# Why are unpatched VPN gateways such a risk?

Because the VPN gateway is reachable from the whole internet by design and trusted by your internal network, a security flaw in it can let an attacker in without any password. Flaws in VPN and remote-access appliances from several major vendors have been exploited widely in recent years, and national cyber-security agencies regularly publish urgent advisories about them. Treat the gateway as your most exposed system: subscribe to the vendor's security advisories, patch within days rather than at the next maintenance window, run the vendor's published compromise checks after a critical flaw, and restrict the management interface to internal addresses. If you cannot patch quickly, consider a managed service. A network sensor cannot see a flaw being exploited inside the appliance, but it can see what comes next: monitoring the segment behind the gateway, NetSenX flags scanning, lateral movement and beaconing from VPN addresses, on every plan.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/why-are-unpatched-vpn-gateways-a-risk

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [What is split tunnelling on a VPN, and is it a risk?](https://netsenx.com/en/faq/what-is-split-tunnelling-and-is-it-a-risk)
- [Where should a sensor sit to see what VPN users do?](https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic)
- [How do I detect a VPN account used from two countries at the same time?](https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries)
- [What is impossible travel, and which tool detects it?](https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it)
- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)