The State
of Zero Trust
07.2025
//zero trust is dead. long live zero trust.
Introduction
Welcome to the State of Zero Trust 2025 survey results.
We surveyed 1,000 IT, security, and engineering professionals to create a clear baseline of where the industry really stands on secure access and Zero Trust adoption today. Instead of buzzwords, this report focuses on objectivity and clarity through verified survey data and rigorous analysis. We hope it helps surface the biggest gaps, highlight emerging practices that are working, and offer practical direction for where secure access goes next.
But despite every effort to approach the data impartially and transparently, Tailscale is not a neutral observer. We see these challenges every day, and we've built our secure network connectivity platform to address many of them. If you're interested in learning how Tailscale can help solve the secure access issues outlined in this report, visit us at tailscale.com or reach out to our sales team for a demo.
This year's survey showcases the frustrations of teams across the industry, the often half-deployed state of Zero Trust, and the emerging trends like identity-based networking.
Want to read more? Download the full report.
Reality vs aspiration
Reality: “Is it as dire as it seems?”
Mesh gains ground on legacy VPNs
A growing 27% of companies are using peer-to-peer mesh VPNs, and 34% use cloud-delivered ZTNA platforms. Legacy VPNs still own a hearty share of company usage at 41%.
Current secure access and network connectivity tools
Identity-based access is low
Fewer than a third (29%) of organizations currently use identity-based access as their primary model. Many still operate in a hybrid mode of adding an identity layer on top.
Company policy for system access
Features that help Zero Trust aren't ubiquitous
Only 56% of companies granted access based on role or need, and 46% via groups or teams. For more granular controls that support Zero Trust, an even lower 33% had just-in-time access (JIT) and 26% followed least privilege (with manual approvals).
Employee access control
Aspiration: “We would, if we could”
Low overall satisfaction
Only 1% report being satisfied with their organization's current access and connectivity setup, with the majority citing security (49%) and performance (45%) as the main priorities they want to redesign around, and a notable portion (26%) wanting more automation.
Access and connectivity priorities
New solutions are needed soon
Many IT professionals (42%) believe their current access setups will no longer meet their needs within two years. Companies are moving towards identity-centric solutions with robust security, streamlined operations, and better user experiences.
How long your current setup will meet your organization's needs
Companies would change for productivity
At 38% of companies surveyed, a major security incident is cited as what would force companies to upgrade. Simultaneously, 30% say that employee complaints about slow or frustrating access would also trigger the same type of change, indicating that better productivity is a strong underlying rationale in any scenario.
What would prompt decision-makers to consider a new approach
Frustrations
Connectivity: “Is it just our VPN that sucks?”
Legacy VPNs are slow and frustrating
Of respondents, 90% have one or more issues with their current VPN. Latency issues are a key frustration for 35%, and throughput limitations for 24%. Frustrations are mounting as legacy VPNs struggle to transition to cloud services and remote work.
Current VPN limitations
Workers are vocal about their frustrations
Employee complaints are a frequent occurrence, with 37% of respondents reporting daily or weekly complaints related to remote access or network security.
Complaint frequency
Legacy VPN frustrations are on the rise
These frustrations will only grow. 84% of companies report increased throughput needs over the past couple of years. 1-in-10 say their throughput needs have doubled in the past 2 years alone.
Throughput needs increase over time
Tooling: “Wait, how many tools does your team use?”
Everyone is juggling multiple tools and services
A large majority of organizations (92%) juggle multiple solutions for network security. Only 8% rely on a single, unified platform, contributing to fragmentation and inefficiency.
The number of tools or services that companies rely on to manage network security
Tool consolidation is a dream
The ballooning number of tools is a known issue, with 48% of companies actively trying to consolidate tools. However, this comes with issues like resourcing, integration, and lock-in.
Tool consolidation consideration
Management: “How much effort are we wasting?”
Balancing security and productivity is hard
The two biggest challenges IT and security professionals cite are balancing security with speed and productivity (32%) and enforcing IT rules, such as dealing with unauthorized tools (31%). Users are often just trying to do their jobs, sometimes by working around security measures.
Current challenges for IT and Security teams
Manual processes are more common than automation
A majority of organizations (68%) still rely on manual processes to manage network access. This creates complexity, friction, and security gaps.
Manual vs automatic access controls
Ramifications
Security: “At least we're secure, right?”
Security incidents are common
A large majority (88%) report at least one security incident over the past two years. This includes misuse of privilege (24%) and bypassing security protocols (22%). 1-in-3 companies report security incidents from employee error, which is even more common than system or network failure.
Causes of security incidents
Remote network security concerns
Organizations worry about VPN connections being “always on”, with 38% concerned about VPNs being left open. Another 38% of respondents worry about unmanaged personal devices connecting.
