I Replaced My VPN with ZTNA. Why Did I Fail My Zero Trust Audit?

Replacing your VPN with ZTNA does not automatically make your network Zero Trust compliant. The most likely reason you failed your audit is that you changed the remote-access mechanism without demonstrating that your security architecture enforces Zero Trust principles.

Zero Trust is not a product. It’s an enterprise security architecture built around continuous verification, least privilege access, and limiting the impact of a compromise.

Zero Trust doesn’t require a specific technology. It focuses on the security outcomes those controls achieve. When it’s time for a Zero Trust access audit based on a framework like NIST, SOC 2, PCI DSS, DORA, etc., organizational accountability means implementing controls that meet the audit’s defined scope and criteria.

ZTNA Has Three Large Zero Trust Architectural Gaps

An auditor can find inconsistent control enforcement in a ZTNA implementation even when it’s working exactly as designed because ZTNA has a number of architectural gaps.

1.     ZTNA does not inherently protect every access path

An organization may deploy ZTNA for remote employees while retaining direct connectivity for on-prem users, privileged admins, service accounts, and internal workloads. There are many legitimate reasons for network designs like this, including compute budget and latency impacts on user productivity.

In this scenario, the direct connections may never pass through the ZTNA policy enforcement point. A Zero Trust access audit will find inconsistent zero trust enforcement even though the ZTNA implementation is working exactly as configured.

2.     ZTNA does not inherently provide continuous verification

Picture a device that authenticates at 9 am, passes a posture check, and establishes a session. At 9:05 am, your EDR detects a compromise. If the ZTNA deployment doesn’t receive that risk signal in time and fails to revoke the existing session, the compromised device can retain access until the session expires.

That is a failure of risk-responsive enforcement, even though the initial access decision was correct.

3.     ZTNA does not inherently provide east-west segmentation

Imagine a remote user connected to a ZTNA gateway and accessing a specific application server. What about the databases and/or other servers that are connected to that application? ZTNA might correctly authenticate an engineer connecting to application server A; but server A also allows unrestricted connections to dependent databases, domain controllers, or other internal systems.

In this case, the audit fails because controlling initial access isn’t the same as restricting lateral movement. Say one of network engineers actually wrote a policy for this scenario, but the added latency left users twiddling their thumbs. So another engineer switched off that policy to decrease latency. It’s still a failure that will generate an audit finding.

What closes these gaps?

Passing a Zero Trust access audit requires evidence that every control in your ZTNA implementation is enforced consistently for every user, device, and access path.

Extending ZTNA into a universal access model produces that evidence. A universal access model is designed for core Zero Trust principles: never trust, always verify, grant least-privilege access, and assume breach.

Universal ZTNA covers remote, on-premises, and hybrid users, managed and unmanaged devices including OT and IoT, and applications, all of which are governed by centralized policy and continuous contextual verification.

 

Expand Zero Trust with the Five Universals

The Five Universals maps to a control area auditors usually test. The Universals turn ZTNA into a Zero Trust operating model that can show an auditor how every identity is verified, every device is assessed, every centralized policy is set, every application is protected, and every activity is continuously interpreted.

Universal Identity Verification

Universal trust begins with establishing identity everywhere, not just when a remote user authenticates. To do this, you need to verify everything in the environment and confirm it is what it claims to be. Universal Identity Verification does this by applying identity verification universally, with defined acceptance criteria and requirements.

Universal Identity Verification can help close the identity verification audit finding. Auditors can confirm that identity-based policies and authentication apply to every human user, privileged admin, and service account, including on-premises and internal connections.

Universal Device Posture Assessment

Security posture reveals whether a device should be trusted right now. A Universal Device Posture Assessment determines whether a device can be trusted, what it is doing, where it belongs, and the context surrounding it. The universal model explicitly includes managed and unmanaged endpoints as well as IoT and OT, rather than restricting posture assessment to traditional, i.e. easy, managed endpoints.

Universal Device Posture Assessment helps close the device posture and continuous assessment audit findings. For example, when a device’s security posture changes, an integrated EDR flags the event and triggers an access change workflow. The system record provides the evidence for when and why.

Universal Policy Enforcement

Universal Policy Enforcement establishes a common decision framework across the enterprise, determining what access should be allowed, under what conditions, and when that access should change. That framework governs connections between users, applications, and workloads. Application servers, databases, domain controllers, and OT systems communicate only along the paths that policies explicitly permit, limiting how far a compromised system can reach. Such consistency lets Zero Trust principles protect distributed, heterogeneous environments while maintaining a unified security model.

Universal Policy Enforcement helps close segmentation and policy enforcement audit findings by letting auditors confirm that a centralized policy covers multiple access paths, including users, workloads, and legacy routes.

Universal Application Access

Universal Application Access evaluates every access request in the context of the user, device, resource, and current conditions, forming a consistent foundation for determining what’s appropriate. This allows Zero Trust principles to travel with the connection wherever applications and users operate.

Universal Application Access can help close the least-privilege audit finding. It limits access to the specific application and the conditions of each request for every user, everywhere, removing the broad subnet access auditors often flag.

Universal Continuous Monitoring

Organizations need to understand the complex context of environmental telemetry sources and determine whether the observed activity is normal. That means shifting from data collection and ingestion to understanding and using the information to produce actionable zero trust outcomes.

Universal Continuous Monitoring helps close the visibility and logging audit finding. Auditors get an evidentiary record of who accessed what, from which device, under which policy, and why the decision was made.

 

Start Building Your Zero Trust Security Model Now

Begin advancing your Zero Trust strategy now rather than waiting for a perfect technology stack or fully mature architecture. Define the end state, then move toward it incrementally, accounting for network segmentation, East-West traffic, legacy applications, IoT and OT environments, and vendor interoperability. This approach can reduce risk today while preserving the flexibility to adapt as technologies, threats, and business requirements evolve.

Interoperability should be a core architectural principle. Zero Trust cannot be delivered through a single product or a ‘Zero Trust in a box’ offering. Enterprise environments are inherently heterogeneous, spanning technologies, vendors, applications, devices, and infrastructure with different security requirements and operational constraints. Prioritize technologies that integrate with the environment you already have and exchange context, telemetry, and enforcement signals across the security ecosystem.

Brownfield and OT environments make this especially important. Many legacy and operational systems cannot support conventional security controls without affecting availability, performance, or operations. A practical Zero Trust architecture must account for these constraints, apply controls appropriate to each environment, and create a path toward stronger security without requiring wholesale infrastructure replacement or disrupting critical systems.

These realities require an access model that extends Zero Trust principles across users, devices, applications, networks, and operational environments. Universal Zero Trust Network Access (UZTNA) provides that bridge by bringing visibility, trust assessment, access control, segmentation, and policy enforcement together across heterogeneous environments. It allows organizations to strengthen Zero Trust incrementally while maintaining a consistent approach to trust and control across the enterprise.

That consistency is also critical to auditability. Security teams need to demonstrate not only that controls exist, but that they operate consistently, unauthorized access is prevented, and policy decisions and enforcement can be supported with evidence. Forescout Universal Zero Trust Network Access helps organizations address access-control gaps while building the visibility, enforcement, and evidence needed to demonstrate that Zero Trust controls are operating as intended.

Explore the Practitioner’s Guide to Universal Zero Trust Network Access for a practical implementation roadmap that security architects, network engineers, and CISOs can use to move from Zero Trust strategy to measurable, defensible control.