According to the Zscaler ThreatLabz 2026 VPN Risk Report, the answer is yes. The report argues that AI-assisted attacks are compressing compromise timelines from days to hours, and in some cases just minutes, making traditional perimeter-based VPN security far less effective than it once was.
The report’s findings also align with a broader shift highlighted across recent threat intelligence reports from Google Mandiant and IBM X-Force. Together, the reports suggest attackers are moving faster, increasingly targeting identities, credentials and trusted relationships alongside software vulnerabilities.
Why VPNs became the backbone of remote work
Traditional enterprise networks were designed around a simple assumption: employees worked inside office buildings connected to trusted corporate networks. Security was built like a castle, with firewalls protecting everything inside. When remote work became widespread, especially post the Covid-19 pandemic, that model no longer worked. Employees needed secure access from anywhere.
VPNs solved that problem by creating encrypted tunnels between a user’s device and the corporate network. Instead of exposing company systems directly to the internet, organisations could authenticate users and extend internal network access securely over public connections.
For years, that approach worked well because the primary challenge was protecting data while it travelled across the internet. Today’s threat landscape is very different.
AI is changing the speed of cyberattacks
The Zscaler report argues that AI-enabled phishing campaigns, automated credential theft and AI-assisted reconnaissance are significantly reducing the time between an initial compromise and an active intrusion. Traditional VPN security assumes defenders have enough time to detect suspicious behaviour after an attacker gains access.
Multiple industry reports suggest that the assumption is becoming increasingly difficult to rely on.
Perhaps the clearest evidence comes from Google Cloud’s M-Trends 2026 report. Based on more than 500,000 hours of incident response investigations, Google found that the median time between an initial access broker compromising a victim and handing that access to another threat group collapsed from more than eight hours in 2022 to just 22 seconds in 2025.
That does not mean every organisation is compromised within 22 seconds. Rather, it shows how specialised cybercriminal operations are becoming. Google says initial access brokers are increasingly pre-staging malware or tunnels preferred by secondary threat groups before handing over access.
At the same time, Google’s report notes that interactive voice phishing accounted for 11 per cent of observed intrusions in 2025, making it the second most common initial infection vector after software exploits. Meanwhile, traditional email phishing fell to just 6 per cent, reflecting how attackers are adapting as email security improves.
IBM’s X-Force Threat Intelligence Index 2026 points in a similar direction. It warns that AI-assisted phishing and infostealer malware are increasing the scale and sophistication of credential theft, while researchers found more than 300,000 ChatGPT credentials advertised for sale on underground forums during 2025.
Taken together, the reports suggest attackers are relying on both credential theft and software exploitation, rather than any single technique. This is where VPN architecture begins to face challenges.
The real weakness is not VPN encryption
Modern VPNs generally use strong encryption. The encryption itself is not the primary problem. Instead, the issue is what happens after someone successfully authenticates.
A VPN is designed to verify identity at the point of entry. Users often receive broad access to internal networks once authenticated. If attackers steal legitimate credentials—or successfully trick an employee into approving access—they can inherit that same level of trust.
According to Zscaler, this expands an organisation’s attack surface and creates opportunities for lateral movement—the process through which attackers move from one compromised system to others inside the same network while searching for valuable data, privileged accounts or critical infrastructure.
Because VPNs extend internal network access, a compromised account may provide attackers with pathways that would otherwise remain inaccessible from the public internet. That architectural challenge becomes more significant as AI reduces the time available to detect suspicious activity.
Why Zero Trust is replacing the security perimeter
These findings help explain why Zero Trust has become a growing focus across enterprise cybersecurity. Unlike VPNs, which generally authenticate users once before granting network access, Zero Trust assumes that no user, device or application should be trusted automatically, even after successful login.
Instead, access decisions are continuously verified based on identity, device health, location, application sensitivity and behavioural signals. The principle is commonly interpreted as never trust, always verify.
Google’s recommendations in M-Trends 2026 closely reflect this philosophy. The company advises organisations to move towards continuous identity verification, stricter least-privilege access, behaviour-based anomaly detection and longer-term visibility across networks.
IBM similarly argues that organisations should treat vulnerability management and identity security as parallel priorities while strengthening least-privilege access controls and continuously monitoring authentication behaviour.
Although neither report suggests Zero Trust eliminates cyber risk, both indicate that continuous verification better reflects how modern attacks operate than perimeter-based trust models alone.
Future of VPNs
The reports do not argue VPNs should disappear entirely. VPNs still provide encrypted remote connectivity and remain useful in many enterprise environments, particularly for legacy systems, administrative access, and organisations that cannot immediately redesign their security architecture.
Instead, the shift appears to be about changing their role. Rather than serving as the primary security boundary, VPNs might become one component within broader Zero Trust architectures where identity verification, device posture, segmentation and continuous monitoring provide additional layers of protection.
Future cybersecurity spending is likely to focus less on securing network perimeters and more on continuously verifying identities, limiting access, and detecting abnormal behaviour as quickly as possible.
Remote work helped turn VPNs into one of enterprise cybersecurity’s most essential technologies. AI may now be forcing organisations to rethink whether that model is enough for the next decade.
