HPE VPN Exposure Report 2025

Keypoints

• This annual cybersecurity report is typically structured with an introduction, an explanation of the research methodology, and several themed sections covering attack exposure, operational complexity, user experience, security confidence, and adoption of alternatives. It generally closes with best practices, strategic recommendations, and a conclusion that frames the report’s main takeaway for security leaders.
• The survey is based on 648 IT, network, and cybersecurity professionals, with a 95% confidence level and a margin of error of ±3.85%, giving the findings statistical weight.
• Nearly half of organizations, 48%, reported a VPN-related cyberattack, and 47% experienced at least one attack in the last 24 months, showing that VPN exploitation remains a persistent threat.
• Attackers commonly exploit stolen credentials, zero-day flaws, and misconfigurations to gain unauthorized access and maintain persistence inside enterprise networks.
• A notable example cited in the report is the February 2025 exploitation of CVE-2025-0282 in Ivanti Connect Secure, which allowed attackers to bypass authentication and access enterprise environments.
• The report highlights that 72% of organizations use between two and five VPN services, and 67% operate three or more inbound VPN gateways globally, creating fragmentation, higher overhead, and a larger attack surface.
• VPN reliance is still widespread, with 91% of users connecting at least weekly and 55% using VPNs daily or almost daily, underscoring how embedded legacy remote access remains.
• User dissatisfaction is high, with 83% reporting frustration due to slow connections, cumbersome authentication, and frequent disconnections, which can drive insecure workarounds.
• IT leaders rate their confidence in detecting and mitigating VPN vulnerabilities at only 6.1 out of 10, while confidence in VPN segmentation as a containment control is even lower at 4.1 out of 10.
• Sixty-eight percent of respondents worry that VPNs could jeopardize their security posture, reflecting broad concern that VPNs are becoming liabilities rather than protections.
• Security and compliance are the top concern for 25% of respondents, ahead of poor user experience at 23% and management complexity at 20%, showing that risk is no longer only an operational issue.
• Third-party access is a major concern, with 69% fearing that external VPN access could create exploitable backdoor pathways into the network.
• Among the most feared threats are ransomware at 52%, phishing at 49%, and credential theft at 43%, indicating that identity-based attacks are tightly linked to VPN exposure.
• The report shows the modern enterprise attack surface is expanding geographically and technologically, with remote users active across North America, Asia, Europe, South America, Australia, the Middle East, and Africa.
• Cloud adoption is also broadening exposure, as private applications still run in data centers at 69%, but many also run in private cloud at 52% and public cloud environments such as Azure at 48%, AWS at 40%, and GCP at 16%.
• Sixty-one percent of organizations are actively exploring remote access alternatives to traditional VPNs, and 79% plan to adopt ZTNA within the next two years.
• ZTNA adoption is being driven primarily by improved security posture at 73%, better user experience at 68%, simplified infrastructure management at 57%, and stronger cloud integration at 53%.
• Zero Trust maturity is already underway for most organizations, with 82% reporting that they have started a Zero Trust strategy and 30% currently in implementation.
• There is strong demand for full VPN replacement, with 83% saying a ZTNA solution should fully replace VPN, and 87% saying it should be part of a broader SSE platform.
• The report also notes a budget shift toward modernization, with 54% of organizations increasing remote access budgets, suggesting greater willingness to invest in Zero Trust and SSE rather than expand legacy VPN infrastructure.
• The recurring themes across the report are that VPNs create excessive access, complicate security operations, frustrate users, and no longer match the needs of distributed, cloud-heavy enterprises.
• The main takeaway is that organizations are moving away from perimeter-based remote access and toward least-privilege, identity-driven models such as ZTNA and SSE to reduce breach risk and operational complexity.