Notifications
Clear all
Topic starter
11/07/2026 8:46 pm
TL;DR: Attackers can preserve access after VPN patching by abusing persistence mechanisms and the broad trust model built into traditional tunnels, according to Appgate’s analysis of the Fortinet symlink backdoor incident. The lesson for practitioners is that segmentation and session-scoped policy, not faster patching alone, determine whether compromise becomes containment or enterprise-wide exposure.
NHIMG editorial — based on content published by Appgate: traditional VPN persistence and direct-routed ZTNA analysis
Questions worth separating out
Q: What breaks when VPN access still assumes trust after authentication?
A: Broad VPN trust turns one successful login into wide internal reach, which gives attackers room to move laterally, persist, and pivot after compromise.
Q: Why do traditional VPNs increase lateral movement risk in enterprise networks?
A: Traditional VPNs usually grant network-level access instead of application-level access, so attackers can explore systems that were never intended to be reachable together.
Q: How do security teams know if remote access is actually limited enough?
A: A remote access model is limited enough when a valid session can only reach the specific resources required for the task, and when posture or context changes can revoke access immediately.
Practitioner guidance
- Eliminate broad post-authentication network reach Map every remote access path to the internal resources it can reach today, then remove any tunnel that still grants implicit access to multiple segments without additional policy checks.
- Validate persistence after VPN remediation After patching remote access infrastructure, verify file integrity, startup paths, services, and symlink or configuration artefacts that could preserve unauthorized access beyond the original vulnerability fix.
- Adopt resource-scoped access enforcement Move high-risk remote access flows toward per-session and per-resource authorization so a compromised endpoint cannot use a single authenticated tunnel to pivot freely through the environment.
What's in the full article
Appgate's full analysis covers the operational detail this post intentionally leaves for the source:
- The specific Fortinet symlink persistence mechanics and why they survived routine remediation.
- The direct-routed ZTNA architecture details behind Single Packet Authorization and short-lived session creation.
- The access-control contrasts between VPN tunnels, brokered ZTNA paths, and per-resource enforcement models.
- The practical implications of posture checks and session revocation for remote access design.
👉 Read Appgate's analysis of VPN persistence and direct-routed ZTNA →
VPN persistence and lateral movement: why implicit trust keeps failing?
Explore further
11/07/2026 9:14 pm
Implicit network trust is now a governance failure, not a convenience choice. VPNs were designed for a perimeter model that no longer reflects how attackers operate. Once authenticated, broad access enables lateral movement that identity teams cannot contain with authentication alone. Practitioners should treat network trust expansion as an identity governance issue because the session boundary becomes the real control surface.
A question worth separating out:
Q: Who is accountable when compromised access infrastructure keeps working after patching?
A: Accountability sits across platform owners, IAM teams, and security operations because patching alone does not remove persistence or confirm that access state has been cleaned up. Frameworks that matter here include least-privilege and configuration management controls, plus the operational responsibility to verify that no unauthorized access path survives remediation.
👉 Read our full editorial: Traditional VPN persistence shows why Zero Trust must replace implicit trust
