Replacing Your VPN: From Classic VPN to Zero Trust and Mesh VPN

Want to replace your corporate VPN but the target model is not settled yet? WZ-IT's Secure Access Check assesses your current remote access and delivers target model, product choice, migration path and a fixed-price quote for the switch, from €1,490 excl. VAT. The amount is credited towards the switch. Book a free initial consultation

The classic corporate VPN comes from a time when staff, servers and applications sat in one shared network. A gateway at the network edge checks the sign-in and then opens access to an entire segment. Today staff work on the move, applications run in several data centres, and external service providers need access to individual systems. At the same time, the VPN gateways themselves are among the most frequently attacked systems.

This guide explains when replacing the VPN makes sense, which target models exist, how self-hosted and cloud solutions differ, and in which order the switch works without interrupting operations. As of October 2026.

Key points at a glance:

1. Zero trust is an architecture principle, not a product. Access is granted per application or target and by identity, not by network location.
2. VPN gateways from several major vendors have repeatedly appeared in CISA's catalogue of actively exploited vulnerabilities since 2023.
3. There are four target models: cloud ZTNA, a self-hosted mesh VPN, plain WireGuard for sites, and publishing individual applications.
4. The replacement runs group by group in parallel operation. The old gateway is switched off last.
5. The inventory decides the outcome, not the product choice.

Table of Contents

1. Why businesses replace their VPN
2. Vulnerabilities in VPN gateways since 2023
3. Zero trust: what the principle requires
4. The four target models compared
5. Product choice: self-hosted or cloud service
6. Inventory: what must be clear before replacing
7. Migration path: from parallel operation to switch-off
8. NIS2 and access control
9. Common misconceptions
10. Our approach at WZ-IT
11. Further guides

Why businesses replace their VPN

The reasons fall into four groups. Usually two or three come together.

A vendor change forces a reconfiguration anyway. If you have to reconfigure, it makes sense to first check whether the current model is still the right one.

Vulnerabilities in VPN gateways since 2023

The following selection shows vulnerabilities in remote-access gateways that the US cybersecurity agency CISA added to its Known Exploited Vulnerabilities (KEV) catalogue. CVSS scores are from the NVD; differing vendor scores are noted.

For two of these cases CISA issued emergency directives to US federal agencies: ED 24-01 of 19 January 2024 on Ivanti and ED 25-03 of 25 September 2025 on Cisco. The Cisco campaign is described in Cisco ASA, ArcaneDoor and CVE-2025-20362, the Fortinet situation in FortiGate SSL VPN risk 2026.

The table is not a statement about any single vendor. It shows a pattern: a device at the internet edge that accepts connections before sign-in and processes complex protocols is a valuable target, regardless of vendor.

Zero trust: what the principle requires

The US standards institute NIST describes zero trust in SP 800-207 (August 2020) in one sentence: no implicit trust is granted based solely on physical or network location. Sitting in the company network does not automatically grant authorisation.

CISA's Zero Trust Maturity Model 2.0 (April 2023) structures implementation in five pillars: identity, devices, networks, applications and workloads, and data. The German BSI states in its zero trust position paper 2023 that zero trust approaches secure application access better preventively and reduce the impact of attacks.

For remote access this translates into four requirements:

• Identity before access: sign-in through a central identity service with multi-factor, such as Keycloak or authentik.
• Access per target: policies define which group reaches which application or system, not which network.
• Device posture: access only from devices that meet defined conditions, such as operating system version or active antivirus.
• Logging: a traceable record of who accessed what and when.

A detailed definition is in the knowledge article What is ZTNA?.

The four target models compared

In practice the models are combined. A common setup is a mesh VPN for staff, administrators and service providers, complemented by WireGuard tunnels between data centres and individual published web applications. How internal services become reachable without a VPN client is described in NetBird reverse proxy.

Product choice: self-hosted or cloud service

The fundamental question is: where do the control plane and connection data live? With cloud ZTNA both are at the vendor; with self-hosted solutions they are on your own infrastructure or at an operator of your choice.

Sources: GitHub, NetBird, NetBird pricing, self-hosted, GitHub, Headscale, Tailscale pricing, WireGuard, WireGuard 1.0.0 for Linux 5.6, OpenVPN Access Server pricing. As of October 2026.

Some points that often get lost in comparisons:

• NetBird Community Edition can be used without limits on users and devices, according to the vendor. Commercial Starter adds high availability, SCIM provisioning, device approvals and email support. What that means in numbers is covered in NetBird self-hosting licence. The current release is NetBird v0.80.0 of 1 October 2026.
• Headscale covers a single tailnet according to its README and targets personal use or small open-source organisations. The current release is v0.29.4 of 23 September 2026.
• Per-user pricing grows with every person and every service provider. At which size a fixed price pays off is shown in Tailscale pricing 2026.

Six mesh VPN solutions with architecture, licence and pricing are compared in Mesh VPN comparison 2026.

