50% of the Fortune 500 Replaced Their VPN with Zscaler. What’s Holding Back the Rest?

50% of the Fortune 500 Replaced Their VPN with Zscaler. What’s Holding Back the Rest?

Every internet exposed IP address and open port on your network is an invitation to attackers, and Frontier AI is empowering the attackers to move faster than the enterprises can respond.  Traditional VPN architectures, burdened with discoverable IP addresses and open inbound entry points, are rapidly turning into security liabilities in today's sophisticated threat ecosystem.

Frontier AI has accelerated the speed and scale of attacks, giving threat actors the ability to scan vulnerabilities, identify exploit paths, and move laterally faster than a security team can patch systems. According to Zscaler ThreatLabz 2026 VPN Risk Report, 79% of organizations say the greatest AI-driven risk is attackers weaponizing vulnerabilities faster, while 70% report limited or no visibility into AI-enabled threats traversing their VPN connections. 

Inside the Castle-and-Moat: Let’s Examine VPN's Gateway Model

Traditional VPN architecture relies on a gateway model characterized by the following:

• DMZ placement: VPN gateways are positioned in the DMZ with public, DNS-published IP addresses that must be discoverable to enable connection.
• Inbound connections: Remote users initiate inbound connections to the gateway, requiring perimeter firewalls to keep inbound ports open to these public IP addresses.
• Network placement after authentication: Upon successful authentication, the VPN gateway assigns a virtual IP address and provisions network routes, placing the user directly onto the internal network/subnet.

This architecture inherently expands the attack surface because the gateway must accept unsolicited inbound traffic from the public internet, making it easily discoverable to attackers. Consequently, a single unpatched gateway can expose the largely flat internal network, providing a primary entry path exploited in major VPN-gateway CVEs and enterprise breaches.

Image 1: VPN architecture with gateways in the DMZ

The rules of the game have changed, and legacy solutions were never built to play it. 

That's why 50% of the Fortune 500 didn't wait to adopt Zscaler. They eliminated exposed networks entirely by moving to Zscaler Private Access, and closed the front door that attackers had been targeting for years. 

Hiding applications to eliminate internet exposure is one of four powerful Zero Trust capabilities that Zscaler Private Access customers use to stop AI-powered attacks: Hide, Segment, Shield, and Deceive.

Image 2: ZPA hides, segments, shields, and deceives threats in the AI Era 

So What’s Holding Back Other Enterprises Globally from Adopting Zscaler Zero Trust?

What holds organizations back isn't technical limitations, but inertia—specifically, the fear of the unknown. Enterprise teams often worry about complex network re-architecting, whether legacy applications will work seamlessly in a Zero Trust model, and the operational risks if critical workflows break during the transition.

50% of the Fortune 500 have already done it, so other enterprises can too. Zscaler recently added several capabilities in the Zero Trust Exchange platform to make this transformation as simple and painless as possible.

Zscaler simplifies your Zero Trust transformation: Lift and shift effortlessly and adopt Zero Trust at your own pace

Just like half of the Fortune 500, organizations can immediately transition to Zscaler Zero Trust for rapid risk reduction. For teams preferring a flexible pace, Zscaler ZPA offers enhanced features that guarantee 100% application compatibility throughout your gradual rollout.

By executing a true lift-and-shift migration, you can onboard ZPA with near-zero operational disruption while maintaining full routing control and continuous application access.

Phase 1 - Replace the VPN Gateway with "VPN for Legacy Apps"

Enterprises can fully retire their VPN gateway and replace it with Zscaler's VPN for Legacy Apps, without rewriting access policies. Most importantly, the routing policies remain CIDR-based and security policy carries over unchanged. This is unique to ZPA for the following reasons. 

• Specialized Network Connector: A virtual instance deployed in the data center replaces the VPN gateway, establishing an outbound-only tunnel to the Zero Trust Exchange so no inbound ports are ever opened and the internal network stays hidden from the internet. 
• Bi-directional Support: For server-initiated traffic and real (non-NATed) IP binding, VPN for legacy apps keeps legacy protocols like VoIP, SCCM, and active FTP working seamlessly. These are precisely the traffic patterns that often force enterprises to maintain a full-tunnel VPN.

The result is a like-for-like operational swap with a zero-trust architecture underneath, setting up the enterprise to selectively migrate crown-jewel apps onto full ZPA when they’re ready.

