The VPNs We Chased for Years: Who Is Replacing Them?

Late last year, while running a security assessment for an auto parts factory in Shunyi, an older engineer opened the Cisco ASA that had been running in the equipment room for seven years. I saw something in his eyes I could not quite name — not disdain, more like bidding farewell to an old comrade-in-arms. His remark, “Configuring this thing back then took me three days and three nights,” made me realize that for many Beijing enterprises, VPN is not just a tool. It is memory, it is cost, it is historical baggage.

But market data has no sentiment. In IDC’s Q4 2025 Worldwide Security Spending Guide, the ZTNA (Zero Trust Network Access) market has already reached US$4.7 billion, with a compound annual growth rate above 26%. Gartner goes further and predicts that by 2027, more than 60% of enterprises will replace traditional VPN with ZTNA, more than triple the 18% recorded in 2024. This is not the wolf crying at the door. The wolf is already in the village.

From “Whether” to “How”: How Far Has ZTNA Deployment Come?

I divide the enterprise ZTNA deployments I have seen into three stages. The first is the POC stage, where enterprises are usually pushed along by compliance requirements or by vendors. One client was working on an MLPS Level 3 (China’s Multi-Level Protection Scheme) remediation last year; the moment the vendor heard they were still using IPSec VPN, it immediately recommended moving to ZTNA for identity-based perimeter control. He asked tentatively whether they could get by with their existing Huawei firewall, and we had to say, “It will run, but not far.” The second is the scenario expansion stage, where enterprises past POC start pushing ZTNA into deeper waters — internal applications, SaaS, cross-cloud environments. A medical device manufacturer in Tongzhou brought its ERP, R&D environment, and dealer portal entirely under ZTNA control. The third is the full replacement stage, where enterprises are no longer satisfied with “it works” but pursue “it works well” — SDP integrated with micro-segmentation, dynamic risk assessment, end-to-end encryption. A smart manufacturing client in Shunyi linked ZTNA with OT network isolation, so that any device joining the network must first pass identity authentication.

Interestingly, the distribution across these three stages is roughly normal. IDC research shows that 42% of enterprises are still in POC or have just passed POC, 35% are in the scenario expansion stage, and only 23% have truly completed a full replacement. That means most enterprises still have a long way to go, and it also means this market is far from saturated.

Doing the Math for SMBs: Is ZTNA’s ROI Worth It?

Whenever a client asks how much more expensive this is than VPN, I first ask in return: are you counting purchase cost, or total cost of ownership (TCO)?

Purchase cost is indeed higher. Mainstream ZTNA products are subscription-based per user, with annual fees ranging from RMB 300 per user per year (Basic) to RMB 1,200 per user per year (Enterprise). For a 100-person company, that is RMB 30,000 to 120,000 a year. Compared with the one-time investment in VPN hardware (a good enterprise-grade VPN gateway can be had for RMB 20,000–50,000), the first three years are indeed somewhat more expensive.

But the math should be done differently: VPN maintenance cost is a hidden black hole in enterprise IT. We have seen far too many cases — a VPN appliance failure leaves the whole company unable to work, and the IT director is woken by a phone call at two in the morning; during the pandemic, VPN concurrency bottlenecks forced companies into emergency capacity expansion; accounts not revoked in time after an employee leaves create security risks. These hidden costs, plus the loss of time, can be more damaging to an SMB than the purchase price.

ZTNA’s advantage lies precisely in being worry-free. Identity-based access control means no need to manage a pile of IP address ranges; dynamic policies revoke access the moment an employee leaves; fine-grained logs give audits something to stand on. IDC research data shows that ZTNA users cut average security incident response time by 67%. My rule of thumb: for a company with more than 50 people, 18 months is generally enough to break even against VPN’s total cost of ownership, and every year after that, the saved operations labor and reduced risk cost are pure gain.

The Deployment Path: Not a Tear-Down, but a Gradual Replacement

Many companies assume that replacing VPN means turning everything upside down. It does not. My advice has always been: do not build PPT-driven zero trust; build business-driven zero trust. A practical path can follow four steps:

1. Step 1: Inventory your assets. Classify the applications currently carried by VPN by importance and user group, and clarify which are high-frequency core systems and which are low-frequency edge cases. This step often takes more time than technology selection, but it is critical to later decisions.
2. Step 2: Pick one “anchor scenario” to start with. Remote work is the most common starting point, because VPN’s pain points are most obvious there and incremental deployment carries the lowest risk. Prove it on one business line first, then consider expanding horizontally.
3. Step 3: Migrate gradually. Put new applications directly on ZTNA; let legacy applications keep running on VPN for a while, using a gateway for hybrid access, and slowly move traffic off the VPN side. This stage tests patience the most, but it is also where results become visible.
4. Step 4: Retire VPN. Once ZTNA coverage passes 80%, you can consider letting VPN “retire.” Of course, core appliances can be kept as a fallback; a little caution never hurts.

For an SMB, the whole process usually takes 6 to 12 months. You cannot rush it, and you cannot drag it out — rushing leads to missteps, while dragging makes the return on investment look poor. We previously served a software outsourcing client that started with the remote work scenario and completed a full switch in eight months, with no business interruption caused by the migration at any point.

But a lower technology barrier does not mean a lower implementation barrier. Deploying ZTNA is never just about buying a product; it means reworking your identity system, adjusting your network architecture, and changing how you think about security management. Understanding that matters more than choosing a vendor.