Does Your Company VPN Make You Safer, or Just Move the Problem?
Key takeaways
- A VPN encrypts the connection and does not protect the endpoint, the credentials or the internal network reachable after login.
- Legacy protocol fallback is a common finding, because a client that can still negotiate an obsolete protocol will do so under attacker pressure.
- CERT-In requires 180 days of log retention, and VPN logs are often the only record of who connected from where and when.
- The most common Indian remote-access weakness is an account that bypasses MFA, not a cryptographic break of the tunnel.
- Remote users should land in a restricted segment, with access to specific systems rather than to the whole internal network.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does a company VPN actually protect?
One thing well: the confidentiality and integrity of traffic between the endpoint and the gateway, and a level of network access control, if the rules are tight. It does not protect the device, which may be infected before the tunnel is opened. It does not protect the credentials, which is why a password phished from a fake portal is a fully authenticated session. It does not protect the internal network, which is reachable from the account unless segmentation limits it. And it does not protect against an insider who is a legitimate user. The honest framing for a business is that a VPN is a transport, and the security lives in the identity layer, the endpoint and the segmentation that sits behind it.
Which VPN configurations should be reviewed first?
Six checks, in priority order. Protocol and cipher, because a client that still permits an obsolete protocol will happily downgrade under pressure, and a modern policy should allow only a current protocol with a strong cipher, with legacy fallback disabled. Authentication strength, because the single most common finding is an account with MFA disabled, bypassed for a service account, or enforced by a method that can be relayed. Split tunnelling policy, since an open split-tunnel rule quietly sends a large share of traffic outside the tunnel and outside the inspection point. Client and server patching, since unpatched VPN concentrators are among the most consistently exploited internet-facing appliances anywhere. Idle and absolute timeouts, which limit the value of a stolen session. And log coverage, with retention of 180 days per CERT-In and shipping to a central store the administrator cannot edit.
Why does the endpoint matter more than the tunnel?
Because the malware is already there. A device that connects over a VPN carries whatever it collected, and a secure tunnel faithfully transports it inward, which means the VPN can accelerate a breach rather than prevent one. The controls that address it are device posture checks before the connection is allowed: disk encryption on, screen lock set, the device managed, the operating system within a supported patch window, and endpoint detection and response running with a current policy. Where a full posture check is not feasible, a compromise-resistant second factor and a short session lifetime narrow the window considerably. This is the same reasoning behind the 2026 Indian advisories on mobile device management and on the Statement of Account.zip malware, which spread through a hijacked WhatsApp session rather than through any weakness in the messaging encryption.
How should an organisation test its remote access?
Test the authentication path first, because that is where Indian remote-access breaches actually happen: attempt to authenticate without the second factor, attempt a relayed or proxied factor, attempt to authenticate with a stale session token, and attempt to reach an internal administrative interface that should not be exposed to remote users. Then test the post-login reach, because a remote account that can reach the whole internal network turns a phished credential into a network-wide event. And test the policy, by checking that a client on an unsupported or unmanaged device is refused. At AAVETech this is a fixed-price remote access assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest after your changes and a written rules-of-engagement document.
| Area | Expected configuration | Finding when absent |
|---|---|---|
| Protocol | Current protocol only, strong cipher, no legacy fallback | Silent downgrade under attacker pressure |
| Authentication | Phishing-resistant MFA, no bypass accounts | Stolen password becomes a full session |
| Device posture | Encryption, managed, patched, EDR running | Infected device tunnels malware inward |
| Segmentation | Remote users land in a restricted segment | One credential reaches the whole network |
| Session control | Idle and absolute timeouts, re-auth for sensitive | Stolen session stays usable for hours |
| Logging | 180 days, central store, tamper-resistant | No way to reconstruct who connected |
What are the common questions about V?
Get a straight answer on this
Send us your VPN configuration and the list of remote-access accounts and we will return a fixed-price remote access assessment with a written scope.
Send us the details See pricing