Public sector Chief Information Security Officers (CISOs) and IT leaders are caught in a tug-of-war over where and how government employees work.
While return-to-office directives aim to bring federal employees back into physical offices, 2026 arbitration rulings across major civilian agencies — including the IRS, US Forest Service, Social Security Administration, and Department of Health and Human Services — have restored telework and remote work flexibilities for hundreds of thousands of personnel. Combined with ongoing state, local, and education (SLED) hybrid work policies, remote work remains a reality across the public sector.
Regardless of whether an employee is sitting at a desk in a federal facility or working from a home office, public sector agencies face a shared operational wall: the legacy VPN and its static encrypted tunnels.
Initially engineered for a network-centric world, traditional hardware VPNs have become a major security concern for agencies that are trying to protect distributed environments. With VPN architectures, gateway bandwidth can become constrained as remote user volume scales, slowing network performance and degrading user experience.
To protect both the mission and the workforce, public sector IT leaders need to move beyond legacy network tunnels and adopt a device-agnostic, cloud native approach to secure remote access through Zero Trust Network Access (ZTNA).
Federal, state, and local agencies rely heavily on a blended workforce made up of full-time civil servants, cross-departmental teams, and contractors. Supporting hybrid and remote work across this mixed environment has historically forced agencies into a heavy hardware footprint: provisioning, shipping, and tracking government-furnished equipment for every external contractor or partner requiring access to internal systems.
This hardware-first model creates severe financial and operational friction. Beyond the high upfront procurement costs of purchasing physical laptops, IT teams face ongoing administrative demands, including continuous OS updates, endpoint patching, device troubleshooting, and hardware lifecycle tracking across dispersed personnel.
By shifting to an application-centric Zero Trust architecture with Akamai Enterprise Application Access, agencies can modernize access for both employees and contractors through secure, identity-verified browser sessions.
This transition unlocks three critical organizational benefits.
Reduce direct costs: Federal and SLED agencies can provision significantly fewer physical devices, allowing third-party contractors to securely access necessary applications without needing dedicated government laptops.
Minimize attack surfaces: Unmanaged or contractor endpoints never touch or route onto the internal agency corporate network. By isolating access strictly to the application layer via standard web browsers, agencies eliminate broad network visibility and remove lateral movement vectors.
Provide operational relief for IT teams: Reducing the managed device footprint frees IT organizations from the labor-intensive cycle of remote endpoint management, OS patching, software distribution, and asset retrieval.
When security validation shifts from the physical endpoint to the application layer at the edge, agencies can achieve lower operational expenditure and a stronger Zero Trust security posture.
While the performance limitations of legacy VPNs impede productivity, the security risks also create significant concerns. Cybersecurity and Infrastructure Security Agency (CISA) advisories have continually warned against dozens of Known Exploited Vulnerabilities specifically targeting legacy VPN infrastructure.
This vulnerability landscape recently prompted government officials to formally petition CISA, Office of Management and Budget, and the National Institute of Standards and Technology to establish a mandatory two-year federal deadline to completely purge legacy, public-facing VPN servers across civilian and national security networks.
Hardware VPN gateways act as exposed digital front doors that cybercriminals and adversaries can easily exploit for devastating cyberattacks. Because traditional VPN architectures grant broad, network-wide access upon a single successful authentication, exploiting a perimeter vulnerability can give a threat actor opportunities to move laterally across the broader enterprise environment. Replacing legacy VPNs is no longer just a modernization goal; it is becoming an increasingly urgent cybersecurity priority (Figure).
Agencies require an adaptive framework that supports remote work while reducing the enterprise attack surface. Shifting from network-centric VPN architecture to application-centric validation helps achieve this balance.
With Enterprise Application Access, which achieved FedRAMP Moderate authorization in 2026, endpoints no longer connect directly to an open agency network. Instead, the architecture establishes an isolated, identity-verified connection that authorizes traffic strictly to and from specific private resources.
The platform uses outbound application connectors to establish secure access to private applications, helping agencies avoid exposing those applications directly to the public internet or opening inbound firewall ports for remote users.
Together, these capabilities address three core access and security challenges:
Providing agnostic access
Reducing public-facing exposure and lateral movement
Supporting progress toward CISA’s “optimal” tier
Enterprise Application Access delivers a completely device-agnostic user experience. Authorized contractors and employees can securely access the exact web applications, internal tools, and collaboration platforms they need directly via a standard web browser. This eliminates the need to toggle between multiple physical devices or struggle with bandwidth-throttling software clients.
By hiding internal application origin servers behind the Akamai edge and generating comprehensive audit logs, Enterprise Application Access closes the exposed digital front door. Security policies, multi-factor authentication, and identity assertions are continuously validated in transit.
Even if an individual credential or endpoint is compromised by malware, application-level access helps limit lateral movement across the broader enterprise network, protecting sensitive data with end-to-end encryption both in motion and at rest.
Federal directives require that modern remote access frameworks align with CISA’s Zero Trust Maturity Model. Under the Networks pillar of CISA's framework, replacing broad network connectivity with software-defined, application-specific validation is explicitly designated as the core capability required to reach the highest maturity tier.
Enterprise Application Access can help agencies advance toward this application-specific, least-privilege access model as part of a broader Zero Trust architecture.
Securing a modern, distributed public sector hybrid workforce shouldn't come at the expense of user performance. By shifting network access validation to Enterprise Application Access, federal and SLED agencies can reduce exposure to critical vulnerabilities while helping their teams stay productive.
Ready to eliminate your agency's VPN bottlenecks and align with modern CISA network access standards? Learn more about Enterprise Application Access or contact the Akamai Federal Public Sector team for an architectural consultation.
© 2026 Akamai Technologies
