All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
In a letter sent Monday to leaders at the Office of Management and Budget (OMB), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Institute of Standards and Technology (NIST), Wyden called for a government-wide transition away from "legacy, insecure, internet-facing" VPNs in favor of newer "zero trust" remote access technologies.[1]
"For too long, federal agencies and government contractors have suffered devastating cyberattacks due to their reliance on legacy, insecure, internet-facing VPN servers to grant employees remote access," Wyden wrote.
The Oregon Democrat cited a string of high-profile attacks targeting enterprise networking products, including Cisco, Fortinet, Ivanti, and Check Point devices, and argued that continually patching vulnerable systems is no longer enough.
"The federal government has become trapped in an endless game of 'whack-a-mole' in responding to widespread compromises of legacy remote access technologies," Wyden wrote.
Wyden is asking federal cybersecurity agencies to require departments to phase out legacy remote-access infrastructure over the next two years and replace it with zero trust architecture, a security model that continuously verifies users and devices rather than assuming anyone inside a network can be trusted.
He argues that traditional enterprise VPNs create a visible entry point for attackers because they're designed to accept connections from the public internet.
"Legacy remote-access technologies operate a digital 'front door' that is accessible to the public internet so that mobile devices and remote employees can log in," Wyden wrote. "Because these entry points are exposed, hackers can easily scan, target, and break into them."
By contrast, Wyden says modern remote-access systems don't advertise their presence online.
"Instead of leaving an open door accessible from the public internet, modern solutions provide remote access without broadcasting their presence," he wrote. "This effectively makes these servers invisible, ensuring that hackers cannot attack an entry point they cannot see."
Not necessarily.
The VPNs discussed in Wyden's letter are the enterprise systems organizations use to let employees remotely access internal company networks. These typically rely on dedicated VPN appliances positioned at the edge of an organization's network that accept inbound internet connections.
That's different from the consumer VPN services many people use to encrypt internet traffic on public Wi-Fi, reduce tracking, or help protect their privacy online.
The Congressional Research Service memo attached to Wyden's letter specifically defines enterprise VPNs as systems that place a publicly accessible VPN gateway between an organization's private network and the internet, allowing authenticated users broad access once they're connected.
On the other hand, zero trust systems are designed to grant access only to specific applications and continuously verify users throughout a session. They also avoid exposing publicly accessible login gateways whenever possible.
While Wyden argues zero trust architecture addresses many of the weaknesses of older VPN infrastructure, the attached Congressional Research Service analysis notes that zero trust systems have security considerations of their own.
For example, compromising the centralized policy engine that makes access decisions could allow attackers to grant unauthorized access or block legitimate users, particularly if organizations rely heavily on cloud-based providers.
Still, Wyden says it's time for the federal government to move beyond decades-old remote-access technology.
"It is no longer acceptable for agencies to use insecure, decades-old technology," he wrote.
No. Wyden’s proposal targets enterprise VPN systems that businesses and governments use for remote access, not the apps most consumers are using daily.
That said, there are a few steps worth taking to improve your own security:
As organizations continue shifting toward zero-trust security models, consumers can expect businesses to increasingly rely on identity verification, device checks, and continuous authentication behind the scenes.
Our #1 rated VPN, which has increased download speeds by up to 36% across all regions in our testing
Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
Bundles with ad blocker, data removal, and encrypted storage for a more complete privacy setup
/images/2024/01/12/best_vpns_for_fanduel.jpg)
/images/2023/08/17/vpn-disadvantages.jpeg)
/images/2026/07/28/sen-wyden-older-vpns.jpg)
/images/2026/07/23/virtual_networking_chalk_white_icons_set_on_black_background._user_aut_kcRz3fT.jpg){kind=icon}
/images/2026/07/08/how-to-bypass-reddit-age-verification_1.png)
/images/2026/06/27/closeup_of_free_vpn_apps_on_smartphone.jpg)
/images/2026/06/18/nordvpn_app_on_smartphone_screen.jpg)
/images/2026/06/06/closeup_of_firefox_download_screen_on_smartphone.jpg)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2022/05/26/logo-nordvpn.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)