{"id":126601,"date":"2026-09-16T15:56:35","date_gmt":"2026-09-16T14:56:35","guid":{"rendered":"https:\/\/www.realvnc.com\/?post_type=blog&p=126601"},"modified":"2026-09-16T15:56:38","modified_gmt":"2026-09-16T14:56:38","slug":"zero-trust-cannot-stop-point-access","status":"publish","type":"blog","link":"https:\/\/www.realvnc.com\/en\/blog\/zero-trust-cannot-stop-point-access\/","title":{"rendered":"Zero Trust Cannot Stop at the Point of Access"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Emerging\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Why privileged remote access needs protection from the first access decision to the final endpoint<\/em><\/p>

Security teams do not need another reminder that the threat landscape is changing.<\/p>

What they may need is a better way to judge whether their current controls are actually working.<\/p>

The 2026 RealVNC<\/strong>\u00ae<\/sup> Emerging Threats in Remote Access Security report<\/strong><\/a> surveyed 323 IT professionals across seven industries. Nearly half, 47%, said their organisation had experienced a remote access security incident in the past 24 months.<\/strong><\/p>

More concerning is what happened when confidence was compared with outcomes.<\/p>

Among respondents who described themselves as very or extremely confident in their current remote access security, 55% had still experienced an incident.<\/strong><\/p>

That disconnect matters because remote access is becoming more important at exactly the same time the environments surrounding it are becoming more distributed, interconnected, and difficult to govern.<\/p>

Third-party vendors need access. Administrators need access. Engineers need access to plant systems and operational technology. Hybrid work has expanded where connections originate. Legacy devices remain in production long after the architectures around them have changed.<\/p>

The security question is no longer simply: Can this person connect?<\/em><\/strong><\/p>

It is: Should this person connect, to this specific resource, from this device, under these circumstances, with these permissions, for this amount of time?<\/em><\/strong><\/p>

And once that decision has been made: How is the connection to the endpoint itself controlled and secured?<\/em><\/strong><\/p>

That is where Zero Trust and secure remote access meet.<\/p>

Organizations understand Zero Trust. Implementing it is another matter.<\/strong><\/h2>

Zscaler defines Zero Trust<\/a> around a simple principle: no user, device, workload, or system should be inherently trusted simply because it sits inside a network. Every request should be verified, and access should be limited to only what is necessary. Its model emphasises identity and context, adaptive controls, segmentation, direct resource access, and continuous verification.<\/p>

RealVNC’s research found that 58% of respondents consider implementing Zero Trust architecture a top priority.<\/strong><\/p>

Yet only 28% have actually implemented it.<\/strong><\/p>

That gap between intention and execution is one of the defining findings of the research.<\/p>

The issue is not a lack of awareness. It is the complexity of turning that intent into consistent controls.<\/p>

The same study found that 85% of organisations use two or more remote access tools. Among organisations using just one remote access tool, 28% reported an incident. Among those operating four to five tools, that figure rose to 67%.<\/strong><\/p>

More tools do not automatically produce more security.<\/p>

In some environments, tool proliferation creates more credentials to manage, more policies to reconcile, more configuration points to maintain, and more opportunities for gaps to emerge.<\/p>

That is why Zero Trust needs to be understood as an architecture rather than another security product added to the stack.<\/p>

Zero Trust changes what access means<\/strong><\/h2>

Traditional remote connectivity has largely been built around network access.<\/p>

A VPN establishes a path into an environment, after which security controls attempt to determine what the user can do from there.<\/p>

ZTNA changes that model.<\/a><\/p>

Instead of granting broad network access, Zero Trust Network Access evaluates identity, device context, policy, and the resource being requested. Access can then be granted specifically to that application or service while preventing unnecessary lateral movement. RealVNC’s own explanation of ZTNA<\/a> notes that this differs substantially from traditional remote access, which is focused on allowing someone to interact directly with a workstation or endpoint desktop.<\/p>

That distinction is important.<\/p>

A privileged user may successfully pass every identity and policy check required to reach an application or remote resource.<\/p>

But eventually, somebody may still need to interact with an actual machine.<\/p>