The quiet risks of legacy VPNs

A VPN is one password away from the whole network. That sentence should worry every security team.

The blast radius problem

VPN access is binary: you are in or you are out. Once in, lateral movement is limited only by internal segmentation — which, in most networks, barely exists. Every compromised laptop becomes a pivot point.

Where to start shrinking it

Begin with apps nobody should reach over VPN anyway: admin panels, databases, dashboards. Each app moved to identity-aware access cuts the VPN’s usefulness to attackers.

Frequently asked questions