Skip to content
Start with Identity
Join free
implementation · Advanced

Zero Trust rollout: from VPN replacement to mature program

By SWI Community Team · Updated 2026-11-05 · 18 min

A Zero Trust rollout is a 12 to 24 month program (a practitioner estimate) that moves access decisions from network location to verified identity, device, and context: modernize identity first, pilot ZTNA on one application, expand and switch off the VPN, then add microsegmentation and SaaS data controls. This guide is for IAM, network, and security architects who need a sequence that survives contact with a real estate, not a product brochure.

What Zero Trust actually is

NIST SP 800-207 (August 2020) defines Zero Trust as granting no implicit trust to assets or user accounts based solely on their physical or network location, and protecting resources rather than network segments. The product category that delivers most of it is Zero Trust Network Access, which brokers access to individual applications instead of dropping a connected user onto a flat internal network. For the concept in plain terms, see what is Zero Trust.

Two newer public references are worth using as scaffolding:

  • CISA Zero Trust Maturity Model 2.0 (April 2023) scores five pillars (Identity, Devices, Networks, Applications and Workloads, Data) across four stages: Traditional, Initial, Advanced, Optimal. Three cross-cutting capabilities sit across every pillar: visibility and analytics, automation and orchestration, and governance.
  • NIST SP 1800-35 (final June 2025), "Implementing a Zero Trust Architecture," documents 19 example implementations built with 24 collaborators from commercially available products. It is the closest thing to a public reference build.

Why the order matters: what skipped steps cost

The recurring entry point in identity breaches is remote access that trusted a password or an appliance instead of a verified identity:

Identity hygiene closes the first two. Retiring the internet-facing VPN closes the third. That is why identity comes first and the VPN sunset is not optional.

The honest sequence

Quarter 1: Foundation. Modernize identity first. Single sign-on covering the large majority of applications. MFA enforced for all users, phishing-resistant for admins, because AiTM phishing proxies and MFA fatigue defeat push and OTP. Conditional access policies written and tested in report-only mode before enforcement. Find and disable every legacy VPN profile and local account. This quarter determines whether everything after it works.

Quarter 2: ZTNA pilot. Pick one critical internal application. Replace VPN access to it with a ZTNA gateway. Verify the user experience end to end, confirm audit visibility, and prove that access now depends on identity and device posture rather than network position.

Quarters 3-4: ZTNA expansion. Onboard the next tranche of applications, roughly twenty at a time (an estimate; size batches to your support capacity). Sunset the corresponding VPN tunnels as each application moves, because the security benefit comes from retiring the old path, not from adding a new one beside it. Make device posture a required input to access decisions.

Year 2: Microsegmentation and continuous monitoring. Add east-west controls so a foothold in one segment does not become free lateral movement across the estate. Feed identity telemetry to the SOC and adopt the Shared Signals Framework (CAEP and RISC, Final since August 2025) where your IdP and SaaS apps support it, so a revoked session or risky user propagates without waiting for token expiry. Defend against session cookie theft and token replay, which bypass login-time checks entirely.

Year 2 ongoing: SaaS data controls. Extend policy to SaaS traffic with a secure service edge or cloud access broker, inline data loss prevention, and browser isolation for risky destinations. This closes the gap between "the network is controlled" and "the data is controlled."

Phase exit checklist

Phase Do not start the next phase until CISA ZTMM pillar
Foundation MFA on 100% of remote access paths; legacy VPN profiles disabled; admins on phishing-resistant MFA Identity
ZTNA pilot One critical app reachable only through ZTNA; posture check enforced; logs in the SIEM Networks, Devices
Expansion VPN tunnels retired at the same pace apps move; exception list with owners and end dates Networks, Applications and Workloads
Microsegmentation Posture and identity signals flowing; east-west policy in monitor mode first Networks
SaaS and data Inline DLP on sanctioned SaaS; session revocation tested end to end Data

