Start by mapping VPN users, apps, and risk levels, then phase in ZTNA with least-privilege policies, MFA, device posture checks, and pilot groups before retiring broad network access.