Why not a VPN
A VPN's job is to put you inside. Our job is to make sure there is no inside.
The perimeter is the problem, not the implementation
A VPN is a perimeter, and its function is to get an endpoint in. Once in, the network is flat: the compromised machine can reach its neighbours directly, and lateral movement is trivial. SSL-VPN is worse on both counts — it is a large, permanently internet-facing attack surface, and one of the most heavily targeted classes of appliance there is.
The two failures compound. The thing most likely to be breached is also the thing that grants the flat interior.
What replaces it
An endpoint with the agent installed always traverses the Edge. Every flow is decided against policy, audited, and — where the policy says so — authenticated again at the point of use.
Including on the same LAN. Traffic from one managed endpoint to a machine sitting next to it on the same local segment also goes through the Edge. Most zero-trust products mediate remote access to applications and leave device-to-device traffic on the local network untouched — which is exactly the path lateral movement uses.
| VPN / SSL-VPN | Lantern DSSE | |
|---|---|---|
| Attack surface | a permanently public appliance | the Connector dials outbound only; nothing to attack inbound |
| After a compromise | flat interior, neighbours directly reachable | every hop decided, audited, re-authenticated if required |
| Same-LAN traffic | unmediated | mediated through the Edge |
| Evidence afterwards | connection logs | every decision recorded |
What this does not claim
Ransomware moves in stages — intrusion, dwell, lateral movement, privilege escalation, destruction. This acts on one of them. It does not stop intrusion, it does not detect malware on the endpoint, and it does not replace EDR. Default-deny reachability is the first layer; detection and isolation are subsequent ones.
Naming the stage is what makes the claim about that stage checkable. A product that will not say where it stops working has not finished thinking about where it starts.