UK’s trusted IT infrastructure partner since 2003
sales@servnetuk.com
0800 987 4111
Servnet
FinanceToolsConfiguratorGet in Touch
Network migration
From
VPN (flat-tunnel)
→
To
Zero-Trust Network Access (ZTNA)

VPN to ZTNA migration — UK Zero-Trust programme

Traditional VPN gives every authenticated user a flat tunnel into the corporate network — a known cause of lateral movement during ransomware incidents and a poor fit for modern hybrid working. ZTNA (Zero-Trust Network Access) gives per-app authenticated + posture-checked access without exposing the network. Servnet runs end-to-end VPN → ZTNA migrations including app discovery, ZTNA platform selection, pilot user wave and final VPN decommission.

Vendor migration programme — VPN (flat-tunnel) source on the left, Zero-Trust Network Access (ZTNA) target on the right, with parallel-running data streams converging through a central Servnet cutover hub.
From → To: VPN (flat-tunnel) vs Zero-Trust Network Access (ZTNA)
CURRENTVPN (flat-tunnel)Production workloadsLegacy management planeRenewal due / EoSServnetparallel-running migrationTARGETZero-Trust Network Access (ZTNA)Production workloadsModern management planeStrategic 5-yr position
Typical outcomes

What good looks like after a VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) migration

Lateral-movement risk
↓ significant

Per-app access removes the "flat tunnel = network access" pattern that enables lateral movement.

Migration window
12-20 wk

End-to-end including app discovery, pilot user wave, mass rollout, VPN decommission.

User experience
↑ better

No VPN client logon delays; transparent per-app access; faster overall.

Cyber-insurance posture
↑ material

Most UK cyber-insurers now ask about ZTNA in renewal questionnaires; ZTNA materially affects premium.

The why

Why UK organisations migrate from VPN (flat-tunnel) to Zero-Trust Network Access (ZTNA)

  • ✓Eliminate lateral movement risk from flat VPN tunnels — a top ransomware enabler
  • ✓Per-app authentication + device posture checks (vs once-authenticated flat tunnel)
  • ✓Better user experience — no client logon delays, no MFA prompts per session
  • ✓Conditional Access integration with Entra ID + Defender for Endpoint posture
  • ✓Material reduction in cyber-insurance premium (most insurers now require ZTNA or similar)
  • ✓Strategic alignment with SASE direction (ZTNA is the access pillar of SASE)
How we run it

Migration phasing — typical VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) programme

VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) — programme timeline
W0W3W6W9W12W15W18W20Discovery + app inventory4wZTNA platform deployment4wPilot user wave (20-50 users)3wMass rollout7wVPN decommission2wTotal programme: 20 weeks · parallel running throughout
  1. 1

    Discovery + app inventory

    Weeks 1-4

    Application inventory — every internal app users access via VPN; usage pattern fingerprint; ZTNA platform selection (<a href="/zscaler">Zscaler Private Access</a>, Cisco Duo Network Gateway, Cloudflare Access, Fortinet ZTNA, others); architecture design.

  2. 2

    ZTNA platform deployment

    Weeks 5-8

    Connector deployment in each network segment hosting target apps; user identity federation with Entra ID; device posture policies; app-by-app access policies; SIEM forwarding.

  3. 3

    Pilot user wave (20-50 users)

    Weeks 9-11

    Pilot users access apps via ZTNA in parallel with VPN; performance + functional validation; helpdesk training; runbook refined.

  4. 4

    Mass rollout

    Weeks 12-18

    User waves migrated per department; VPN access removed per wave after ZTNA validated; daily review of access tickets.

  5. 5

    VPN decommission

    Weeks 19-20

    Legacy VPN infrastructure decommissioned; firewall rules tightened; remaining VPN exceptions documented (rare).

Included in scope

What Servnet delivers in a VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) migration

App inventory + ZTNA platform selection

Honest evaluation of ZTNA platforms against your environment; selection documented with rationale.

