The Legacy VPN Is Dying at Small Firms — and Your Next Peer Review Might Notice

Here's an uncomfortable question the managing partner should ask before the next engagement season: if a client's data leaked tomorrow, could you show an examiner exactly which credentials accessed which files, from where, and when? At most small accounting firms running a legacy VPN, the honest answer is no. That gap is no longer a technical footnote. It's becoming an audit liability.

Why the Office VPN Model Is Breaking Down

The traditional setup — a firewall appliance with a VPN endpoint granting full network access once you authenticate — was designed for a world where everyone worked in one office. It grants what security professionals call implicit trust: log in once, and you can reach the tax software, the document management system, the QuickBooks server, everything.

That model has two fatal flaws. First, it's a single point of failure. Compromise one set of VPN credentials — through phishing, credential stuffing, or a reused password from a breached service — and an attacker rides straight into the crown jewels. Second, it produces almost no useful audit trail. Most small-firm VPN logs show a connection was made, not what happened afterward.

Auditors have noticed. We've spoken with IT consultants serving CPA firms who report that cybersecurity questionnaires from banks, private equity clients, and even peer reviewers now ask specifically about remote-access architecture. "We use a VPN" is starting to invite follow-up questions rather than close them.

What Zero-Trust Actually Means for a Ten-Person Firm

Zero-trust network access (ZTNA) flips the assumption. Instead of granting network-wide entry, ZTNA brokers a connection to one specific application, verifies the user and device each time, and logs everything. An intern with access to the client portal sees the client portal — not the payroll folder.

For a firm, this translates into three concrete benefits: blast-radius containment (a stolen credential unlocks one app, not the whole network), granular audit logs that map directly onto FTC Safeguards Rule and IRS Publication 4557 expectations, and the ability to onboard a seasonal hire in minutes without touching the firewall.

The Cost Math Most Partners Get Wrong

The sticker shock of zero trust is real but overstated. A legacy firewall with VPN licensing runs roughly $1,500–$4,000 upfront plus annual support contracts. ZTNA platforms priced per user — Cloudflare Access, Tailscale, Permify-class tools, or offerings from Zscaler and Netskope — typically run $3–$8 per user per month. For a ten-person firm, that's $360–$960 a year, often less than the firewall's maintenance renewals.

The hidden costs run the other direction, too. A single breach notification, forensic engagement, and client-retention hit routinely exceeds six figures. Cyber insurers, who now scrutinize remote-access controls during underwriting, increasingly offer better premiums to firms with MFA-gated, least-privilege access. Zero trust isn't just risk reduction; it's a pricing lever.

How to Pitch It to Clients and Partners

For partners, frame it as engagement-readiness: "Our remote-access controls now produce logs we can hand to any auditor or insurer without redaction." For clients — particularly those in regulated industries — it becomes a differentiator. A due-diligence questionnaire answered with specifics (per-application access, device verification, full session logging) stands out against firms that check a generic box.

A Practical Migration Checklist

1. Inventory. List every system remote workers touch and who genuinely needs it.
2. Start small. Route one low-risk application — usually the document portal — through a ZTNA tool while keeping the legacy VPN as backup.
3. Enforce MFA and device health checks on the new path before expanding.
4. Turn on logging from day one and decide where those logs live and who reviews them.
5. Migrate applications in waves, retiring legacy VPN access as each system moves.
6. Document the architecture in your written information security plan so peer review, insurers, and clients see the same story.

The legacy VPN served small firms well for two decades. But the profession's threat landscape, regulatory expectations, and clients' own diligence standards have all moved. Firms that modernize access controls now won't just pass the next questionnaire — they'll have something to say when it arrives.