By Nate Brady - Cloud Security Architect
July 17, 2025 5 Minute Read
The cybersecurity industry has developed a fascinating consensus around Zero Trust Network Access (ZTNA): position it as a direct replacement for aging VPN infrastructure, promise minimal disruption, and migrate policies gradually over time. The messaging is compelling — avoid the complexity of organizational change while gaining modern security benefits. The economics, however, may tell a different story.
I predict that organizations traveling this “easy” path will discover that the approach, intended to minimize short-term disruptions, actually maximizes long-term costs. Meanwhile, those who see ZTNA migration as an opportunity for fundamental IT transformation will find their sweat equity pay dividends in operational efficiencies. I’m a firm believer in the good-fast-easy triad (you can choose only two) and in this blog I’ll explain how this holds true for ZTNA adoption.
The Application Inventory Crisis
The root of this paradox lies in a blind spot that most enterprises share but rarely acknowledge: they don’t actually know what applications they own, who uses them (with what data), or what business value they provide. Years of organic IT growth, acquisitions, and departmental initiatives have created sprawling application portfolios that resist easy categorization.
Traditional VPN infrastructure has enabled this opacity. Broad network access policies obscure actual application usage patterns. When employees can reach “everything on the network,” nobody needs to justify why specific applications exist or who requires access. The VPN becomes a convenient abstraction layer that masks fundamental governance gaps.
The ZTNA-as-VPN-replacement approach perpetuates this dynamic. Vendors promise to replicate existing access patterns with minimal organizational disruption. The implicit message: you can achieve zero trust security without the inconvenience of understanding what you’re protecting. This creates a market incentive structure where complexity is rewarded and rationalization is avoided.
Consider the economic implications. Organizations routinely maintain applications whose original business justification has expired. They pay licensing fees for software that serves diminishing user populations. They allocate infrastructure resources to systems that could be consolidated or retired. The VPN replacement model preserves these inefficiencies while adding new technology costs on top.
The False Economy of “Risk Mitigation”
The irony deepens when examining how organizations frame their decision-making. The application inventory and rationalization process gets characterized as “risky”— what if we accidentally restrict access to something important? What if application owners push back on justification requirements? What if we discover our IT portfolio is more chaotic than we thought?
These concerns reflect genuine organizational dynamics, but the risk calculus is backwards. The actual risk lies in perpetual ignorance about your IT environment. Security teams cannot implement effective controls for applications they don’t understand. Compliance efforts become exercises in documentation theater rather than substantive risk management. Business continuity planning relies on assumptions rather than evidence.
The market has responded predictably to these misaligned incentives. A consulting ecosystem has emerged around managing the complexity rather than reducing it. Organizations will engage expensive professional services to migrate hundreds of applications to ZTNA platforms without questioning whether those applications should exist in the first place. The fees for this “risk mitigation” often exceed the cost savings that proper rationalization would generate.
The Zero Trust Dividend
Organizations that choose the transformation path discover something unexpected: proper zero trust implementation creates a forcing function for long-overdue IT portfolio optimization. When every application must have an identified owner, justified business purpose, and classified data flows, the cleanup happens organically.
The economics become compelling quickly. Application retirement eliminates licensing costs, reduces infrastructure requirements, and decreases security surface area. Consolidation opportunities emerge when teams discover they’re maintaining multiple tools for identical functions. Technical debt reduction follows naturally when deprecated systems lose their protective anonymity.
The quantifiable benefits often surprise leadership teams. License optimization alone typically generates 20-40% cost reductions in software spending. Infrastructure rationalization yields similar savings in compute and storage costs. The operational efficiency gains—fewer systems to patch, monitor, and backup — create ongoing dividend streams that compound over time.
Perhaps more importantly, organizations develop actual knowledge about their IT environments. This capability enables faster incident response, more accurate business impact assessments, and data-driven technology investment decisions. The competitive advantages accumulate steadily for enterprises that understand what they own and how it creates value.
Reframing the Business Case
The traditional cybersecurity business case positions security improvements as necessary expenses — investments in risk reduction that don’t directly generate revenue. This framing puts security teams at a systematic disadvantage when competing for budget against initiatives that promise obvious financial returns.
The application inventory dividend changes this dynamic entirely. Zero trust implementation becomes an IT portfolio optimization initiative that happens to include security improvements. The business case shifts from “how much will this security project cost?” to “how much money will this optimization effort save us?”
The timeline considerations reinforce this reframing. Application rationalization benefits begin immediately — retired applications stop generating costs in the current month. License optimization shows up in the next renewal cycle. Infrastructure reductions flow through to quarterly cloud bills. These savings typically fund the ZTNA implementation within 12-18 months, after which the security improvements become essentially free.
Organizations that embrace this framing find their zero trust initiatives receive different stakeholder reception. CFOs become allies rather than skeptics. Business unit leaders engage proactively when they understand the efficiency benefits. Technology teams appreciate the opportunity to eliminate technical debt that has accumulated over years.
The Strategic Choice
The VPN end-of-life crisis presents a strategic inflection point that extends far beyond technology replacement. Organizations can choose to perpetuate existing inefficiencies with new tools, or they can use the transition requirement as a catalyst for fundamental improvement.
The “easy” path preserves organizational comfort zones while adding technology complexity and cost. The transformation path requires short-term disruption but creates sustainable competitive advantages through improved IT portfolio management, operational efficiency, and genuine security capability.
The economics favor transformation, but only for organizations willing to confront the application inventory reality they’ve been avoiding. Those that choose this path discover that the hardest problems often have the most profitable solutions. The market dynamic rewards this courage — enterprises with clean, well-understood IT portfolios outperform their peers across multiple dimensions.
The question isn’t whether your organization will eventually rationalize its application portfolio. Market pressures, compliance requirements, and operational costs will eventually force this reckoning. The question is whether you’ll use the current VPN transition as an opportunity to do it strategically, or wait for a crisis to do it reactively.
The organizations making this choice today will be the ones with sustainable competitive advantages tomorrow.
About the Author
Nate Brady
Cloud Security Architect
Nathan Brady is an Enterprise Architect at Skyhigh Security. Nathan received his doctorate in business economics from the University of Newcastle, Australia, an M.B.A from the University of Kansas, undergraduate degrees in business and engineering, and industry certifications including the CISSP, CCSP, Microsoft ASAE, and AWS-CSA.
Dr. Brady also serves on the executive Board for (ISC)2 Chicago. For the past twenty years, Nate has served as a trusted advisor in building critical IT infrastructure for many Fortune 500 companies.
Back to Blogs