VPN vs Zero Trust Network Access: Zero Trust Let Me In—The Smaller VPN Got the Contract Out

The company portal opened.

The partner upload page did not.

I was in an airport lounge in Frankfurt with twenty-three minutes before a procurement deadline. Our legal team had approved a revised contract while I was travelling, and I needed to retrieve the signed pricing schedule from an internal application, upload the complete package to the partner’s portal and join a final video call.

My employer had recently replaced its traditional remote-access VPN with Zero Trust Network Access.

The new system worked exactly as IT had described.

It checked the managed laptop.

It asked for multifactor authentication.

It opened only the internal contract application I was authorised to use.

I downloaded the signed schedule.

Then I opened the partner portal in another tab.

The page stalled.

The video-call application showed:

Trying to reconnect.

I blamed the lounge Wi-Fi.

Normal news sites loaded instantly. The internal company application remained available through the zero-trust agent. The external services required to finish the contract did not.

I refreshed the partner portal.

It returned another network error.

The corporate access system had let me into the company.

It had not carried the rest of the job.

Zero trust had replaced one kind of VPN

My mistake began with the phrase VPN replacement.

I had heard it during the company rollout and interpreted it too broadly.

Zero trust changes how an organisation grants access to its own resources. Instead of treating a user as trusted because they entered a private network, it checks the user, device and requested application before allowing access. (Nist)

That was exactly what happened on my laptop.

The corporate agent did not place me inside a large company network.

It opened one approved application because my identity and managed device met company policy.

That was a more precise way to protect internal systems. It also meant the agent’s responsibility ended at the edge of the approved application.

The partner portal was external.

The video-call service was external.

My travel accounts, personal email and ordinary browsing were external.

The company’s zero-trust system had no reason to carry all of that traffic.

It had replaced the old tunnel into corporate resources.

It had not become a personal VPN for every connection leaving my laptop.

Once I understood that boundary, the rest of the problem became easier to define.

I needed two things in sequence:

Authorised access to retrieve the internal file.

A stable private route to deliver it across airport Wi-Fi.

Zero trust had completed the first task.

The second was still waiting.

The boundary was deliberate

My employer’s setup reflected the basic zero-trust model: protect individual resources rather than trusting everything behind one network perimeter. NIST’s published implementations show the same approach across remote users, cloud applications and public networks. (Nist)

So the partner portal had not been accidentally forgotten.

It sat outside the company’s access policy.

That made sense from the employer’s perspective. It was less helpful with twenty minutes left and a contract package still sitting on my laptop.

The distinction also changed the comparison.

I was no longer asking whether ZTNA or a VPN was more modern.

I was asking which tool belonged to each half of the workflow.

Zero trust decided whether I could retrieve the approved file.

A personal VPN still needed to protect the public handoff.

The established VPN made the two systems compete

I opened the commercial VPN I had used for years.

It had a long public history, mature applications and servers throughout Europe. Before my employer adopted zero trust, it had been my normal protection on airport and hotel Wi-Fi.

I selected the automatic route.

The partner portal loaded.

The video-call preview appeared.

Then the internal contract application vanished.

The corporate agent changed from Connected to Checking device.

A few seconds later, it displayed:

Private application unavailable.

I disconnected the commercial VPN.

The internal application returned.

I connected through another VPN server.

The partner portal opened, but the corporate session disappeared again.

The lounge bandwidth was not the problem. Two network tools were trying to control overlapping routes on the same managed laptop.

Corporate access clients and third-party VPNs can coexist, but that usually depends on routing and DNS rules set by administrators. (Cloudflare) I did not control those policies, and the managed laptop would not let me rewrite them at an airport table.

In front of me, the result was simple:

With the commercial VPN off, I could reach the company file.

With it on, I could reach the partner portal.

I needed both parts of the workflow, but I no longer needed them open at the same time.

That suggested a better order.

Finishing the internal task simplified everything

I disconnected the commercial VPN and reopened the corporate application.

The signed pricing schedule was already on the laptop.

I checked the version number.

I downloaded the approval record and saved both files inside the final contract folder.

Then I signed out of the internal application.

The zero-trust system had completed its job. It had verified me and released exactly the files I was permitted to access.

I did not need to keep that private session open while sending the package to the partner.

The workflow could now cross from the company-controlled side to the public internet.

I reopened the established VPN and selected a nearby German server.

The partner portal loaded.

The upload reached 17 percent and stopped.

A Dutch route reached 29 percent before the portal returned me to the login page.

The automatic server opened the video call but produced another network error when I selected the contract folder.

The established service was now handling the correct half of the job.

It still could not complete it on the lounge network.

Mobile data removed the conflict and the deadline

I closed the VPN and switched the laptop to my phone hotspot.

The partner portal opened.

The upload began.

