Telework moves the security perimeter to the endpoint because remote employees reach cloud applications from home networks rather than from inside the office. Routing all of that traffic back through a corporate VPN adds latency and strains capacity, so organizations increasingly secure each user and device directly, using zero trust access and cloud-delivered models such as SASE and SSE.
Key Takeaways
- The traditional perimeter model assumes trusted users and systems sit inside the corporate network; remote work and cloud applications break that assumption.
- Full-tunnel VPNs send cloud-bound traffic through the corporate network and back out again, which adds latency and load.
- Split tunneling relieves the VPN but lets some traffic bypass corporate security inspection, so it needs other controls on the device and in the service.
- NIST Special Publication 800-207 (August 2020) defines zero trust as moving defenses from network perimeters to users, assets and resources.
- SASE, a term coined by Gartner in 2019, combines SD-WAN networking with cloud-delivered security; SSE, defined by Gartner in 2021, is its security-only subset.
After the COVID-19 pandemic began in 2020, many organizations adopted extended or permanent support for telework. The security challenges associated with the recent surge in support for telework have highlighted the fact that traditional approaches to network security no longer meet the needs of the modern enterprise.
As telework grew, many organizations found that traditional virtual private networks (VPNs) struggled to scale as their main way of providing secure network connectivity.
As organizations evolve and support increasingly remote workforces, transitioning from legacy VPN infrastructure to modern solutions, such as secure access service edge (SASE) is necessary to ensure both worker productivity and security.
Telework Dissolves the Network Perimeter
In the past, many organizations’ security relied on a perimeter-based security model. At the time, an organization’s employees primarily used devices connected directly to the enterprise network.
The main advantage of the perimeter-based security model is that it is simple to understand and implement security under this model. Most organizations have a single point of connection between their internal network and the public Internet through which all traffic entering and leaving the network flows.
By deploying a security stack at this location, an organization maintains visibility into this traffic and is able to identify and respond to a high percentage of malware and other threats attempting to gain access to the enterprise network.
The perimeter-based security model has several issues. A major issue is the fact that a perimeter-based security model assumes that all of an organization’s “trusted” infrastructure lies within the network perimeter.
With the rise of cloud computing and remote work, the traditional network perimeter is dissolving. A growing percentage of an organization’s business traffic originates and terminates outside of the network perimeter.
As a result, forcing all of that traffic through traditional, perimeter-based security solutions can significantly slow network performance.
VPNs Degrade Network Performance
Most organizations, in an attempt to secure remote workers’ network connections, require remote workers to connect to the enterprise network via a VPN, which encrypts the traffic between the VPN client and a VPN endpoint on the enterprise network.
This approach to teleworker security has a number of negative impacts on network performance. In general, a full-tunnel VPN adds latency to cloud-bound traffic because the traffic is routed through the enterprise network before continuing on to its destination.
However, as organizations’ remote workforces grow, VPN infrastructure also experiences scalability issues. Many organizations’ VPN infrastructure is designed to support a fraction of the workforce and is incapable of scaling far beyond the intended maximum capacity.
When enterprise VPN use exceeds its design parameters, remote workers experience degraded productivity and network performance.
The number of inbound connections can exceed the capacity of existing VPN infrastructure, and the computationally expensive decryption and encryption of all inbound and outbound traffic consumes processing resources and slows network throughput.
Scalability Solutions Compromise Security
Organizations are increasingly reliant upon cloud-based infrastructure for core business functionality. Flexera’s 2020 State of the Cloud Report, published in April 2020, found that 93% of enterprises had a multi-cloud strategy; Flexera’s 2026 report, published in March 2026, found that 73% of organizations operate hybrid cloud environments and that multi-cloud adoption is still rising.
This includes everything from cloud-based data storage to web applications hosted on cloud infrastructure to use of Software-as-a-Service (SaaS) applications such as Microsoft 365 or Salesforce.
As a result of increased cloud adoption, a high percentage of teleworkers’ network traffic – the same traffic placing strain on enterprise VPN infrastructure – is intended for cloud-based infrastructure outside the organization’s network perimeter.
