The traditional client-to-site VPN has one fatal property: it answers the question “who are you?” once, at connect time, and then hands out a network position. Everything after that is IP routing, and IP routing does not know or care that the credential was phished. Once inside, a compromised account sits on a flat subnet with reach the user never needed.

I deployed Cloudflare’s Zero Trust platform company-wide to replace that model. The client agent (WARP, now part of the Cloudflare One client) runs on every corporate device and sends traffic through Cloudflare’s network, where Gateway policies decide, per connection, what is allowed. The architectural inversion is the whole point: instead of access being a place you get into, access becomes a decision made continuously, per user, per device, per destination.

Identity as the policy foundation

The deployment integrates with the corporate identity provider, so every policy is written against users and groups rather than source IP ranges. From there we built differentiated access profiles based on role: engineering reaches its infrastructure segments and tooling, finance reaches its applications, support reaches the systems support needs. Each profile default-denies everything else.

This is where ZTNA quietly delivers the segmentation that legacy VPNs promise and never keep. The old model had “the VPN subnet” reaching essentially everything internal, because splitting it per team was too painful to maintain in firewall rules keyed on IP pools. When policy is keyed on identity, per-team access becomes a list you edit in minutes, and it survives reorgs, address changes, and home networks.

Device posture: the second signal

Identity alone is not enough, because a valid user on a compromised laptop is still a threat. The agent reports device posture, and our policies require it: disk encryption enabled, OS at or above minimum version, the endpoint protection agent present and healthy, and the device actually enrolled in our fleet. Fail posture, and it does not matter whose credentials you hold; sensitive access is refused. Posture is also evaluated on an ongoing basis rather than once at login, which shuts the classic window where a session outlives the conditions that justified it.

Rollout mechanics

A few choices made a company-wide rollout land smoothly:

  • Deployment through MDM. The agent shipped via the device-management stack with settings preconfigured. Users enrolled by signing in with their normal SSO, and there is no separate VPN password to forget or phish.
  • Split tunnels chosen deliberately. Traffic that belongs inside inspection goes through Cloudflare; explicitly excluded categories (like latency-sensitive conferencing media) bypass it. Every exclusion is a documented decision, not a support-ticket concession.
  • Coexistence, then cutover. ZTNA ran alongside the legacy VPN while we migrated access application by application and team by team, watching Gateway logs to confirm each profile matched reality before retiring the old path. Nobody experienced a forklift day.
  • Follow the vendor’s reference patterns. Cloudflare publishes solid design guidance for ZTNA access policies; we treated it as the baseline and deviated only with written reasons. Zero trust rollouts fail on invented complexity far more often than on missing features.

What changed in practice

Security-wise, lateral movement from a compromised endpoint stopped being free. Reach is now scoped to the victim’s role, gated by device health, and logged per connection, which also turned “who accessed what” from a forensic reconstruction into a query.

Just as important, the user experience got better rather than worse, which is what makes security stick. Always-on connectivity with no VPN client ritual, no full-tunnel backhaul dragging every video call through a distant concentrator, and the same experience in the office, at home, or on hotel wifi. When the secure path is also the fastest and least annoying path, adoption takes care of itself, and the exceptions list stays short.

The flat VPN subnet is gone. Nobody has asked for it back, and the incident tabletop exercises read very differently now: the first foothold no longer comes with a map of the whole interior.