VPN security for Indian businesses: what a VPN does and does not protect, split tunnelling, legacy protocol fallback, and how remote access should be reviewed.
A VPN protects the traffic between a remote device and your network, and it does nothing about what happens once the user is inside. The common failure in Indian businesses is treating a VPN as the remote access control, when the real risks are the account it authenticates, the device it runs on, and the internal network it grants reach into. A modern posture requires phishing-resistant MFA on the VPN, device posture checks before connection, a modern protocol with no legacy fallback, session logging retained for 180 days as CERT-In requires, and network segmentation for remote users.
One thing well: the confidentiality and integrity of traffic between the endpoint and the gateway, and a level of network access control, if the rules are tight. It does not protect the device, which may be infected before the tunnel is opened. It does not protect the credentials, which is why a password phished from a fake portal is a fully authenticated session. It does not protect the internal network, which is reachable from the account unless segmentation limits it. And it does not protect against an insider who is a legitimate user. The honest framing for a business is that a VPN is a transport, and the security lives in the identity layer, the endpoint and the segmentation that sits behind it.
Six checks, in priority order. Protocol and cipher, because a client that still permits an obsolete protocol will happily downgrade under pressure, and a modern policy should allow only a current protocol with a strong cipher, with legacy fallback disabled. Authentication strength, because the single most common finding is an account with MFA disabled, bypassed for a service account, or enforced by a method that can be relayed. Split tunnelling policy, since an open split-tunnel rule quietly sends a large share of traffic outside the tunnel and outside the inspection point. Client and server patching, since unpatched VPN concentrators are among the most consistently exploited internet-facing appliances anywhere. Idle and absolute timeouts, which limit the value of a stolen session. And log coverage, with retention of 180 days per CERT-In and shipping to a central store the administrator cannot edit.
Because the malware is already there. A device that connects over a VPN carries whatever it collected, and a secure tunnel faithfully transports it inward, which means the VPN can accelerate a breach rather than prevent one. The controls that address it are device posture checks before the connection is allowed: disk encryption on, screen lock set, the device managed, the operating system within a supported patch window, and endpoint detection and response running with a current policy. Where a full posture check is not feasible, a compromise-resistant second factor and a short session lifetime narrow the window considerably. This is the same reasoning behind the 2026 Indian advisories on mobile device management and on the Statement of Account.zip malware, which spread through a hijacked WhatsApp session rather than through any weakness in the messaging encryption.
Test the authentication path first, because that is where Indian remote-access breaches actually happen: attempt to authenticate without the second factor, attempt a relayed or proxied factor, attempt to authenticate with a stale session token, and attempt to reach an internal administrative interface that should not be exposed to remote users. Then test the post-login reach, because a remote account that can reach the whole internal network turns a phished credential into a network-wide event. And test the policy, by checking that a client on an unsupported or unmanaged device is refused. At AAVETech this is a fixed-price remote access assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest after your changes and a written rules-of-engagement document.
| Area | Expected configuration | Finding when absent |
|---|---|---|
| Protocol | Current protocol only, strong cipher, no legacy fallback | Silent downgrade under attacker pressure |
| Authentication | Phishing-resistant MFA, no bypass accounts | Stolen password becomes a full session |
| Device posture | Encryption, managed, patched, EDR running | Infected device tunnels malware inward |
| Segmentation | Remote users land in a restricted segment | One credential reaches the whole network |
| Session control | Idle and absolute timeouts, re-auth for sensitive | Stolen session stays usable for hours |
| Logging | 180 days, central store, tamper-resistant | No way to reconstruct who connected |
A VPN protects the traffic between a remote device and your network, and it does nothing about what happens once the user is inside. The common failure in Indian businesses is treating a VPN as the remote access control, when the real risks are the account it authenticates, the device it runs on, and the internal network it grants reach into. A modern posture requires phishing-resistant MFA on the VPN, device posture checks before connection, a modern protocol with no legacy fallback, session logging retained for 180 days as CERT-In requires, and network segmentation for remote users.
No. A consumer VPN is designed to hide your traffic from an internet provider, not to authenticate a company employee, and it typically provides no per-user identity, no device posture check, no session log and no revocation. Business remote access needs a server you control, with identity integration, individual credentials and auditable logging.
An account that can authenticate without a second factor, or a service account with a shared password and broad reach. The tunnel cryptography is rarely the weak point; the identity and the segmentation behind it are.
At least 180 days, per CERT-In's directions, and longer where an investigation is open. Logs should be shipped to a central store the firewall or VPN administrator cannot delete, because an administrator-editable log is not evidence.
No. Remote users should land in a restricted segment with access to the specific systems they need, and administrative interfaces should be reachable only through a controlled path. Without that, a single phished credential becomes a network-wide event.
Yes. AAVETech runs a fixed-price remote access and VPN assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a signed rules-of-engagement document and a retest after your remediation.
Read the full guide on AAVETech: Does Your Company VPN Make You Safer, or Just Move the Problem?.
Send us your VPN configuration and the list of remote-access accounts and we will return a fixed-price remote access assessment with a written scope.
Talk to an analyst about this.