This traffic intended for external destinations places an especially high load on an organization’s network and security infrastructure. Unlike network traffic bound for servers within the network perimeter, remote workers’ cloud-bound traffic passes through the perimeter twice (inbound and outbound).
As a result, a large contingent of remote workers accessing cloud-based resources has a significant impact on network throughput and performance.
To improve the scalability of network and security infrastructure, split-tunnel VPNs have been recommended by Microsoft and other organizations.
Unlike a full-tunnel VPN, which sends all traffic over the encrypted VPN connection, split-tunnel VPNs enable traffic intended for the public Internet (or certain trusted sites on it) to go directly to its destination. This greatly decreases the load on the organization’s perimeter-based security solutions.
However, this increased scalability can come at the cost of security. With direct access to the public Internet, a teleworker’s computer does not benefit from the enterprise’s security scanning for this traffic.
This enables malware to infect the teleworker’s computer and then use it as a stepping stone to infect the enterprise network via its VPN connection.
Cloud-Based Security Meets the Needs of Telework
VPNs worked well when most applications lived in the corporate data center, but on their own they no longer meet the needs of many modern enterprises. With growing numbers of teleworkers and reliance upon cloud-based infrastructure, the network perimeter has moved to these endpoints. Attempting to keep security at the former network perimeter is inefficient and unscalable.
SASE (secure access service edge) is a cloud-delivered architecture, named by Gartner in 2019, that combines networking and security for distributed organizations. Cloud-based points of presence (PoPs) integrate security functionality, such as a next-generation firewall (NGFW) and secure web gateway (SWG), and the optimized network routing offered by a software-defined wide area network (SD-WAN).
This enables an organization to deploy security at the network edge close to cloud-based resources and teleworkers, which minimizes the latency impacts of routing traffic over the corporate WAN.
SASE enables an organization to maintain network visibility and security scanning while minimizing the associated impacts on network performance and latency for remote workers.
Pulling it together matters — why unified endpoint security and management is important makes that case.
What Does Moving the Perimeter to the Endpoint Mean?
Moving the perimeter to the endpoint means security decisions are made around each user, device and application session instead of around the office network. A laptop on a home Wi-Fi connection is treated the same way whether it is inside or outside the building: it must prove who the user is and that the device is healthy before it reaches a resource.
The National Institute of Standards and Technology (NIST) describes this shift in Special Publication 800-207, Zero Trust Architecture, published in August 2020. According to NIST, zero trust is a set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets and resources. Zero trust does not grant automatic trust based on network location or device ownership.
VPN vs. Split Tunnel vs. Zero Trust vs. SASE
The table below compares the main ways organizations connect and protect remote workers.
| Approach | How traffic flows | Main strength | Main weakness |
|---|---|---|---|
| Full-tunnel VPN | All traffic goes through the corporate network, then out to the internet or cloud | Central inspection of every connection | Added latency for cloud apps; VPN capacity limits |
| Split-tunnel VPN | Corporate traffic uses the VPN; selected internet or SaaS traffic goes direct | Lower VPN load and faster access to trusted cloud services | Direct traffic can bypass gateway-level security |
| Zero trust network access (ZTNA) | Each user and device is verified for each application, not given broad network access | Limits what an attacker can reach from one compromised device | Requires identity, device and application inventory work |
| SASE / SSE | Traffic is inspected at cloud points of presence close to users and cloud resources | Security follows the user without hairpinning through a data center | Depends on the provider’s coverage and on careful policy migration |
What Is SASE and How Is It Different From SSE?
Secure access service edge (SASE) is a model that delivers networking and security together from the cloud. Gartner analysts Neil MacDonald and Joe Skorupa introduced the term in 2019, in a July 29, 2019 networking hype cycle report and an August 30, 2019 report.
SASE combines SD-WAN with network security functions such as cloud access security brokers (CASB), secure web gateways (SWG), malware inspection, VPN, firewall as a service (FWaaS) and data loss prevention (DLP). A software-defined wide area network (SD-WAN) uses software-defined networking to manage a wide area network, typically over encrypted overlay tunnels across internet links.
