Why are unpatched VPN gateways such a risk?

Because the VPN gateway is reachable from the whole internet by design and trusted by your internal network, a security flaw in it can let an attacker in without any password. Flaws in VPN and remote-access appliances from several major vendors have been exploited widely in recent years, and national cyber-security agencies regularly publish urgent advisories about them. Treat the gateway as your most exposed system: subscribe to the vendor's security advisories, patch within days rather than at the next maintenance window, run the vendor's published compromise checks after a critical flaw, and restrict the management interface to internal addresses. If you cannot patch quickly, consider a managed service. A network sensor cannot see a flaw being exploited inside the appliance, but it can see what comes next: monitoring the segment behind the gateway, NetSenX flags scanning, lateral movement and beaconing from VPN addresses, on every plan.

This answer also appears, with more context, here: Remote work and exposed services

← All 40 questions on Remote work and exposed servicesAll topics