Image 3: VPN for legacy apps replaces VPN gateways

To deliver a lift-and-shift migration, Zscaler recently introduced key innovations, including user group-based access controls, wildcard FQDN support, static user IP assignments, micro-tenancy, and BGP route summarization.

Phase 2 - Selectively Onboard Applications onto ZPA

Migration isn't like a light switch. The Network Connector and App Connector work concurrently, allowing applications to be migrated incrementally:

• Move your crown-jewels to ZPA: Apps first move to standard ZPA App Connectors, where each application is defined as a discrete ZPA Application Segment with its own “per-app” policy. This enables true least-privilege and user-to-app access instead of network-level reachability.
• Server-initiated / server-to-client traffic stays on VPN for Legacy Apps: Standard ZPA App Connectors only support inside-out, user-initiated connections (user → app). Protocols requiring the server to initiate contact back to the client like VoIP signaling (SIP/H.323), SCCM pushes, and Active FTP's server-initiated data channels need the Network Connector's bi-directional tunneling and real IP binding. These stay on "VPN for Legacy Apps" by design, not as a temporary workaround.

Both connector types can coexist on the same network segment, pointing at the same Zero Trust Exchange, so enterprises can migrate application-by-application instead of a single high stakes swap. Migration becomes incremental work instead of an obstacle blocking organizations from retiring legacy VPN gateways.

Image 4: Transformation to ZPA to protect all applications

Phase 3 - ZPA Takes Over and Automates Policy Creation Including App Segmentation Policies

The final phase eliminates manual overhead entirely by automating the process with Autonomous User-to-App Segmentation. Application discovery, segmentation, and policy creation operate seamlessly in the background without requiring human intervention.

ZPA stands apart from other Zero Trust solutions because it automatically breaks down broad wildcard segments (such as *.company.com) into granular, least-privilege policies for individual applications (e.g., crm.company.com and confluence.company.com). 

Eliminating the need for tedious manual application mapping, ZPA delivers the following key capabilities:

• Discovery: Passively analyzing wildcard segment traffic (FQDNs, ports, and protocols), the AI engine identifies unmanaged applications. It can also integrate data from ServiceNow CMDB, Qualys, or Tenable to enhance initial discovery.
• Clustering: Using co-occurrence modeling, the system aggregates frequently co-accessed applications into unified logical segments. Meanwhile, domain-similarity heuristics isolate dev, staging, and production environments.
• Prioritization: Adaptive App Ranking evaluates clusters using domain structures, IP dependencies, and traffic volume, highlighting policies with the biggest blast radius.
• Policy generation: By mapping discovered application traffic to identity groups and real user access paths, the engine formulates targeted least-privilege policies (e.g., granting the Finance team access to only 5 designated apps) instead of broad subnet permissions. Each policy comes with a calculated attack-surface reduction metric and can be deployed with a single click.
• Continuous refinement: After deployment, the App Segmentation Insights dashboard proactively highlights new, idle, or overly broad segments.

Image 5: Autonomous User-to-App segmentation eliminates lateral threat movement

With Hide and Segment already in place, ZPA gives customers two additional defenses purpose-built for today's frontier AI-driven threats:

• Shield - Protect apps that must stay reachable. Autonomous Application Shield, built into the App Connector, scans which apps are actually running vulnerable software, blocks access and applies virtual patches inline.
• Deceive - Place realistic, high-fidelity Deception decoys and planted lure credentials directly along the paths an attacker would explore.

A Simplified Path to Zero Trust

Together, this phased approach transforms your security landscape smoothly, turning your VPN to Zero Trust transition into a low-friction, continuous journey with zero workflow disruption.

To help your IT team achieve a seamless migration and maintain a strong security posture, we strongly emphasize these three strategic phases as recommended best practices.

1. Swap your VPN gateway with Zscaler’s "VPN for Legacy Apps" with no re-architecture while instantly eliminating the internet-facing attack surface
2. Move your crown-jewel applications to ZPA at your own pace, coexisting with legacy VPN, so server-initiated applications (VoIP, SCCM) operate with zero downtime. 
3. Enable Autonomous User-to-App Segmentation to continuously discover, classify, and generate application policies on its own, turning coarse wildcard access into least-privilege, per-app zero trust without weeks of manual policy configuration. 

The result is a seamless transformation that happens entirely at your preferred pace without operational disruption - users remain fully productive, applications remain operational, and your attack surface continually shrinks.

To start your transformation, refer to the Zscaler best practices for migrating from VPN to ZPA and take advantage of our latest innovations listed in What’s new in Zscaler SSE.