Traditional VPN persistence shows why Zero Trust must replace implicit trust

At a glance

What this is: This analysis argues that traditional VPNs can leave persistence and lateral movement intact even after patching, because implicit trust survives authentication.

Why it matters: It matters because IAM and security teams need access models that limit post-authentication reach, especially where non-human identities, remote access, and privileged paths can be abused for persistence.

Context

Traditional VPNs create a security gap when successful authentication is treated as permission for broad internal reach. Once a tunnel is established, the control plane often shifts from identity to network location, which makes containment difficult after compromise. That model is increasingly mismatched to remote access, privileged workflows, and environments where a single credential or session can expose far more than the original request required.

In this article's identity angle, the issue is not just perimeter design but how access is governed after login. Broad tunnels can blur identity assurance, privilege scope, and session boundaries, which is why segmentation and contextual policy matter when teams are trying to contain machine, service, or human access. The symlink backdoor example is a familiar pattern, not an outlier.

Key questions

Q: What breaks when VPN access is treated as trusted after login?

A: Broad VPN trust breaks containment. Once an attacker or compromised vendor session connects, flat network design can expose internal systems, management interfaces, and shared services that were never meant to be reachable from a remote entry point. Security teams should remove implicit post-login trust and limit access to specific assets and tasks.

Q: Why does persistence matter even after a VPN patch is applied?

A: Patching removes the flaw, but it does not automatically remove attacker footholds that were planted to survive remediation. If a persistence mechanism can re-establish access, the environment still contains a path back in. That is why post-patch verification, session teardown, and access-path review are part of remediation, not optional extras.

Q: What are the signs that remote access is failing to contain compromise?

A: The main warning signs are broad internal reach from a single remote session, access that survives context changes, and repeated re-entry after patching or rebooting. If a remote access control cannot narrow scope, enforce posture-based revocation, or eliminate surviving footholds, it is functioning as a connectivity layer rather than a containment control.

Q: How should teams respond when VPN access is being used for lateral movement?

A: They should separate the access problem from the cleanup problem. First, reduce the session's reach to the smallest possible set of resources and revoke anything that is not explicitly required. Then validate that no persistence mechanism remains on the access device and that remote paths cannot be reused for broader movement.

Technical breakdown

Why traditional VPN tunnels become persistence paths

Traditional VPNs are designed to establish a trusted network tunnel after authentication, then pass traffic as if the user were inside the perimeter. That model is convenient for connectivity but weak for containment because the tunnel itself becomes a durable access path. If an attacker compromises a VPN appliance or account, the resulting session can survive long enough to support ongoing access even after the original flaw is patched. In practice, the network treats the session as trusted transport rather than continuously evaluated access.

Practical implication: replace implicit tunnel trust with session-bound access decisions and narrow resource reach.

How lateral movement follows broad post-authentication access

Lateral movement becomes easier when VPN access maps to large swaths of the internal network instead of a specific application or data path. Once inside, an attacker can discover adjacent systems, reuse trust relationships, and pivot across flat zones that were never intended to be directly reachable. This is a classic access-scope problem: the control authenticates the entry point, but does not constrain what the session can do afterward. Zero Trust controls matter here because they reduce reach after authentication.

Practical implication: scope remote access to specific resources and remove network-wide reach from remote sessions.

Why persistence can survive patching and rebooting

A reboot or patch can close a vulnerability, but it does not automatically remove attacker footholds that were planted to survive remediation. In this case, the symlink-based mechanism kept unauthorized access alive because the environment still allowed a durable path back into the device or network. That is the key lesson for identity governance and NHI security alike: if access depends on a reusable path, the adversary only needs one surviving control point to maintain presence.

Practical implication: pair vulnerability remediation with access-path validation, session teardown, and post-remediation verification.

Threat narrative

Attacker objective: Maintain unauthorized internal access after initial compromise and use the VPN trust model to move laterally.

