What the standard says
A remote-access VPN (virtual private network) lets someone at home or on the road connect securely into the office network, usually through the office firewall. These are edge devices: equipment that sits on the boundary of your network and can be reached from outside it, like firewalls, routers and VPN gateways [1][2]. Because a VPN is a door into the network, NSA and CISA call VPN servers attractive targets and say multiple nation-state attackers have used publicly known flaws to break into them [1].
The guidance keeps returning to five habits.
Install updates quickly. Firmware is the software built into a device like a firewall, and a patch is an update that fixes a known flaw. NSA and CISA say to apply patches and updates immediately, because known flaws are often rapidly exploited [1]. CISA keeps a list called the Known Exploited Vulnerabilities (KEV) catalog: flaws with reliable evidence of real-world attacks and a clear fix, such as a vendor update [3]. CISA recommends every organization use it to decide what to fix first [3].
Require MFA. MFA, short for multi-factor authentication, asks for a second proof after your password. CISA’s #StopRansomware Guide says to put MFA on all VPN connections [4], and CISA says any form of MFA is better than none [5].
Turn off what you don’t use. NSA and CISA recommend disabling extra features on the VPN device, since they’re more likely to have flaws, and keeping the management login off the open internet [1].
Limit who can connect. The #StopRansomware Guide says to audit remote services and close what isn’t used [4].
Retire devices past end of support. A device is end of support when its maker no longer checks it for flaws or releases patches [2]. CISA, the FBI and the UK’s National Cyber Security Centre say to inventory these devices and replace them promptly, and they urge all organizations, not just federal agencies, to follow this guidance [2]. NSA and CISA also advise replacing a VPN product before it reaches end of life [1].
Remote desktop (RDP), the Windows feature for controlling a computer from elsewhere, gets its own rule: do not expose it on the web [4]. Connect through the VPN first.
What you’ll hear
“If my VPN shows up on an internet scan, it means we’ve been hacked.”
It doesn’t. A VPN has to be reachable from the internet to work, so being visible is expected. What the scan can’t tell you is whether the device is patched, whether MFA is on, and whether anything else, like remote desktop, is exposed beside it.
The opposite claim is common too: “We have a VPN, so remote access is secure.” A VPN does encrypt the connection. But the #StopRansomware Guide says attackers often get in by exploiting VPNs or using stolen passwords [4]. It protects you only while it’s patched and needs more than a password.
What the numbers say
More than 22: VPN-related flaws on CISA’s Known Exploited Vulnerabilities list, as of June 2024, per CISA, the FBI and partner agencies [6]. This is a government count of flaws with confirmed attacks, not a survey of businesses.
#1: Akira was the most-reported ransomware variant in complaints to the FBI’s Internet Crime Complaint Center (IC3) in 2024 [7]. IC3 counts complaints people chose to file, so it undercounts real incidents.
Small and medium-sized businesses: who the FBI and CISA say Akira primarily targets [8]. Akira got in through VPNs without MFA, or through known flaws in VPN products [8]. This is government reporting on one group, not a sample, but it fits small businesses directly.
What we’ve seen
We haven’t run into this yet.
Putting it together
A visible VPN is normal. The risk is an edge device that’s behind on updates, protected by only a password, or past end of support. Keep it patched, put MFA on every login, keep remote desktop behind the VPN, and replace the device before support ends.
What good looks like
VPN and firewall firmware on the latest version the maker supports, with someone checking for updates every month.
Urgent updates, especially anything on CISA’s KEV catalog, installed within days.
MFA required for every VPN login, with no exceptions for shared or old accounts.
Only current staff and needed vendors able to connect, reviewed a few times a year.
The device’s management login not reachable from the open internet.
Remote desktop never exposed directly; it’s reached only through the VPN.
Every edge device listed with its end-of-support date, and a plan to replace it before then.
Questions for your IT resource
What VPN or remote-access service do we use, and what firmware version is it on?
When was it last updated, and how do we hear about urgent patches?
Does every VPN login require MFA?
Who can connect today, and are any former employees or vendors still on the list?
Is remote desktop reachable from the internet anywhere on our network?
When does our firewall or VPN device reach end of support?
Related learning
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
How to read your Free Security Assessment
Your Free Security Assessment starts with what’s working well, then lists each item worth confirming with how sure we are and how soon it’s worth handling. This page explains each part so you can read it on your own.
Sources
NSA and CISA, Selecting and Hardening Remote Access VPN Solutions, Cybersecurity Information Sheet, September 2021. (checked 2026-10-08)
CISA, FBI and UK NCSC, Reducing the Attack Surface for End-of-Support Edge Devices, joint fact sheet, February 5, 2026. (checked 2026-10-08)
CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities. (checked 2026-10-08)
CISA and MS-ISAC, #StopRansomware Guide, September 2023. (checked 2026-10-08)
CISA, Multi-Factor Authentication. (checked 2026-10-08)
CISA, FBI and partner agencies, Modern Approaches to Network Access Security, June 18, 2024. (checked 2026-10-08)
FBI Internet Crime Complaint Center, 2024 IC3 Annual Report, covering 2024. (checked 2026-10-08)
FBI, CISA and partner agencies, #StopRansomware: Akira Ransomware, advisory AA24-109A, April 18, 2024, updated November 13, 2025. (checked 2026-10-08)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.