivanti instance by February 2, 2024, factory reset it, and assume domain accounts were compromised. A month later, joint advisory AA24-060B reported that attackers could deceive Ivanti’s Integrity Checker Tool and keep root-level persistence despite factory resets.
The pattern repeated with a different vendor. Emergency Directive 25-03, issued September 25, 2025 and updated April 23, 2026, required forensic core dumps within about a day for Cisco ASA devices exploited through CVE-2025-20333 and CVE-2025-20362. When a perimeter device can survive a reset, the only safe fix is fewer exposed devices, which is the policy logic behind CISA’s Zero Trust Maturity Model.
| Metric | Value | Source |
|---|---|---|
| ED 24-01 issued (Ivanti Connect Secure / Policy Secure) | January 19, 2024; 3 CVEs | CISA ED 24-01 |
| Initial mitigation deadline / patch window after vendor fix | January 22, 2024 / 48 hours | CISA ED 24-01 |
| Deadline to disconnect all Ivanti instances | February 2, 2024 (passwords reset twice by March 1, 2024) | CISA ED 24-01 Supplemental Direction V1 |
| Persistence after factory reset demonstrated | Yes, root-level | CISA AA24-060B, February 29, 2024 |
| ED 25-03 issued (Cisco ASA and Firepower) | September 25, 2025; 2 CVEs | CISA ED 25-03 |
| ED 25-03 inventory deadline / Firepower hard-reset deadline | October 2, 2025 / April 30, 2026 | CISA ED 25-03 |
| CISA Zero Trust Maturity Model | Version 2.0; 5 pillars, 3 cross-cutting capabilities, 4 maturity stages | CISA ZTMM |
Context note: the Ivanti directives date from 2024, but they remain the most cited example of a VPN product line being pulled offline across the US federal government. The Zscaler ThreatLabz blog also flags CVE-2025-22457, a known-exploited critical Ivanti flaw from 2025, as evidence the problem did not end with ED 24-01.
6. Market Size: SASE and SSE Spending Keeps Compounding
Spending confirms the shift better than surveys do. Dell’Oro Group reports the SASE market reached $3.5 billion in Q2 2026, its fifth consecutive quarter of growth above 20% year-over-year (Dell’Oro Group, September 2026). In Q1 2026 the market passed $3 billion, up 21%, with Security Service Edge (the SSE bundle that includes ZTNA) up 22% and access router revenue down 10%. Dell’Oro notes that core SSE growth moderated in Q2 2026 while migration from legacy products continued, which is VPN replacement showing up in revenue.
Forecasts keep getting revised upward. In February 2025 Dell’Oro projected $17.0 billion by 2029 at a 12% CAGR; in August 2026 it raised the outlook to $24 billion by 2030 at a 15% CAGR, with core SSE alone above $13 billion. Back in 2022, Dell’Oro reported that FWaaS and ZTNA revenue had more than doubled in a year (SDxCentral, July 2022).
| Metric | Value | Source |
|---|---|---|
| SASE revenue, Q2 2026 | $3.5 billion (5th straight quarter above +20% YoY) | Dell’Oro Group, September 2026 |
| SASE revenue, Q1 2026 / SSE growth | Over $3 billion, +21% / SSE +22% | Dell’Oro Group, June 2026 |
| SASE revenue, Q2 2025 / SSE / SD-WAN growth | $2.7 billion, +22% / +19% / +27% | Dell’Oro Group, September 2025 |
| Share of SASE revenue from vendors offering both SD-WAN and SSE | 84% (Q2 2025) | Dell’Oro Group, September 2025 |
| SASE forecast | $24 billion by 2030, 15% CAGR; core SSE above $13 billion | Dell’Oro Group, August 2026 |
| Earlier SASE forecast / single-vendor share | $17.0 billion by 2029, 12% CAGR / 90% of market | Dell’Oro Group, February 2025 |
| Network security revenue, Q2 2025 / virtual and SaaS share of new spend | $6.4 billion, +8% / 78% | Dell’Oro Group, September 2025 |
| SSE revenue, Q1 2022 | Over $800 million, +40% (FWaaS and ZTNA more than doubled) | Dell’Oro Group, via SDxCentral, July 2022 |
Context note: in 2022 Dell’Oro forecast the SASE market would exceed $13 billion by 2026 (SDxCentral, August 2022). With Q1 and Q2 2026 at over $3 billion and $3.5 billion, the first half alone is above $6.5 billion, so the forecast looks on track. Dell’Oro also reports network security is projected to eclipse $26 billion in 2025, with hardware appliances expected to decline 2% as cloud-delivered controls grow 20%.
7. User Experience, Cost and the Hybrid Workforce
Security is the lead argument for ZTNA, but daily friction is what employees notice. 51% of organizations say their VPN delivers a poor user experience, and 37% complain of high costs (Zscaler ThreatLabz 2025 VPN Risk Report). The specific complaints are mundane: 23% report slow connections, 20% complex logins and 17% authentication errors, while 47% of IT teams cite frequent patching demands and 54% struggle with troubleshooting. For real-time voice and video calls, every extra hop through a central VPN concentrator adds latency that users experience as lag.
