On April 16, 2026, HENNGE K.K. announced HENNGE Mesh Network, a next-generation network solution designed to eliminate the fundamental vulnerabilities of traditional VPNs. With National Police Agency data revealing that over 60% of ransomware intrusions originate from VPN devices, transitioning to a Zero Trust architecture that overcomes the limits of perimeter-based defense has become an urgent imperative.

The Reality of Ransomware Intrusion Routes Shown by National Police Agency Data

In recent years, cyberattacks targeting corporations and local governments have grown increasingly sophisticated, with ransomware damage cementing itself as a severe management risk. According to statistical data from the National Police Agency’s report, “Threats in Cyberspace in the First Half of 2025,” VPN devices accounted for 62% (28 cases) of ransomware intrusion routes. Furthermore, when combined with the 10 cases originating from Remote Desktop Protocol (RDP), more than 85% of all ransomware attacks exploited remote access environments.

This data demonstrates that the issue extends beyond flaws in specific VPN products; in today’s work environment, where telework and external connectivity are standard, consolidating network entry points into a single bottleneck creates a massive attack surface. Mid-sized and small-to-medium enterprises (SMEs) with limited IT resources face particular challenges in keeping pace with patch management and continuous monitoring across diverse vulnerabilities, leaving exposed gateways as prime targets for ransomware attacks.

The diagram below illustrates the structure of cyberattacks targeting remote access in recent years.

Against this backdrop, organizations face an urgent need to shift toward replacing traditional VPNs by redesigning their overall network architecture rather than relying on reactive patching or stopgap measures.

Structural Flaws in Legacy SSL VPNs and Lateral Movement Risks

Traditional perimeter-based security models, represented by legacy SSL VPNs, suffer from inherent structural flaws in both security and operational management. First, gateway devices for conventional VPNs are constantly exposed on the internet with fixed IP addresses, making them prime targets for hackers and automated scanning tools worldwide. If an unpatched vulnerability exists, attackers can breach the system without going through authentication procedures.

Second, legacy VPNs operate under a structure where a single key grants access to the entire building. Once an attacker breaches the perimeter, they gain broad access across the internal network. This allows malicious actors to execute lateral movement with ease, eventually reaching critical servers housing sensitive data.

Third, the traditional hub-and-spoke architecture—which routes and processes all remote traffic through a centralized internal network hub—causes severe network latency and bandwidth congestion as cloud SaaS usage and video conferencing surge. Beyond degrading operational efficiency, expanding hardware capacity and configuring complex routing rules drive up operational overhead significantly.

Technical Architecture of Next-Gen Mesh Networks Enabling VPN Replacement

WireGuard-Based P2P Communication and Attack Surface Minimization

To address the structural flaws of conventional VPNs at their core, HENNGE K.K. announced HENNGE Mesh Network on April 16, 2026, with service availability planned for October 2026 and beyond. The service adopts peer-to-peer (P2P) mesh networking technology built on WireGuard, an open-source, high-speed VPN protocol. The technology development leverages advanced capabilities from Runetale Inc., a HENNGE portfolio company.

Unlike legacy VPNs, HENNGE Mesh Network operates without centralized, publicly exposed connection gateways or public IP addresses visible over the internet. Instead, dedicated agent software is installed on endpoints such as PCs and servers, allowing authenticated devices to establish direct communication with one another. This design effectively hides endpoints from internet scanning and external attack vectors, minimizing the attack surface to the bare minimum.

Supported platforms at launch will include Windows and Linux endpoints, with plans to expand compatibility sequentially to smart devices running macOS, iOS, and Android.

The following diagram illustrates direct endpoint-to-endpoint communication in a P2P mesh network.

Because there is no centralized bottleneck, communication latency is eliminated, delivering optimal, high-speed data transfers at all times.

Access Control via Microsegmentation and Identity Integration

A defining feature of HENNGE Mesh Network is its software-defined microsegmentation capability. Without requiring complex reconfigurations of physical routers or switches, administrators can granularly segment network access ranges via software.

