Public sector Chief Information Security Officers (CISOs) and IT leaders are caught in a tug-of-war over where and how government employees work.

While return-to-office directives aim to bring federal employees back into physical offices, 2026 arbitration rulings across major civilian agencies — including the IRS, US Forest Service, Social Security Administration, and Department of Health and Human Services — have restored telework and remote work flexibilities for hundreds of thousands of personnel. Combined with ongoing state, local, and education (SLED) hybrid work policies, remote work remains a reality across the public sector.

Regardless of whether an employee is sitting at a desk in a federal facility or working from a home office, public sector agencies face a shared operational wall: the legacy VPN and its static encrypted tunnels.

Initially engineered for a network-centric world, traditional hardware VPNs have become a major security concern for agencies that are trying to protect distributed environments. With VPN architectures, gateway bandwidth can become constrained as remote user volume scales, slowing network performance and degrading user experience.

To protect both the mission and the workforce, public sector IT leaders need to move beyond legacy network tunnels and adopt a device-agnostic, cloud native approach to secure remote access through Zero Trust Network Access (ZTNA).

How can agencies reduce the hardware burden of hybrid work?

Federal, state, and local agencies rely heavily on a blended workforce made up of full-time civil servants, cross-departmental teams, and contractors. Supporting hybrid and remote work across this mixed environment has historically forced agencies into a heavy hardware footprint: provisioning, shipping, and tracking government-furnished equipment for every external contractor or partner requiring access to internal systems.

This hardware-first model creates severe financial and operational friction. Beyond the high upfront procurement costs of purchasing physical laptops, IT teams face ongoing administrative demands, including continuous OS updates, endpoint patching, device troubleshooting, and hardware lifecycle tracking across dispersed personnel.

By shifting to an application-centric Zero Trust architecture with Akamai Enterprise Application Access, agencies can modernize access for both employees and contractors through secure, identity-verified browser sessions.

Unlock key benefits

This transition unlocks three critical organizational benefits.

Reduce direct costs: Federal and SLED agencies can provision significantly fewer physical devices, allowing third-party contractors to securely access necessary applications without needing dedicated government laptops.

Reduce direct costs: Federal and SLED agencies can provision significantly fewer physical devices, allowing third-party contractors to securely access necessary applications without needing dedicated government laptops.

Minimize attack surfaces: Unmanaged or contractor endpoints never touch or route onto the internal agency corporate network. By isolating access strictly to the application layer via standard web browsers, agencies eliminate broad network visibility and remove lateral movement vectors.

Minimize attack surfaces: Unmanaged or contractor endpoints never touch or route onto the internal agency corporate network. By isolating access strictly to the application layer via standard web browsers, agencies eliminate broad network visibility and remove lateral movement vectors.

Provide operational relief for IT teams: Reducing the managed device footprint frees IT organizations from the labor-intensive cycle of remote endpoint management, OS patching, software distribution, and asset retrieval.

Provide operational relief for IT teams: Reducing the managed device footprint frees IT organizations from the labor-intensive cycle of remote endpoint management, OS patching, software distribution, and asset retrieval.

When security validation shifts from the physical endpoint to the application layer at the edge, agencies can achieve lower operational expenditure and a stronger Zero Trust security posture.

Why are legacy VPNs becoming a greater security risk?

While the performance limitations of legacy VPNs impede productivity, the security risks also create significant concerns. Cybersecurity and Infrastructure Security Agency (CISA) advisories have continually warned againstdozens of Known Exploited Vulnerabilities specifically targeting legacy VPN infrastructure.

This vulnerability landscape recently prompted government officials to formally petition CISA, Office of Management and Budget, and the National Institute of Standards and Technology to establish a mandatory two-year federal deadline to completely purge legacy, public-facing VPN servers across civilian and national security networks.

Hardware VPN gateways act as exposed digital front doors that cybercriminals and adversaries can easily exploit for devastating cyberattacks. Because traditional VPN architectures grant broad, network-wide access upon a single successful authentication, exploiting a perimeter vulnerability can give a threat actor opportunities to move laterally across the broader enterprise environment. Replacing legacy VPNs is no longer just a modernization goal; it is becoming an increasingly urgent cybersecurity priority (Figure).

How does application-centric access change the security model?

Agencies require an adaptive framework that supports remote work while reducing the enterprise attack surface. Shifting from network-centric VPN architecture to application-centric validation helps achieve this balance.

With Enterprise Application Access, which achieved FedRAMP Moderate authorization in 2026, endpoints no longer connect directly to an open agency network. Instead, the architecture establishes an isolated, identity-verified connection that authorizes traffic strictly to and from specific private resources.

The platform uses outbound application connectors to establish secure access to private applications, helping agencies avoid exposing those applications directly to the public internet or opening inbound firewall ports for remote users.

Together, these capabilities address three core access and security challenges:

Providing agnostic access

Providing agnostic access

Reducing public-facing exposure and lateral movement

Reducing public-facing exposure and lateral movement

Supporting progress toward CISA’s “optimal” tier

Supporting progress toward CISA’s “optimal” tier

Providing device-agnostic access

Enterprise Application Access delivers a completely device-agnostic user experience. Authorized contractors and employees can securely access the exact web applications, internal tools, and collaboration platforms they need directly via a standard web browser. This eliminates the need to toggle between multiple physical devices or struggle with bandwidth-throttling software clients.

Reducing public-facing exposure and lateral movement

By hiding internal application origin servers behind the Akamai edge and generating comprehensive audit logs, Enterprise Application Access closes the exposed digital front door. Security policies, multi-factor authentication, and identity assertions are continuously validated in transit.

Even if an individual credential or endpoint is compromised by malware, application-level access helps limit lateral movement across the broader enterprise network, protecting sensitive data with end-to-end encryption both in motion and at rest.

Supporting progress toward CISA's “optimal” tier

Federal directives require that modern remote access frameworks align with CISA’s Zero Trust Maturity Model. Under the Networks pillar of CISA's framework, replacing broad network connectivity with software-defined, application-specific validation is explicitly designated as the core capability required to reach the highest maturity tier.

Enterprise Application Access can help agencies advance toward this application-specific, least-privilege access model as part of a broader Zero Trust architecture.

How can agencies balance secure access with workforce productivity?

Securing a modern, distributed public sector hybrid workforce shouldn't come at the expense of user performance. By shifting network access validation to Enterprise Application Access, federal and SLED agencies can reduce exposure to critical vulnerabilities while helping their teams stay productive.

About the author

Kendrick Daniel

Kendrick Daniel is a Solutions Engineer at Akamai, specializing in the Public Sector. Over more than a decade, Kendrick has dedicated his career to supporting Federal Civilian Agencies and public sector technology initiatives. He holds a BBA in Management Information Systems from the Goizueta Business School at Emory University and currently resides in Seattle, Washington.

Today, a website must serve both humans and AI. Unfortunately, you can't effectively serve both audiences with the same response.

Trends

Your Website Now Has Two Audiences: Humans and AI

Optimize your site for both humans and AI crawlers using Akamai Functions and Akamai Bot Manager at the edge to boost performance and AI visibility.

If you can’t trust your agent to respect constraints and ignore malicious inputs, you can’t use it.

Trends

The Agentic Security Crisis: Why You Need to Act Now

Akamai and RAD Security have launched a new tool, running on Akamai Cloud, that helps you protect your OpenClaw deployment. Learn how to try it yourself.

The issue is not a lack of model intelligence, it’s architectural misalignment.

Trends