How do we know if our VPN has been compromised?

Check the VPN's own logs first: sign-ins at odd hours or from unexpected countries, accounts that never used the VPN before, many failed attempts, and new configuration changes or admin accounts on the appliance. Compare its software version with the vendor's security advisories, because VPN gateways are a frequent target of exploited flaws, and run the vendor's published compromise checks if there are any. Behind the VPN, an attacker's next steps show on the network: scanning from the VPN address pool, new sessions from VPN addresses to servers they never used, large transfers out. NetSenX flags those where the segment behind the VPN is monitored, on every plan, and its VPN view lists the tunnels and gateway sessions it sees, with the country each remote address is registered in. It does not read the appliance's logs and cannot inspect the appliance itself.

← All 40 questions on Remote work and exposed servicesAll topics