ZTNA platform deployment

Connectors deployed; user federation; device posture; app-by-app policies — full architecture implemented.

Entra ID Conditional Access integration

Conditional Access policies enforce identity + device + risk posture per access.

Per-app access policies

Every app discovered during inventory gets a documented access policy (who, what device posture, when).

User wave plan + helpdesk runbooks

Detailed wave plan + helpdesk scripts for access escalations + edge cases.

Post-migration support

90-day hypercare; optional ongoing managed ZTNA service.

De-risking the cutover

Top risks + how we mitigate them

⚠️ Users access apps we didn't discover
Discovery phase combines tooling (VPN logs, NetFlow, EDR) + user surveys. Pilot wave catches anything missed. Post-cutover any "I can't access X" ticket gets fast-tracked into the access policy.
⚠️ Apps with complex network requirements (multicast, broadcast)
Most modern apps work fine over ZTNA; edge cases (multicast, broadcast, certain SCADA / OT protocols) may genuinely need VPN or other connectivity. Discovery phase identifies these honestly.
⚠️ User experience worse than VPN initially
Modern ZTNA platforms generally improve UX vs VPN (no logon delay, transparent access). Where there's regression we tune the platform + connector placement before mass rollout.
⚠️ Cyber-insurance still wants VPN-style access reports
ZTNA platforms provide more detailed access logs than VPN — easier reporting, not harder. We provide the report template insurers typically ask for.
Pricing guide rail

Indicative: VPN → ZTNA migrations for a 500-3,000 user estate typically run £25k-£60k professional services (excluding ZTNA platform licensing). ZTNA licensing typically £8-£25 per user per month depending on platform + tier. Total programme often cost-neutral with VPN eliminated and security uplift substantial. Talk to us for a sized commercial proposal.

Frequently asked

FAQs — VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA)

Which ZTNA platform should we pick?

Depends on your existing stack. M365 / Defender-heavy = Cisco Duo or Cloudflare. Existing Zscaler customers = ZPA. Fortinet FortiGate shops = Fortinet ZTNA. Genuinely vendor-neutral evaluation happens during discovery; we recommend platforms based on your environment, not commission.

Can we keep VPN for specific use cases?

Yes — many enterprises keep a slim VPN for very specific use cases (third-party contractor access, legacy device support, OT protocols). The goal is "VPN as exception, ZTNA as default" not "delete all VPN".

What about Conditional Access — isn't that already ZTNA?

Conditional Access enforces identity + device posture per app — it's a foundational component of ZTNA. But ZTNA platforms add the per-app network access tunnelling that lets you decommission the VPN entirely.

How does this fit with broader SASE strategy?

ZTNA is the access pillar of SASE; combined with SWG, CASB, DLP and SD-WAN you have the full SASE stack. Our 2026 SASE buyer's guide covers the strategy.

Go deeper

Ready to scope your VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) migration?

30-minute discovery call with an engineer who's run this migration before. Honest scoping, no sales script.

Book a scoping call →
💷 Spread the cost · IT finance

Finance the hardware behind your VPN (flat-tunnel) → Zero-Trust Network Access (ZTNA) migration

Spread the cost of the target Zero-Trust Network Access (ZTNA) platform, servers and storage across a lease or hire-purchase term instead of a single capital outlay — keep the migration moving without a big up-front bill. Indicative terms; subject to status.

See IT finance options →

Indicative estimate · subject to change · no credit check at this stage · hire purchase, lease & subscription for UK businesses

Indicative illustration only. Servnet Limited is not authorised or regulated by the FCA and does not provide financial advice or arrange finance. All finance opportunities are referred to Number Eight Business Finance. Finance policy

Talk to a UK specialist

Get expert advice or a no-obligation quote — servers, storage, networking, maintenance, finance and cloud. We reply the same working day.

or call 0800 987 4111