Managing that at scale is so unbelievably hard. Network layer stuff like VPN tends to be really isolated from application access restrictions both in terms of d

Managing that at scale is so unbelievably hard. Network layer stuff like VPN tends to be really isolated from application access restrictions both in terms of data and operational processes, so you end up having to duplicate the access controls and it's never in sync. Ask me how I know; I've been trying for years. Something like Google's BeyondCorp where the access restrictions are done in a proxy or other application layer is much more likely to be tied to the same access controls used within applications. That way ZTA acts as an additional security boundary but not an entirely separate authentication and authorization system that VPNs tend to be.