For a moment, mobile data seemed to solve everything. The zero-trust session was finished, and the laptop no longer depended on airport Wi-Fi.

Then the phone dropped from 5G to a weak indoor signal.

The upload estimate changed from nine minutes to thirty-eight.

The video-call application warned that the connection might not support screen sharing.

I moved closer to the lounge windows.

The signal improved briefly, then weakened again as passengers gathered near the gate.

The contract package was too large for the connection I had.

The lounge Wi-Fi had the bandwidth.

I needed a private route that could use it without turning the upload into another round of server testing.

The smaller app carried the contract out

I returned the laptop to the lounge Wi-Fi and opened OnlydogVPN.

The smaller app did not begin with a country map. I selected the situation for sending work files over a restrictive public network and connected.

Then I closed the partner portal and began a fresh session.

The login page appeared.

The authentication request reached my phone.

The contract workspace opened.

I selected the final folder.

The upload began.

Ten percent.

Twenty-six.

The progress bar continued moving.

At 44 percent, the partner’s lawyer joined the video-call lobby. I opened the meeting in another window.

The camera preview appeared.

The microphone check passed.

The upload remained active behind it.

Sixty-eight percent.

Eighty-five.

The portal processed the files and displayed the signed pricing schedule, approval record and revised agreement.

I pressed Submit package.

The status changed to:

Documents received for review.

I joined the call with four minutes remaining.

The partner opened the package while we spoke.

They found the pricing schedule.

They confirmed the signature.

The procurement lead changed the project status from Awaiting documents to Ready for execution.

The contract had crossed the boundary that the corporate access system was never meant to cross for me.

Only after the partner confirmed receipt did the connection design matter. The smaller service uses an HTTP/3-based transport with added traffic obfuscation, giving the portal, upload and call one stable route through the lounge network.

I could not inspect the airport’s internal filtering rules or the risk systems behind the partner portal. The observable result was decisive: zero trust released the authorised company file, the established VPN repeatedly lost the public upload, and the smaller app completed the handoff.

The connection stayed useful after the deadline

The call ended just as boarding began.

The partner sent one final message asking me to confirm the planned signing date.

I closed the laptop, joined the boarding line and opened the conversation on my phone.

The phone was still using lounge Wi-Fi.

As the line moved down the jet bridge, the Wi-Fi weakened.

Mobile data took over.

The messenger paused briefly, then refreshed.

The VPN remained connected.

I confirmed the date.

The message delivered before I reached the aircraft door.

The service’s HTTP/3-based route recovered as the phone changed networks. (IETF)

The practical result was simpler:

Airport Wi-Fi disappeared.

Mobile data appeared.

The partner conversation continued.

That was a smaller success than submitting the contract, but it solved the problem that follows travellers everywhere: the connection changed before the work was quite finished.

The smaller app had already completed the public handoff.

Now it remained useful after I left the lounge.

ZTNA remained the right key to the company

Nothing about the experience made zero trust the wrong choice.

It had given me narrow, policy-based access to the internal application.

It had checked the managed device before releasing sensitive files.

It had prevented my remote session from becoming broad access to the company network.

A personal VPN could not replace those decisions.

It could protect an internet route.

It could not decide whether I was authorised to open the pricing application or whether the laptop met company policy.

Those decisions belonged to the employer.

The personal VPN became useful after the approved files left the private application and the task returned to the public internet.

That separation was not a compromise.

It was the reason the workflow finally made sense.

Public work remained after the private application closed

The confusion between the two tools is common in cloud-first workplaces.

Once an organisation protects its internal applications with identity checks, device policy and ZTNA, it is tempting to assume that every connection on the laptop has also been handled.

Administrators still run into the same practical question: what protects the traffic that does not belong to a corporate application? (Reddit)

My contract workflow answered it directly.

The zero-trust agent handled the resource my employer controlled.

It did not carry the partner portal, external call, travel services or personal communications surrounding that resource.

A company could deploy a broader platform that covers both private applications and public internet traffic. Mine had not done so on this device.

The name of the security model did not determine where every connection went.

The actual route did.

One tool did not need to replace the other

The smaller service has fewer locations and a shorter public history than the largest VPN providers.

Neither limitation affected the contract handoff.

ZTNA was the right tool for deciding whether I could enter the internal application.

The established VPN offered more locations and a familiar interface, but it competed with the managed access agent and later failed to complete the external upload.

The smaller app did not try to become the company’s identity system. It took over when the approved files reached the public side of the workflow, carried them to the partner and kept the conversation open when the airport connection changed.

I had started the afternoon asking whether a VPN or Zero Trust Network Access should replace the other.

The contract moved forward when I gave them separate jobs: zero trust decided whether I could take the file out, and the smaller VPN made sure it reached the people waiting for it.