1. Entry occurred through earlier exploitation of Fortinet SSL-VPN flaws, which gave attackers a foothold on internet-facing VPN appliances.
2. Attackers implanted a symlink-based persistence mechanism so the foothold remained usable even after administrators patched and rebooted affected devices.
3. The persistent access path supported ongoing unauthorized access and lateral movement across environments that still trusted VPN-authenticated sessions.
4. The end state was durable presence inside trusted networks, not a one-time intrusion.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Implicit trust is the real control failure in traditional VPN design. The article shows that once a session is authenticated, too many environments still treat the connection as broadly trustworthy. That makes the VPN itself a persistence surface, not just an access channel. Practitioners should read this as a governance problem about post-authentication scope, not simply a patching problem.

Persistence plus flat reach creates a long tail of identity risk. The symlink backdoor example is important because it shows how an attacker can keep access after the original vulnerability is addressed. That is the same structural weakness that appears when identity, network reach, and privilege are fused into one broad session. The control gap is not visibility alone but the absence of session-level containment.

Zero Trust only changes the outcome when access is both contextual and ephemeral. A direct-routed or broker-free design is less relevant than the governance principle behind it: do not let successful authentication imply open-ended trust. Where access is bound to user, device, and resource context, the blast radius of compromise collapses. The practitioner takeaway is to replace network-wide trust with resource-scoped authorization.

Traditional VPN persistence is a named example of the connect-then-trust problem. This article sharpens that concept by showing how static tunnels create reuse opportunities after compromise. In identity terms, the session outlives the assurance event, which is why continuous policy enforcement matters more than a one-time login check. Teams should treat this as a boundary design issue across IAM, PAM, and remote access.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Connect-then-trust is now a liability pattern, not an access convenience. When a remote access tunnel turns successful login into broad internal reach, the session itself becomes the thing attackers try to preserve. That means containment has to move closer to the point of authorization, with resource-scoped policy and posture checks doing the real work.

Persistence is the governance clue that a VPN model is too permissive. If an attacker can remain present after a patch and reboot, the environment has not actually closed the access path. The practical lesson for IAM and PAM teams is to treat remote access as a continuously governed privilege, not a network entitlement that lasts until the session drops.

For practitioners

• Constrain remote access to resource-scoped policy Map each VPN use case to a specific application, subnet, or data path and remove network-wide reach wherever possible. The goal is to make successful authentication authorize only the minimum necessary destination set.
• Eliminate persistent tunnel assumptions Treat remote sessions as ephemeral access events, not standing conduits. Force re-evaluation when device posture, identity confidence, or context changes during the session.
• Verify that remediation actually removed the foothold After patching or rebooting a remote access device, check for surviving files, rules, or access paths that could preserve unauthorized access. Remediation is incomplete until the persistence mechanism is confirmed gone.
• Segment privileged and remote workflows Separate administrative access, user remote access, and sensitive workload paths so compromise in one tunnel cannot expose the broader internal environment. Segmentation should be enforced at the authorization layer, not just the network boundary.

Key takeaways

• Traditional VPN designs can turn a successful login into a persistence opportunity because the session inherits broad internal trust.
• The Fortinet symlink backdoor example shows that patching alone does not guarantee the attacker foothold is gone.
• Segmentation and session-scoped authorization are the controls that change whether compromise becomes contained access or lateral movement.

Key terms

• Implicit trust: The assumption that an authenticated user, token, or session should continue to be trusted across time and systems without repeated checks. In modern environments, this assumption creates attack leverage because identity artefacts can be reused, delegated, or moved faster than manual governance can react.
• Persistence mechanism: A persistence mechanism is any technique that allows malware or unauthorized code to survive reboot, logout, or process termination. In Linux environments, that often includes system services, init scripts, cron jobs, shell profiles, and configuration changes that automatically relaunch the payload.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Session-Scoped Access: Session-scoped access is permission that exists only for a defined task or time window and is expected to end when the task ends. For NHI governance, it reduces lingering authority and makes AI-driven activity easier to review, revoke, and investigate when behaviour changes.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for teams that need to connect access governance, privilege control, and non-human identity oversight to day-to-day security decisions.