Remote access is now the weakest edge of the network
The perimeter review found the office network in good order and the routes around it neglected. We recommend retiring the legacy VPN before the end of the year.
The legacy VPN still accepts passwords alone
It predates single sign-on and was left running for two suppliers.
Patching is fast wherever it is automated
The servers that lag are the ones still patched by hand.
Backups exist, and have never been restored in a test
Nobody can say how long a recovery would take.
Exposure fell everywhere except remote access
We compared what an outsider can reach today with what they could reach at the last review. Four of five categories shrank. Remote access grew, because two supplier connections were added to the old gateway.
Remote access is the only category that grew
Services reachable from the internet, April and October 2026
Three ways to close it
Retire the VPN
Move both suppliers to the access broker. Six weeks, 18,000 euros, no new licences. Closes the finding.
Add a second factor
Two weeks, 6,000 euros. Keeps an unpatched gateway on the internet.
Accept the risk
No cost now. The gateway leaves vendor support in March.
Recommendation
Retire the legacy VPN by 15 December
It is the only option that removes the gateway. Both suppliers have confirmed they can move.