Causes of concern for remote network security
Infrastructure access is shaky
A majority of respondents (76%) report gaps in their infrastructure access.
Concern for infrastructure access
Former employees aren't getting their access revoked
After leaving their companies, 68% of respondents report retaining access to their former employers' systems. Many companies don't have automation or centralized visibility into who has access.
Retaining access that should have been revoked
Productivity: “At least we're productive, right?”
Developers don't feel understood
More than 2-in-3 developers and engineers say IT/security teams don't understand how they work and what they need to build fast and effectively. Nearly 1-in-4 say IT/security outright block productive workflows.
Perception of IT and security
Network security feels disconnected from development
Furthermore, half of the respondents say their company's security rules feel disconnected from supporting modern development practices.
Perception of security policies
Onboarding takes longer for IT
It takes a lot of time for IT teams to onboard a new user onto networking systems, with 35% saying it takes more than a day.
Onboarding speed
Going to market is slower
Twice as many employees at companies using a legacy VPN say they are slower than average to bring new products to market.
Comparative speed in developing and launching
Hurdles to improvement
Team: “What can our leadership do to help?”
Perception of preparedness is a sliding scale
63% of non-management employees think they are fairly or very well-equipped to detect unauthorized tools and workarounds, while the number is higher for executives at 80%. This indicates a misalignment in perception and an opportunity for leadership communication to bridge that gap.
Perceived preparedness
Improvement delays are common, and leadership can address them
When it came to the cause for delays in security improvements, 35% of respondents pointed to the cost of resources, 39% to leadership priorities, and 42% to the risk of workflow disruption. Once again, many causes identified by employees can be opportunities for better alignment and signaling from management.
Causes of delays to security or networking upgrades
What's next
Tailscale’s predictions
IP design will be supplanted with access and identity-first networking. The old perimeter-based model will be replaced, and every instance of access will be authenticated as a baseline of “Never trust, always verify”.
Legacy VPNs are demonstrably issue-prone as seen in the data, and while they won't disappear, there are better options. Peer-to-peer mesh architectures that are identity-aware will be the new default.
AI in particular will play a role, given its ubiquity. This will be true for both defenders of security who use AI for anomaly detection and risk scoring, and attackers generating phishing attempts and scanning for poor security configurations. Companies themselves will bet big on AI, investing in GPU clusters and shared model training infrastructure that will require modern networking tools for performance and security.
And this is just the tip of the iceberg. For even more insights, including the evolution of security and engineering culture, the extension into edge and IoT environments, and the move towards modularity, we recommend checking out our full report. You can download the report below.
Want to read more? Download the full report.
Recommendations
Tailscale's recommendations for leaders
Access and identity-first networking needs to be the core of your access control model. It's no longer enough to have old perimeter-based models that rely on broad access. Start by auditing your current critical infrastructure. As a baseline, gauge your level of integration with identity providers, and determine if access is granted based on roles and attributes.
If you rely on legacy VPNs for remote access, it's time to upgrade to a more modern solution. Aim to pilot a new solution, starting by identifying the pain points of your current setup. Find a solution that offers easy deployments (like Tailscale). Start building the case for upgrading by gathering data.
Then dig even deeper. Look into onboarding and offboarding processes, take stock of your stack of internal network security tools, and ultimately gauge how your technical teams feel about your current solution. Modern security should be invisible and effortless, and understanding how your colleagues are engaging with networking security can yield benefits beyond building an immediate case for structural improvement. Gain a more nuanced understanding of what is frustrating people, and they'll join your cause as champions.
All of this is just the start towards a bigger, company-wide win from spearheading an upgrade in networking security. For these types of insights and more, including recommendations on implementing just-in-time and least privilege access, download our full report below.
Want to read more? Download the full report.
Methodology
Survey respondents by seniority
If you'd like to review the full methodology or explore the raw survey data, please reach out to our communications team at press@tailscale.com. To learn more about Tailscale and our approach to Zero Trust, visit us at tailscale.com or reach out to our sales team for a demo.
Social: “Is this a user issue?”
Circumventing security measures
Just to stay productive, a large majority of respondents (83% overall and 87% of developers) are willing to resort to circumventing security measures.
83%
of respondents have bypassed security processes
Methods of security circumvention
Third-party SaaS isn't safe either
Specifically, when looking at access to third-party SaaS tools, 24% said SaaS controls are easy to bypass.
Restrictions on third-party SaaS tools
It happens more often with legacy VPNs
28% of employees at legacy VPN-using companies report higher instances of colleagues bypassing the infrastructure. Non-legacy-VPN companies report only 20%. Broken access or inconsistent access is reported in 25% respondents for legacy VPN users, and 15% for non-legacy-VPN users. Across the board, 30% report frustration in managing access methods across legacy and modern systems.
Systems and tools frustrations