Almost every business in Malta with remote or hybrid staff has a VPN. Far fewer can say what a single stolen password would reach once it was used.
Those are two different questions, and only one of them is ever asked in advance.
A VPN checks a person once, at the door, and then places their device on the network. Whatever that network can reach, the device can now try to reach. Zero Trust does something narrower. It checks the person and the device against one application, opens that one, and keeps checking while the session runs. One approach hands out a place to stand. The other hands out a single door.
The VPN Works, Which Is the Problem
Nobody moves away from a VPN because it stopped working. It encrypts the tunnel, it checks the credential, and staff get to the file server from home. Judged on what it was built to do, it does it.
That is exactly what makes the gap hard to see. The VPN was designed for a time when the thing worth protecting sat in one building, and the people worth trusting sat in it too. Access meant getting inside the perimeter, because inside the perimeter was where the work was.
Very little of that still holds. Staff work from home, from a client site, from a hotel network nobody controls. Applications sit partly in the server room and partly in someone else’s data centre. The perimeter still exists on the diagram, but the work has moved out from behind it.
So the VPN keeps doing its job faithfully, and the job it is doing has quietly stopped being the one that matters. It still answers the question it was asked. It is no longer the right question.
What a Stolen Password Actually Buys
Credentials get stolen. That is not a failure of discipline, it is the normal weather of running a business online. Someone reuses a password, someone clicks a convincing invoice, a supplier is breached and a list turns up for sale.
What decides how bad that morning gets is not the theft. It is what the credential opens.
With a VPN, a working credential buys a position on the network. From there an attacker can look around, find the file shares, find the backup server, find the finance application, and move between them. Nothing has been broken into at that point. They are using the access the credential was given, which is why it so often runs for weeks before anyone notices.
This is the part that turns an incident into a ransomware event. Not the first machine, the movement afterwards. The broader the access, the more there is to move through, and a VPN is broad by design.
The Questions Worth Asking Before Q4
Budgets get drafted around now, and remote access is usually renewed rather than examined. Three questions worth answering honestly about your own setup before it is renewed again:
- If one remote worker’s password were used by someone else tonight, what could they open? Not what should they open, what could they, with no further obstacle.
- When someone leaves, how long does their remote access keep working? The answer is often an honest “until somebody remembers”.
- Is the laptop checked at all before it connects, or only the person using it? A patched company machine and an unpatched personal one look identical to a password prompt.
None of these are trick questions. Most businesses can answer the first one in seconds, and the answer is usually “most things”. That is the finding, not a failure. It is simply what network-level access means, and it is worth knowing before it is renewed for another year.
What FireCloud Total Access Does Differently
WatchGuard FireCloud Total Access, released in September 2025, extends FireCloud Internet Access and takes a different starting position. Instead of placing a device on the network, it grants access to one approved application at a time.
Three services arrive together, cloud-delivered, through a single agent: Firewall as a Service, a Secure Web Gateway, and Zero Trust Network Access. The policies live in WatchGuard Cloud, so the rules that apply in the office are the same rules that apply in a hotel room.
Two details matter more than the acronyms. First, identity and device posture are checked for every session and re-checked while the connection is open, so access is not something granted once and forgotten. Second, private applications are never exposed to the internet at all. There is no front door on the public network to find.
That second point is what removes lateral movement. If a credential is stolen, it opens the application it was entitled to, and there is no network to wander from there.
A Reasonable Place to Start
Replacing remote access across a business in one move is rarely sensible, and it is not what we would advise. Start with the group where broad access costs the most.
That is usually whoever reaches the finance system, the client data, or the administrative consoles. It is a small number of people, so the change is contained, and it is the access an attacker wants most, so the benefit is immediate.
Run it alongside the VPN rather than against it. Move one application and one group, confirm the experience is genuinely better for the people using it, and let the comparison make the argument. It usually does, because signing in to one application is faster than bringing up a tunnel to reach it.
From there the rest follows at whatever pace suits the year. The point is not to finish quickly. It is to stop the highest-value access being the broadest access, which is how most Maltese businesses are currently arranged.
Talk to 4TFront
4TFront is the Official WatchGuard Distributor in Malta and supplies FireCloud Total Access to the local IT channel. We advise IT providers and their customers on where it fits, and where a VPN is still perfectly reasonable, because sometimes it is.
If you are scoping remote access for Q4, or you want to work through the three questions above against a real setup, we are happy to go through it with you.
Related reading: why antivirus alone stopped being enough covers the endpoint layer that sits underneath this, and backup is not the same as recovery covers what happens when something does get through.
Contact sales@4tfront.com or call +356 2124 8205.
