How do I detect a VPN account used from two countries at the same time?

With your VPN gateway's or identity provider's sign-in logs, because only they know which account each session belongs to. Look for the same user signing in from two places too far apart for the time between them, a session from a country where you have no staff, or a sign-in from an address that belongs to a hosting provider or an anonymising service. Many identity providers and VPN gateways can raise this automatically, often as impossible-travel or risky sign-in detection; switch it on, and require multi-factor authentication so that a stolen password alone is not enough. The network gives the second half of the picture. The NetSenX VPN view lists the tunnels and gateway sessions it sees on monitored segments, with the country the remote address is registered in, and flags addresses on lists of commercial VPN services and Tor exits. It does not link sessions to accounts, so the identity logs remain the place where this alert belongs.

← All 40 questions on Remote work and exposed servicesAll topics