What is a transport-path perimeter, and when is it useful?

Using a VPN to encrypt the transport path when unencrypted or insufficiently secure legacy protocols cannot be avoided.

Some systems, often old ones or OT equipment, can only speak protocols without encryption or with weak encryption, and they cannot be replaced or upgraded. Instead of fixing the protocol, you wrap its traffic in a VPN tunnel between the endpoints. The legacy protocol still runs unchanged, but only inside the encrypted tunnel, so the exposed path between the two ends is protected. The VPN draws a narrow perimeter around the transport path itself.