JIT vendor access instead of standing VPN

Most small offices still hand vendors a VPN profile and leave it active for years. The project ends, the engineer rotates off, the firewall rule stays. Six months later someone is on your LAN because a password from 2022 still works and nobody remembered to revoke it.

Just-in-time (JIT) vendor access flips the default: no standing path inward unless someone approves a time-bound session for a stated purpose. You do not need a Fortune 500 identity platform to apply the idea. You need a policy that matches how vendors actually work.

Standing VPN fails quietly

Accounts outlive contracts. Vendor turnover is constant. Your VPN user list rarely gets the same attention as employee offboarding.

Flat network access is overkill. A camera installer does not need routes to the file server and the domain controllers. They need one host or one management VLAN for two hours.

Shared credentials hide activity. “Use the vendor login” means you cannot tell which human changed what when something breaks.

Alerts become noise. A permanent tunnel looks normal until it is not. A session that opens at 2 a.m. on a Sunday stands out.

What JIT looks like in practice

JIT does not mean “no remote access.” It means access is requested, approved, logged, and expired.

Reasonable patterns for SMBs:

• Time-bound VPN or Zero Trust app sessions with automatic expiry (same day or same week, not “until we remember”)
• Jump host or vendor VLAN that reaches only the systems in scope, not the whole office LAN
• Named accounts per vendor (or per engineer), never one shared vendor user
• Ticket or change record tied to the session: who approved, what was touched, when it closes

Cloudflare Access, Microsoft Entra global secure access, dedicated vendor SSIDs, or a locked-down RD Gateway can all implement the shape. The tool matters less than the habit: open the door when needed, close it when done.

When standing access might still make sense

Be honest about exceptions:

• 24/7 monitoring contracts with clear SOC procedures and named on-call identities
• Appliances that cannot do per-session auth where you compensate with network segmentation and logging
• True production emergencies where waiting for approval costs more than the risk, documented after the fact

Even then, scope the route and review monthly. “Always on” should mean “always justified,” not “we set it up in 2019.”

Decision checklist

Before you renew another always-open vendor VPN, run through this:

Question	Standing VPN	JIT-style access
Can you name every active vendor identity?	Often no	Required
Does access auto-expire?	Rarely	Yes
Is reach limited to agreed systems?	Usually LAN-wide	Should be
Is there an approval trail?	Sometimes	Built in

If you fail the first row, you do not have a vendor access program. You have a forgotten list.

Bottom line

Replace standing vendor VPN with time-bound, approved, scoped sessions wherever you can. Keep named accounts, tie access to tickets, and review what is still open each month. Vendors will adapt; your attack surface will not keep growing in the background.