Securing the Perimeterless Enterprise: Moving Beyond the VPN in South Africa

The Death of the Corporate Perimeter

For decades, enterprise security relied on a simple analogy: the castle and the moat. The corporate headquarters was the castle, and the network firewall acted as the moat. Anything inside the network perimeter was deemed safe and trusted; anything outside was hostile. Remote workers crossed the moat using a Virtual Private Network (VPN).

That model no longer fits today’s reality. South African enterprises have moved aggressively toward permanent hybrid work. Employees connect from home fibre lines, coffee-shop Wi-Fi, and cellular hotspots across the country rather than from behind enterprise-grade office switches. At the same time, core applications have migrated to the cloud—SaaS platforms, public hyperscalers, and remaining on-premise systems. The traditional network boundary has largely disappeared. Relying solely on legacy VPNs in this perimeterless environment creates both security and operational exposure. Identity, device health, and context have become the primary security boundary.

The Architectural Limitations of Legacy VPNs

The core weakness of a traditional VPN is its philosophy of implicit trust. Once a user authenticates and enters the tunnel, the VPN typically grants broad, network-level access to the internal environment. If an attacker compromises those credentials, they gain extensive reach and can move laterally, scan systems, locate data, and deploy ransomware with relatively little friction.

VPNs also introduce operational friction for hybrid workforces. Routing all traffic from a remote user’s home ISP back through a central corporate data centre—only to send it out again to Microsoft 365, Salesforce, or other cloud services—adds latency. In South Africa this is often worsened by variable local connectivity. Slow performance and frequent disconnections reduce productivity and encourage workarounds, including Shadow IT, where sensitive files move through unmonitored personal applications.

While VPNs remain useful in certain legacy or transitional scenarios, they are no longer the optimal default for most modern remote and hybrid access needs.

Zero Trust and Identity-Centric Access

To secure the perimeterless enterprise, organisations are increasingly adopting Zero Trust Network Access (ZTNA) principles. The core idea is straightforward: never trust, always verify.

Network location becomes largely irrelevant. Whether an employee is in a boardroom in Sandton or working remotely from Gqeberha, every request to access a corporate asset should be authenticated, authorised, and encrypted before access is granted. Robust Identity and Access Management (IAM) acts as the primary control plane. Instead of broad network access, policies enforce least privilege: users receive micro-segmented, context-aware access only to the specific applications and data they need for their current task.

A simplified flow looks like this:

[ Remote User / Endpoint ]
↓
[ Contextual Access Evaluation ] — verifies device health, location, behaviour, and risk signals
↓
[ Identity Management Engine ] — enforces least-privilege, application-level access
↓
[ Specific Cloud / Core Application ] — user reaches only the authorised resource, not the broader network

An administrative assistant needing to view an invoice is connected directly to the finance application, not to the underlying server network or wider database environment.

True Zero Trust extends beyond ZTNA and IAM to include continuous monitoring, deeper micro-segmentation, endpoint protection, and strong logging and response capabilities. Many organisations adopt these controls progressively rather than in a single switchover.

Addressing Multi-Factor Authentication Fatigue

Strict identity verification is essential, but poorly designed policies can create friction that drives user resistance. One common issue is Multi-Factor Authentication (MFA) fatigue.

Rigid policies that force push-notification approvals dozens of times a day lead to frustration. Attackers exploit this through MFA bombing (or prompt spam): they use stolen credentials and flood a user’s phone with repeated authentication requests until the tired user eventually approves one.

Modern IAM platforms counter this with risk-based, conditional access. The system continuously evaluates contextual signals in the background:

• Device health — updated endpoint protection and approved operating system

• Geographical integrity — known locations versus impossible-travel scenarios (e.g., Durban and London within the same hour)

• User behaviour — unusual hours or anomalous data volumes

When signals match the user’s normal profile, access remains seamless. When risk rises—for example, a login from an unencrypted public hotspot—the system escalates the challenge or blocks the attempt.

The Path Forward

Securing the modern hybrid workforce requires a deliberate move away from outdated assumptions about the network perimeter. Legacy VPNs solved an earlier problem when most data and users lived inside a central office.

By adopting a decentralised, identity-centric architecture grounded in Zero Trust principles, South African enterprises can better protect remote endpoints over unpredictable local networks. The transition reduces exposure to identity-based attacks while delivering the lower-latency experience hybrid workers need. Most organisations benefit from a phased approach that retains VPN capabilities for specific legacy use cases during migration.

Key Takeaways

• Identity is the new perimeter: Network-centric defences alone are insufficient; security must centre on user identity, device health, and context.

• Context over friction: Adaptive, risk-based conditional access reduces MFA fatigue by challenging users only when risk signals change.

• Micro-segmented control: Zero Trust limits lateral movement by granting access to authorised applications rather than the broad network.

• Progressive adoption works: Full Zero Trust is a journey that combines ZTNA, strong IAM, continuous verification, and supporting controls.