Why do VPNs and IP filtering fail against remote worker imposters?

Why This Matters for Security Teams

VPNs and IP filters are still widely treated as proof that a person is “inside,” but they only validate a network path. They do not answer whether the connecting party is the right worker, on a trusted device, in a safe session state, or operating under current risk conditions. That makes them a weak control against imposters using stolen credentials, session replay, or compromised endpoints. NIST’s NIST Cybersecurity Framework 2.0 reinforces that identity assurance must be paired with ongoing risk management, not connectivity alone.

The failure mode is especially visible in attacks that reuse valid access from approved geographies or known corporate egress points. NHIMG research on the Schneider Electric credentials breach and the SonicWall VPN Mass Breach via Stolen Credentials shows how stolen access can remain credible long enough to bypass perimeter assumptions. In practice, many security teams encounter impostor access only after lateral movement or data access has already occurred, rather than through intentional verification at login.

How It Works in Practice

A VPN authenticates the tunnel, not the human, device, or intent behind it. IP filtering narrows where traffic may come from, but it does not distinguish a legitimate worker from an impostor using the same account from the same location. Once the session is established, the environment often trusts the connection too broadly, especially when legacy applications still key authorisation off network location.

Effective defence requires layering identity, device, and session controls so that trust is continuously re-evaluated. Current guidance suggests combining MFA, device posture checks, conditional access, short session lifetimes, and privilege minimisation. Where possible, organisations should move away from static allowlists and toward policy decisions that incorporate user risk, device health, geolocation anomalies, and session history. NIST’s framework supports this shift from boundary-based control to ongoing governance, while NHIMG’s analysis of the DeepSeek breach illustrates how exposed credentials and weak control planes can create broad access opportunities.

• Require step-up authentication for sensitive actions, not just initial login.
• Bind access to device posture, certificate status, and revocation checks.
• Use least privilege so a stolen session cannot reach everything a real worker can.
• Set aggressive session timeouts and re-authentication triggers for risky events.

For remote work, this also means treating VPN access as transport, not trust, and using it only as one signal among many. These controls tend to break down in flat networks and legacy remote-access stacks because they cannot inspect session risk after authentication or distinguish normal worker behaviour from abuse.

Common Variations and Edge Cases

Tighter access controls often increase friction for legitimate workers, requiring organisations to balance user experience against stronger assurance. That tradeoff becomes most visible in call centres, third-party support, and distributed operations where IP addresses change frequently and device management is inconsistent.

There is no universal standard for this yet, but best practice is evolving toward context-aware access that can adapt to different risk tiers. For low-risk systems, IP filtering may still reduce noise. For privileged systems, it should never stand alone. VPNs can also remain useful for encrypted transport, yet they should be paired with per-session authorisation and explicit trust checks. NHIMG’s reporting on the LLMjacking threat vector reinforces a broader point: once credentials are compromised, attackers do not need to behave like the legitimate user, they only need to look credible long enough to blend in. That is why current guidance increasingly treats network location as a weak signal and identity lifecycle as the control that matters.

For organisations with contractors, shared workstations, or unmanaged devices, the gap widens further because IP provenance and user provenance diverge. In those environments, VPNs and IP filters are useful for connectivity hygiene, but they should not be treated as an access decision.

Related resources from NHI Mgmt Group

• Why do SMS OTP and voice checks fail more often against AI-driven fraud?
• Why do periodic password resets fail against modern credential attacks?
• Who is accountable when a remote device exposes organisational data?
• How should organisations govern mobile devices used for remote work?