Security service edge (SSE) is the security-only part of SASE. In 2021, Gartner defined SSE as a collection of SASE security services that can be deployed together with separate network services such as SD-WAN. Organizations that already have a networking provider they want to keep often start with SSE. Justwebworld covers practical examples in real-world applications of security service edge.
Why Are VPN Appliances a Security Concern?
Internet-facing VPN gateways are attractive targets because they sit at the edge of the network and accept connections from anywhere. On January 19, 2024, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 24-01 for Ivanti Connect Secure and Ivanti Policy Secure, covering vulnerabilities CVE-2023-46805 and CVE-2024-21887.
Under supplemental direction, CISA required federal agencies to disconnect all affected instances by February 2, 2024, then rebuild and upgrade the devices and reset credentials before returning them to service. The case shows why many security teams no longer want a single remote-access appliance to act as the front door to the whole network.
How Does Split Tunneling Work Safely?
Split tunneling is safest when only well-defined, trusted traffic leaves the VPN. Microsoft’s guidance, Implementing VPN split tunneling for Microsoft 365 (updated in 2026), recommends moving from a forced tunnel to a forced tunnel with a small number of trusted exceptions.
Microsoft identifies a group of Microsoft 365 endpoints in its Optimize category that accounts for around 70% to 80% of the volume of traffic to the service, including latency-sensitive Teams media. These endpoints are Microsoft-owned, have dedicated published IP addresses and change rarely, which is why Microsoft treats them as suitable for direct routing. All other traffic stays in the tunnel.
How to Move Security to the Endpoint: Practical Steps
- Inventory users, devices and applications. Zero trust policies need to know which identities and devices may reach which application.
- Enforce strong authentication. Require multi-factor authentication for every remote-access and cloud application login.
- Protect and manage every endpoint. Use endpoint protection, disk encryption and patch management on company laptops; see why unified endpoint security and management matters.
- Grant per-application access. Replace broad network access with access to specific applications (ZTNA) wherever possible.
- Route trusted SaaS traffic directly and inspect the rest. Use a narrow split-tunnel list or a cloud-delivered secure web gateway rather than hairpinning everything through the data center.
- Patch or retire edge appliances. Track vendor and CISA advisories for VPN gateways and firewalls, and remove remote-access devices that are no longer needed.
- Train staff. Remote employees need to recognize phishing and report lost devices quickly; Justwebworld’s cybersecurity guide for remote employers covers the basics.
Who Should Consider SASE or Zero Trust?
Organizations with a large remote or hybrid workforce, many SaaS applications, or several branch offices gain the most from moving security to the edge. A small office with few cloud applications may still be well served by a properly patched VPN plus strong authentication. For a wider view of options, see this guide to choosing cloud security solutions and the pros and cons of using a VPN.
Zero trust is also an official policy direction in the United States. Executive Order 14028 (May 2021) directed federal agencies to adopt zero trust architectures, and the Office of Management and Budget memorandum M-22-09 (January 2022) required agencies to meet specific zero trust goals by the end of fiscal year 2024.
Frequently Asked Questions
Is a VPN still needed for remote work?
A VPN is still used by many organizations for access to internal systems, but it is no longer the only option. Zero trust network access and SSE services can provide per-application access without placing the remote device on the corporate network.
What is the difference between SASE and zero trust?
Zero trust is a security principle: never grant access based on network location alone, and verify every user and device. SASE is an architecture that delivers networking and security services from the cloud, and it commonly includes zero trust access as one of its components.
Is split tunneling a security risk?
Split tunneling can be a risk because traffic that leaves the VPN directly may bypass gateway-level security inspection. The risk is reduced by limiting direct routing to trusted, well-defined services, as Microsoft recommends for its Optimize endpoints, and by protecting the device itself.
What does SD-WAN stand for?
SD-WAN stands for software-defined wide area network. It uses software-defined networking to manage connections between sites, typically over encrypted tunnels across internet links, and it is the networking half of SASE.
Who created the SASE concept?
The SASE concept was introduced by Gartner analysts Neil MacDonald and Joe Skorupa in 2019. Gartner later defined security service edge (SSE) in 2021 as the security-only subset of SASE.
Justwebworld has published guides since 2012. How we write and update articles Report an error