Inventory: what must be clear before replacing

Most problems in a VPN replacement do not come from the new product but from access paths nobody had on the list. The inventory therefore first clarifies what today's VPN actually does.

The inventory produces an access matrix: group, target, protocol, condition. It is the template for the policies in the new system and, at the same time, the documentation for evidence.

Migration path: from parallel operation to switch-off

The switch follows a fixed sequence. The old VPN and the new model run in parallel until the last group has moved.

1. Prepare the identity service. Create groups or take them over from the directory, enable multi-factor for all groups.
2. Build the control plane. Self-hosted on your own infrastructure or at the operator, with backups and monitoring. Highly available if required.
3. Transfer policies from the access matrix. Grant each group only the targets it needs. Add device conditions.
4. Switch the pilot group. Usually IT itself. Experience with clients, name resolution and applications feeds into the guide for everyone.
5. Move groups one after another. Staff, administrators, service providers, each with a short guide. If problems occur, the old VPN remains the fallback.
6. Connect sites. Switch site-to-site tunnels to WireGuard or to the mesh VPN; the knowledge article on WireGuard site connectivity covers the details.
7. Switch off the old gateway. Once the logs show no more connections, access is deactivated, the port forwards at the internet edge are closed and the licences are cancelled.

Step-by-step guides exist for the most common starting points: migrate OpenVPN to NetBird and migrate FortiGate SSL VPN to NetBird.

NIS2 and access control

The NIS2 directive requires in Article 21(2), among other things, access control policies (point i) and "the use of multi-factor authentication or continuous authentication solutions" (point j). In Germany, the NIS2 implementation act of 2 December 2025 entered into force on 6 December 2025 (BGBl. 2025 I No. 301); the requirement from point j is in section 30(2) no. 10 BSIG.

NIS2 does not prescribe a product or an access model. An identity-based model with per-group policies, multi-factor and logging does, however, deliver exactly the evidence that is asked for: who has access, on what basis, and who accessed what and when.

Not legal advice. Whether and how NIS2 applies to your business should be clarified with your legal or compliance advisers. Trademarks belong to their owners.

Common misconceptions

Our approach at WZ-IT

WZ-IT supports the replacement from inventory to operation. Every step has a defined result.

1. Secure Access Check. The Secure Access Check costs from EUR 1,490 net. The result is the inventory with access matrix, the target model, the product choice with reasoning, the migration path and a fixed-price quote for the VPN migration sprint. If a cloud service or another product fits better, the recommendation says so. The amount is credited towards the switch if you commission it within 6 months on the same topic.
2. VPN migration sprint. In the VPN migration sprint from EUR 2,490 net we implement identity integration, control plane and policies, move the pilot group, groups, service providers and sites, and switch off the old gateway.
3. Operation. With Managed NetBird from EUR 349.90 net per month we take care of updates, backups, monitoring and support for the control plane. All remote access services are listed under VPN services.

WZ-IT is an official NetBird reseller. You can obtain Commercial Starter and Enterprise licences through WZ-IT. When WZ-IT operates NetBird, support beyond the vendor's email support is included.

Further guides

• FortiGate SSL VPN risk 2026, why exposed VPN appliances become a liability.
• Cisco ASA, ArcaneDoor and CVE-2025-20362, how a campaign against VPN gateways unfolded.
• Mesh VPN comparison 2026, six solutions with architecture, licence and pricing.
• NetBird self-hosting licence, what Commercial Starter unlocks.
• Tailscale pricing 2026, when self-hosting is cheaper.
• What is ZTNA?, the terms in the knowledge section.
• VPN services, all WZ-IT remote access services.

Replace your VPN without interrupting operations. We assess your remote access, recommend target model and product, and move group by group until the old gateway is switched off. Book a free initial consultation

Sources

• NIST SP 800-207, Zero Trust Architecture
• CISA, Zero Trust Maturity Model
• BSI, Zero Trust (German)
• NVD, CVE-2023-4966
• NVD, CVE-2023-46805
• NVD, CVE-2024-21887
• NVD, CVE-2024-21762
• NVD, CVE-2024-3400
• NVD, CVE-2025-0282
• NVD, CVE-2025-5777
• NVD, CVE-2025-20362
• NVD, CVE-2025-20333
• CISA, Advisory AA23-325A
• CISA, Emergency Directive 24-01
• CISA, Emergency Directive 25-03
• Fortinet, FortiOS 7.6.3 release notes: SSL VPN tunnel mode replaced with IPsec VPN
• Microsoft Learn, Deprecated features for Windows client
• GitHub, NetBird
• NetBird pricing, self-hosted
• GitHub, Headscale
• Tailscale pricing
• WireGuard
• WireGuard 1.0.0 for Linux 5.6
• OpenVPN Access Server pricing
• Directive (EU) 2022/2555 (NIS2)
• BGBl. 2025 I No. 301, German NIS2 implementation act