Survey Finds 56% of Organizations Reported VPN-Related Attacks as ZTNA Adoption Grows

Summary

A Netskope-supported survey of 683 cybersecurity and IT professionals conducted in early 2025 found 56% reported VPN-related attacks in the previous year. Security concerns and access-management challenges are driving interest in ZTNA.

Key points

Cybersecurity Insiders surveyed 683 professionals in early 2025 with Netskope's support; the report describes stratified sampling and a ±3.75% margin of error.
56% of respondents reported attacks exploiting VPN server vulnerabilities in the previous 12 months, including 41% reporting multiple incidents.
26% said their organizations had deployed zero trust network access, while another 37% planned implementation within the next year.
Enhanced security was a desired ZTNA benefit for 78% of respondents, followed by simpler infrastructure management at 63% and better application performance at 51%.
53% cited insufficient security controls as a challenge with their network access control solutions, and 45% cited difficulties managing remote and hybrid access.
86% considered real-time visibility into user activity and data access at least moderately critical during ZTNA migration; 60% rated integration with security service edge platforms very or extremely important.
The report recommends phased migration, reassessing privileges, application-level access controls, adaptive authentication and integrating access logs with SIEM or SOAR platforms.

Article Details

Publisher: Cybersecurity Insiders and Netskope
Report Period: Survey fielded in early 2025; incident questions cover the preceding 12 months.
Scope: Survey of VPN and NAC security risks, remote-access usability, and ZTNA adoption across diverse industries and company sizes.
Sample Size: 683 cybersecurity and IT professionals; stratified sampling with a reported 95% confidence level and ±3.75% margin of error.
Key Statistics: 56% of surveyed organizations reported at least one attack exploiting VPN server vulnerabilities in the preceding 12 months; 41% reported multiple incidents and 8% reported more than five.
32% of respondents estimated that excessive user access privileges contributed to more than half of their organization's security incidents in the preceding 12 months.
26% of organizations had already deployed ZTNA, and another 37% planned implementation within the next year.
78% cited enhanced security as a desired benefit of transitioning to ZTNA, followed by simplified infrastructure management at 63% and better application performance at 51%.
86% considered real-time visibility into user activity and data access at least moderately critical when transitioning to ZTNA; 47% rated it very or extremely critical.
Recommendations: Use a phased VPN-to-ZTNA migration, prioritizing critical applications and user groups; verify support for essential legacy applications before retiring VPN infrastructure.
Reassess entitlements, enforce role-based least-privilege access, and replace broad network access with application-level controls that evaluate device posture, identity, and contextual risk.
Integrate ZTNA into an SSE or SASE strategy to unify access enforcement, data protection, and security policies.
Continuously monitor access behavior, integrate ZTNA logs with SIEM or SOAR platforms, and routinely audit permissions and policy effectiveness.
Modernize authentication using passwordless authentication, adaptive MFA, and SSO.