The workforce that VPNs were sized for no longer exists. Gallup’s May 2026 data shows 52% of remote-capable US employees work hybrid, 26% work exclusively remote and only 22% are fully on-site, a mix that has held steady since 2022. A VPN built as an exception path for a few travelling staff is now the main road for 78% of remote-capable workers (52% hybrid + 26% remote), a theme we track in our remote work statistics.
| Metric | Value | Source |
|---|---|---|
| Say VPN gives a poor user experience / cite high costs | 51% / 37% | Zscaler ThreatLabz, 2025 VPN Risk Report |
| Top complaints: slow speed / complex login / auth errors | 23% / 20% / 17% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Management burden: troubleshooting / frequent patching / resource costs | 54% / 47% / 41% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Expected zero trust benefits: security and compliance / simpler management / reduced costs | 76% / 64% / 18% | Zscaler ThreatLabz / Cybersecurity Insiders, 2025 |
| Remote-capable US employees: hybrid / fully remote / on-site | 52% / 26% / 22% (May 2026) | Gallup Indicator: Hybrid Work |
| Employees preferring hybrid | 61% | Gallup Indicator: Hybrid Work |
Context note: only 18% of respondents expect zero trust to cut operational costs, so the business case rests on risk reduction and user experience, not on cheaper licenses.
Summary: Enterprise VPN vs ZTNA Adoption by the Numbers
| Metric | Value | Source |
|---|---|---|
| Plan to replace VPN within a year | 65% (+23% vs prior report) | Zscaler ThreatLabz 2025 VPN Risk Report |
| Adopting or planning zero trust within 12 months | 81% | Zscaler ThreatLabz 2025 VPN Risk Report |
| Reported VPN-exploited breaches in past year | 56% | Zscaler ThreatLabz 2025 VPN Risk Report |
| VPN CVE growth, 2020 to 2025 | +82.5% (411 CVEs) | Zscaler ThreatLabz, 2025 |
| Grant open access to authenticated users | 24% | Cybersecurity Insiders, 2025 |
| Edge device and VPN share of exploitation | 3% to 22% | Verizon DBIR 2025 |
| Edge vulnerabilities fully remediated | 54% (median 32 days) | Verizon DBIR 2025 |
| Breaches starting with software vulnerabilities | 31% | Verizon DBIR 2026 |
| Exploits as top initial infection vector | 32% (6th straight year) | Mandiant M-Trends 2026 |
| Network appliance backdoor dwell time | Nearly 400 days | Mandiant M-Trends 2026 |
| CISA KEV catalog size | 1,733 vulnerabilities | CISA, October 2026 |
| Ivanti VPN disconnect deadline for agencies | February 2, 2024 | CISA ED 24-01 |
| Cisco ASA emergency directive | September 25, 2025 | CISA ED 25-03 |
| SASE revenue, Q2 2026 | $3.5 billion | Dell’Oro Group |
| SSE growth, Q1 2026 | +22% YoY | Dell’Oro Group |
| SASE forecast, 2030 | $24 billion (15% CAGR) | Dell’Oro Group |
| ZTNA share of new remote access by 2025 (prediction) | At least 70% | Gartner |
| High-assurance MFA adoption | 41% to 58% | Okta Businesses at Work 2026 |
| Hybrid share of remote-capable US workers | 52% | Gallup, May 2026 |
| Report poor VPN user experience | 51% | Zscaler ThreatLabz 2025 VPN Risk Report |
Methodology and Sources
Every figure above was read during research for this article and attributed to the organization that produced it. Where a primary page was gated or blocked automated access (Verizon’s full DBIR, Gartner’s newsroom), we used a named intermediary that cites the original study and say so below. Unsourced market-size estimates for ‘ZTNA market’ and ‘VPN market’ from report resellers and SEO listicles were excluded.
- Zscaler ThreatLabz and Cybersecurity Insiders, 2025 VPN Risk Report: press release, ThreatLabz research blog, report summary, Cybersecurity Insiders detail page
- Dell’Oro Group: SASE 2Q 2026, SASE 1Q 2026, SASE 2Q 2025, SASE forecast to 2030 (PR Newswire, August 2026), SASE forecast to 2029 (February 2025), Network security 2Q 2025; 2022 figures via SDxCentral (July 2022) and SDxCentral (August 2022)
- Verizon: DBIR 2026 landing page, DBIR 2025 news release; edge device and VPN detail via Eclypsium
- Google Mandiant: M-Trends 2026, M-Trends 2025
- CISA: ED 24-01 (Ivanti), AA24-060B, ED 25-03 (Cisco), Known Exploited Vulnerabilities catalog, Zero Trust Maturity Model
- Gartner ZTNA prediction and AFCOM survey via Data Center Knowledge (October 2022)
- Okta: Businesses at Work 2026, State of Zero Trust Security in Global Organizations (2020)
- Gallup: Indicator: Hybrid Work (May 2026)
- Data watch: The richest VPN-specific survey data comes from a single vendor-commissioned study (Zscaler with Cybersecurity Insiders, 632 respondents, early 2025); Zscaler sells ZTNA, and its own pages report the lateral-movement concern as both 71% (ranked top concern) and 89% (concerned at all), so we cite each with its wording. No neutral firm publishes a free count of installed VPNs versus ZTNA seats, and Gartner’s 70% ZTNA prediction for 2025 has no public scorecard. Market sizing for SASE comes from Dell’Oro Group only: we could not access Gartner or IDC SASE forecasts, and Dell’Oro’s own outlook moved from $13 billion by 2026 (2022 forecast) to $17.0 billion by 2029 (2025) to $24 billion by 2030 (2026). Verizon’s 2025 edge device figures were read through Eclypsium because the full report is gated; the 2026 DBIR edge-device breakdown was not available on Verizon’s public pages. Gartner’s newsroom and NSA’s site returned 403 errors, and OMB M-22-09 could not be parsed, so federal zero trust deadlines are not quantified here. The Okta 2020 and Gartner 2022 figures are older than three years (most recent available data). A 2026 edition of the Zscaler VPN Risk Report, if published, would supersede sections 1, 2, 3 and 7.
Last updated: October 3, 2026. We update this roundup quarterly, and the next refresh is expected when Dell’Oro Group publishes its 3Q 2026 SASE and SD-WAN report and Zscaler ThreatLabz releases its next VPN Risk Report.