VPN Security Checklist for Small Teams

A VPN is one gate, not a wall — and the breaches that start at VPNs are almost never about the encryption. They are a stolen password without MFA, an unpatched appliance, or a contractor account nobody turned off. The honest checklist has five parts: MFA on every account, patch the concentrator like a server, decide the tunnel mode in writing, give each group the least access that works, and retire every account that no longer has a human.

1. What the VPN actually protects (say it honestly)

The VPN encrypts traffic and puts remote people on the office network. It does not fix a compromised laptop, a phished admin, or an appliance running last year's firmware:

Say the honest version out loud once: the VPN moves your perimeter from the office wall to every laptop and every credential. The rest of the checklist lives there.

2. MFA on every VPN account — including the one you forgot

• MFA on every human login — TOTP app or passkeys; SMS-only is a pass for nobody, and a hard no for admins.
• The vendor/support account counts. Most VPN appliances ship with a support or maintenance login. It gets MFA, a renamed ID, and a password in the password manager — or it gets disabled in writing.
• Shared accounts do not exist on the VPN. One credential per human; the shared "office" login is the account that outlives every employee who knew the password.
• Alert on new-device logins and lock out after repeated failures. The alert nobody reads is the MFA you already paid for.

3. Patch the concentrator like a server, not like a toaster

VPN gateways are the single most profitable class of breach entry point of recent years — the same four vendors appear in every headline, and the cause is almost always a patch that sat for weeks. Three rules:

• It is a server. Enroll the appliance in the patch cadence (emergency lane within 24 hours for a CVE that is being exploited in the wild — see the patch cadence calendar).
• The management interface does not face the internet. Not even "temporarily". Admin UI exposed is the lock on the outside of the door.
• Check end-of-life once a year. An appliance past EOL is an unpatchable risk wearing a badge — budget the replacement before it becomes the incident.

4. Full tunnel vs split tunnel — decided in writing, not by default

The default answer changes per role, and the reasoning should be one sentence per group:

Verify the setting, not the intention: run one route check per group each quarter and confirm the client routes what you think it routes.

5. Least privilege: the network behind the VPN is not all yours to give

• Group-based access: finance gets the finance systems, not the prod servers. Map each VPN group to firewall rules or VLANs — one page, four groups is enough for most small teams.
• Vendor accounts get one destination. The printer vendor reaches the printer management port and nothing else, and the account expires on a date you chose.
• No standing admin access for anyone who does not administer that system weekly.
• The quarterly check: export the VPN user list, match it against current staff, and delete the delta the same day (see the user access review).

6. The accounts you forgot are the breach

The accounts that cause incidents are rarely new ones. Hunt for: vendor support logins, ex-contractor accounts, ex-employee phones still enrolled in TOTP, service accounts that authenticate to the VPN (why does a backup job need a tunnel?), and the "office" shared login from before you knew better. Offboarding revokes VPN access in the same hour it revokes email — it is the first credential a disgruntled ex-colleague tries.

7. Client-side basics (what the user's laptop owes you)

• Kill switch on: no traffic outside the tunnel when it drops — silent fail-open turns your VPN into a decoration.
• Auto-connect on untrusted Wi-Fi; managed devices get it enforced by policy, not by memory.
• Client updates ride the normal patch wave — a VPN client two versions behind is the same risk as the appliance.
• Travel devices follow the travel rules (see the travel security checklist) — the VPN is one layer of that bag.

8. The five signals worth alerting on

• Auth failures per user above normal — password guessing shows here first.
• New device or new geo on any account — verify once, then trust the device.
• Appliance config changes outside the maintenance window.
• Concurrent sessions from different countries — usually a shared account confessing.
• Login by a dormant account (90+ days silent) — dormant then active is the classic takeover signature.

9. The quarterly VPN review card