Based on the Principle of Least Privilege (PoLP), access rights are restricted strictly to the resources required for specific user IDs or organizational groups. Even if a single PC on the network becomes infected with malware or compromised, software controls forcefully block the attacker from moving laterally to other servers or devices, containing the damage instantly.

Furthermore, HENNGE Mesh Network seamlessly integrates with the single sign-on (SSO) and access control features (HENNGE Access Control) of HENNGE One Identity Edition, which holds the top market share in Japan’s IDaaS market for four consecutive years. IT administrators can easily configure access routes through an intuitive browser dashboard without requiring specialized networking expertise.

Planned future enhancements include:
– Automated Identity Locking: Integrating with ID management so that if an employee departs or suspicious behavior is detected, locking the ID in HENNGE Access Control immediately revokes network access rights in Mesh Network.
– Device Posture Integration: Partnering with EPP/EDR endpoint protection products to automatically terminate connections under predefined conditions when a threat or anomaly is detected on a device.

“Democratizing Zero Trust”: Decoupling Communication and Centralizing Policy

Architectural Innovation Through Distributed Traffic and Centralized Policy

Building a traditional Zero Trust Architecture (ZTA) has historically presented significant hurdles, requiring organizations to procure and integrate disparate point solutions—such as IDaaS, VPN replacements, EDR, and CASB—from multiple vendors. This led to skyrocketing costs, fragmented management, and blurred accountability. Moreover, traditional hub-and-spoke models could not escape structural latency issues caused by hairpinning all traffic through a central hub.

HENNGE advocates a new Zero Trust architecture that cleanly decouples the data plane (which handles actual traffic) from the control plane (which manages authentication and policy enforcement). Actual data traffic is distributed across the mesh network to prevent performance bottlenecks, while security policies for access authorization are managed centrally on a unified platform: HENNGE One.

At its core, Zero Trust boils down to accurately controlling three fundamental questions: “Who” (Identity), “From which device” (Device), and “Accessing where” (Network). HENNGE expands its established identity platform to cover device protection (HENNGE Endpoint & Managed Security), password management (HENNGE Password Manager), domain protection (HENNGE Domain Protection), and networking (HENNGE Mesh Network). This approach establishes a complete Zero Trust foundation through a single domestic Japanese platform.

Practical Implementation for SMEs and Future Outlook

At the heart of HENNGE’s product strategy is the “Democratization of Zero Trust.” Historically, implementing a comprehensive, advanced Zero Trust environment was a privilege reserved for large enterprises with substantial IT budgets and dedicated security operations centers. HENNGE aims to change this by providing a “just-right” solution that mid-sized businesses and SMEs with limited IT staff can operate autonomously without specialized skills, all at an accessible price point.

On October 1, 2026, HENNGE One will fully overhaul its plan structure, introducing a top-tier “HENNGE One Suite” plan that bundles EDR/MDR, Mesh Network, and other advanced services. These new capabilities will also be rolled out sequentially to HENNGE’s existing customer base of over 3,500 companies, elevating the baseline security of Japanese industry as a whole.

Key areas to watch following the October 2026 service rollout include the adoption rate among mid-sized enterprises and upcoming feature updates, such as automated identity revocation and EDR-triggered connection termination. Beyond replacing legacy VPNs, expectations are high for how this realistic, identity-centric Zero Trust foundation will penetrate and fortify the broader business landscape.

Reference Pages

• 【HENNGE Mesh Network Press Release】https://hennge.com/jp/info/press/20260416_meshnetwork/
• 【Threats in Cyberspace in the First Half of 2025 (National Police Agency)】https://www.npa.go.jp/publications/statistics/cybersecurity/data/R7kami/R07_kami_cyber_jyosei.pdf

【#HENNGE #ZeroTrust #VPNReplacement #HENNGEOne #Cybersecurity #NetworkSecurity #InformationSecurity】