Lantern DSSE

Why not a VPN

A VPN's job is to put you inside. Our job is to make sure there is no inside.

The perimeter is the problem, not the implementation

A VPN is a perimeter, and its function is to get an endpoint in. Once in, the network is flat: the compromised machine can reach its neighbours directly, and lateral movement is trivial. SSL-VPN is worse on both counts — it is a large, permanently internet-facing attack surface, and one of the most heavily targeted classes of appliance there is.

The two failures compound. The thing most likely to be breached is also the thing that grants the flat interior.

What replaces it

An endpoint with the agent installed always traverses the Edge. Every flow is decided against policy, audited, and — where the policy says so — authenticated again at the point of use.

Including on the same LAN. Traffic from one managed endpoint to a machine sitting next to it on the same local segment also goes through the Edge. Most zero-trust products mediate remote access to applications and leave device-to-device traffic on the local network untouched — which is exactly the path lateral movement uses.

VPN / SSL-VPNLantern DSSE
Attack surface a permanently public appliance the Connector dials outbound only; nothing to attack inbound
After a compromise flat interior, neighbours directly reachable every hop decided, audited, re-authenticated if required
Same-LAN traffic unmediated mediated through the Edge
Evidence afterwards connection logs every decision recorded

What this does not claim

Ransomware moves in stages — intrusion, dwell, lateral movement, privilege escalation, destruction. This acts on one of them. It does not stop intrusion, it does not detect malware on the endpoint, and it does not replace EDR. Default-deny reachability is the first layer; detection and isolation are subsequent ones.

Naming the stage is what makes the claim about that stage checkable. A product that will not say where it stops working has not finished thinking about where it starts.