Zscaler VPN Risk Report Highlights Patching, Inspection and Containment Gaps
Report discovered via Awesome Annual Security Reports.
Summary
A Zscaler and Cybersecurity Insiders survey of 822 professionals found 54% need at least a week to patch critical VPN flaws, while 60% inspect a quarter or less of encrypted VPN traffic.
Key points
- The 2026 report surveyed 822 IT and cybersecurity professionals; 51% reported a VPN-vulnerability-related security incident in the preceding 12 months.
- Only 6% said they could fully deploy critical VPN patches within 24 hours; 54% needed a week or longer.
- Respondents reported substantial inspection gaps: 33% inspected no encrypted VPN traffic, and 60% inspected a quarter or less.
- Only 11% could restrict a compromised session to one application; 32% said a stolen VPN credential could expose their entire network.
- Eighteen percent reported confirmed AI-enabled attacks and 43% suspected them. These classifications reflect respondents' observations and attribution, not independently verified AI use.
- Eighty-four percent were planning, undertaking or had completed a zero trust transition, compared with 78% two surveys earlier; 51% reported declining VPN usage.
- The report recommends application-specific access, continuous identity and device verification, inline traffic inspection, and automated detection and response to reduce exposure during migration.
Article Details
- Publisher
- Cybersecurity Insiders, in partnership with Zscaler ThreatLabz
- Report Period
- 2026 report; methodology states the survey was conducted in early 2025.
- Scope
- Enterprise VPN exposure, AI-assisted threats, encrypted traffic inspection, lateral movement containment, and zero trust migration readiness.
- Sample Size
- 822 IT and cybersecurity professionals with network access responsibilities; reported 95% confidence level and ±3.4% margin of error.
- Key Statistics
- 61% of respondents reported confirmed or suspected AI-enabled attacks in the preceding 12 months: 18% confirmed and 43% suspected. Classification reflects respondents' observations and attribution, not laboratory-grade certainty.
- Only 6% said they could deploy critical VPN patches within 24 hours; 54% required a week or more.
- 60% reported inspecting a quarter or less of encrypted VPN traffic for threats, including 33% performing no inspection.
- Only 11% could restrict a compromised session to one application; 32% said a single stolen credential could expose the entire network.
- 84% were planning, transitioning to, or had completed zero trust adoption, compared with 78% in the 2024 survey.
- Recommendations
- Replace broad network connectivity with least-privilege, per-application session access to reduce lateral movement and compromise blast radius.
- Continuously verify identity, device posture, and behavior on every request rather than only at initial login.
- Inspect encrypted traffic inline at the access layer for malware, command-and-control, and exfiltration.
- Automate threat detection and response and use telemetry to refine access policies continuously.
- Assess enforced production controls against the CISA-aligned readiness matrix and independently evaluate the Devices and Data pillars outside the survey's scope.
MITRE ATT&CK
T1056.003 · Web Portal CaptureA reported credential-theft operation distributed trojanized VPN installers that displayed fake login prompts to capture enterprise VPN credentials.T1078 · Valid AccountsAttackers use stolen VPN credentials to authenticate and inherit legitimate users' network access.T1110 · Brute ForceGreyNoise reportedly detected a coordinated brute-force campaign targeting Cisco SSL VPN and Palo Alto GlobalProtect portals in December 2025.T1133 · External Remote ServicesThe report describes ransomware operators and other adversaries obtaining initial access through enterprise VPN services.T1190 · Exploit Public-Facing ApplicationThe report describes active exploitation of internet-facing VPN and firewall appliances, including Ivanti VPN zero-days.T1486 · Data Encrypted for ImpactThe report states that Fog ransomware operators completed attack chains from VPN login to encryption in under two hours.
CVE
People
Threat Actors
AkiraThe report attributes over $42 million in VPN-based campaign proceeds to the group, citing FBI and CISA, and describes renewed targeting of SonicWall SSL VPN devices in mid-2025.Black BastaLeaked internal communications reportedly documented vulnerability prioritization, access-broker credential pricing, and target selection using internet-facing portals.FogRansomware group reportedly completing VPN-login-to-encryption attack chains in under two hours.Salt TyphoonReportedly penetrated U.S. telecommunications providers and compromised lawful intercept systems.Storm-2561A cited Microsoft report identifies this actor as using SEO poisoning to distribute fake VPN clients for credential theft.UAT4356Described as a China-aligned group exploiting three Cisco ASA/FTD zero-days from May through September 2025 against government networks worldwide.Volt TyphoonThe report cites CISA and intelligence agencies confirming targeting of critical infrastructure and access maintained in some networks for years.
Vendors
CiscoCisco ASA/FTD zero-days had been exploited again six days later. 56% rank patching as theirIvantiIn January 2025, a critical Ivanti VPN zero-day breakout time at 29 minutes in 2025, with thePalo Alto NetworksVPN attack risk, 63% named it first. As an Cisco SSL VPN and Palo Alto GlobalProtectSonicWallSonicWall SSL VPN campaign with short never be fast enough.WatchGuarda WatchGuard Firebox zero-day (CVE-2025- that vulnerabilities are weaponized faster thanZscaler| How Zscaler Transforms Secure Access | | | | | | 19 |
Products
Cisco ASA/FTDCisco ASA/FTD zero-days had been exploited again six days later. 56% rank patching as theirGlobalProtectVPN attack risk, 63% named it first. As an Cisco SSL VPN and Palo Alto GlobalProtectIvanti Connect Secure4. CISA, Emergency Directive 25-01: Mitigate Ivanti Connect Secure Vulnerabilities, January 2025; Mandiant, CVE-2025-0282 Analysis, January 2025.SonicWall SSL VPNSonicWall SSL VPN campaign with short never be fast enough.VMware ESXitunnels strip away. attacker to pivot through to VMware ESXiWatchGuard Fireboxa WatchGuard Firebox zero-day (CVE-2025- that vulnerabilities are weaponized faster thanZscaler Private Access (ZPA)| Key Differentiators of Zscaler Private Access (ZPA) | | | | | | 20 |Zscaler Zero Trust Exchangesecure. The Zscaler Zero Trust Exchange™ platform protects thousands of customers from cyberattacks and data
Tools
Countries
Industries
communicationsdevices.² Black Basta’s leaked internal communicationsEnergyenergy, transportation, and water sectors, twelve months – a figure that spans every experienced aGovernmentWhen standard recovery fails and the government orders disconnection, the securityTelecommunicationsdeep penetration of U.S. telecommunications may be higherTransportationenergy, transportation, and water sectors, twelve months – a figure that spans every experienced awaterenergy, transportation, and water sectors, twelve months – a figure that spans every experienced a