Metrics to track

  • Percentage of applications behind SSO and behind ZTNA, trending up each quarter
  • Percentage of VPN tunnels retired, which should track ZTNA expansion, not lag it
  • MFA coverage and phishing-resistant coverage for privileged accounts
  • Mean time to revoke access for a departed user or compromised device
  • Access decisions denied on posture, a sign the posture signals are actually being used

Vendor decisions

The ZTNA layer is the high-use decision. Cloudflare, Zscaler, Netskope, Palo Alto Prisma Access, Cisco Secure Access, Twingate, and Tailscale represent different price-performance points; compare them in the best Zero Trust tools ranking, the top ZTNA tools article, and open source Zero Trust tools. Note the 2026 consolidation: Palo Alto Networks closed its acquisition of Idira (formerly CyberArk) on 2026-02-11, so one vendor now sells both ZTNA and PAM; evaluate the privileged access tier on its own merits rather than as a bundle add-on. Microsegmentation is a separate purchase (Illumio, Zero Networks, or native cloud controls). For the architectural underpinnings, see the Zero Trust architecture implementation guide and identity-first architecture.

Common pitfalls

  • Buying ZTNA before identity hygiene is complete, which produces garbage-in, garbage-out access decisions
  • Treating Zero Trust as a single project instead of a multi-year program with a roadmap and owners
  • Skipping the VPN sunset, so both systems run indefinitely and the concentrator stays internet-facing
  • Leaving service accounts and break-glass paths outside the model; pair the rollout with zero standing privileges
  • Underestimating change management for users moving from VPN to ZTNA, which drives support load and shadow workarounds
  • Buying microsegmentation before basic posture signals are flowing, so the controls have no context to act on

Sequenced this way, Zero Trust stops being a slogan and becomes a measurable reduction in standing access and blast radius, one quarter at a time.

Frequently asked questions

What is Zero Trust in practice?
Zero Trust is a security model, not a product. NIST SP 800-207 defines it as granting no implicit trust to users or assets based on their network location, and verifying identity, device, and context for each access request. In practice, most organizations deliver the largest share of it through Zero Trust Network Access (ZTNA), which brokers access to individual applications instead of placing users on a flat network.
Where should a Zero Trust rollout start?
Start with identity, not a network product. You need single sign-on covering the large majority of applications, multi-factor authentication enforced for all users, and tested conditional access policies before ZTNA can make good decisions. Buying ZTNA before identity hygiene is in place produces garbage-in, garbage-out access decisions.
How long does a Zero Trust program take?
As a typical practitioner estimate, plan for 12 to 24 months to reach maturity. A realistic sequence is a quarter to modernize identity, a quarter to pilot ZTNA on one critical application, two quarters to expand ZTNA and sunset the matching VPN tunnels, and a second year for microsegmentation, continuous monitoring, and SaaS data controls.
What is the most common Zero Trust mistake?
Treating Zero Trust as a single product purchase instead of a multi-year program, and buying ZTNA before identity hygiene is complete. The other frequent failure is never sunsetting the VPN, so the organization runs both indefinitely and gains the cost of the new model without the security benefit of retiring the old one.
Does ZTNA fully replace a VPN?
For user-to-application access, usually yes, once every application behind a tunnel has moved. Some traffic stays harder to move: legacy thick clients, peer-to-peer protocols, and admin tooling that expects network-level reach. Plan those as explicit exceptions with owners and end dates. The security gain comes from switching the VPN concentrator off, because internet-facing VPN appliances have been a repeated ransomware entry point in 2024 to 2026.
How do I measure Zero Trust maturity?
Use the CISA Zero Trust Maturity Model 2.0, released in April 2023. It scores five pillars (Identity, Devices, Networks, Applications and Workloads, Data) across four stages: Traditional, Initial, Advanced, and Optimal, plus three cross-cutting capabilities. Score yourself per pillar at the start, set a target stage for each, and track operational metrics such as VPN tunnels retired and phishing-resistant MFA coverage.
Last reviewed By SWI Community TeamSuggest a correctionHow we research