For two decades, the recipe for supporting a remote user never changed: get them on the VPN, remote into the machine, fix the thing, disconnect. NetworkWorld's recent piece "Is it time to retire VPNs?" makes the case that this recipe has quietly become the biggest liability on the network. Ransomware groups like Qilin and Settra are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto's PAN-OS GlobalProtect and Prisma Access, to create unauthorized VPN sessions and then move laterally across victim networks using ordinary admin tooling.
Here's the part that should make every IT manager and MSP owner squirm: the VPN isn't just the attacker's favorite door — it's ours too. It's how technicians reach endpoints, run scripts, pull logs, and push patches. We have wired our entire remote management workflow into the single piece of infrastructure that threat actors compromise first.
And when that asset gets a pre-authentication bypass disclosed on a Thursday afternoon, your team spends the weekend patching firewalls while the helpdesk queue fills up with users you can't reach — because the only path to their machines runs through the thing you just had to take offline.
The Problem in Depth
The VPN model is the opposite of zero trust — and management traffic is the worst offender
Zero trust says make systems invisible and never grant broad network access. A VPN does the reverse. The moment a technician authenticates, they're on the network: routes to the domain controllers, the file servers, every printer, the management interfaces on the switches. A tech who connected to fix one workstation's spooler is two commands away from everything. The blast radius of one stolen technician credential isn't one laptop — it's the entire flat network behind the concentrator.
Your tool chain is welded to the tunnel
Look at a typical mid-size IT stack: NinjaOne or ConnectWise RMM for scripts and remote sessions, a standalone monitor like PRTG or Zabbix, a separate helpdesk, and a VPN client gluing it all together. When the tools are siloed, the dependencies hide in plain sight:
- Monitoring agents that report through the tunnel go dark the moment the tunnel does.
- RMM gateways installed inside client LANs become yet another set of appliances to patch and harden.
- The helpdesk can't attach a remote session to a ticket because the tech can't reach the machine.
The result is the worst possible timing: during the exact window when you most need visibility — active exploitation of your perimeter — your tooling is blind. Monitoring without management is a smoke detector you can't reach. Management without monitoring is fixing things you didn't know were broken.
MSP math makes it worse
Forty clients. Each one with a site-to-site tunnel, a user VPN, maybe a jump box in the rack. Every tunnel is attack surface. Every technician credential reused across five client portals is lateral-movement bait. And when a GlobalProtect-grade bypass drops, you're patching forty PAN-OS appliances over a weekend with a skeleton crew while tickets slip and SLA reports get cobbled together from three systems with three different clocks.
A scenario every MSP tech will recognize: Monday morning, a client calls — the payroll application is down. The VPN console is in change-freeze pending the security patch. The tech asks the user to connect to the VPN so they can run diagnostics... which is precisely the step the security team just blocked. The ticket sits for six hours, the SLA blows, and the monitoring tool never fired an alert because its collector rode the same dead tunnel. Nobody touched a single broken endpoint all morning.
How AlertMonitor Solves This
Outbound-only agents: management without an attack surface
Every managed endpoint runs a lightweight AlertMonitor agent that initiates an outbound connection. No inbound firewall ports, no gateway appliance sitting inside the client LAN, nothing internet-facing for an attacker to CVE next quarter. Whether the endpoint is at HQ, in a home office, or on a client site, the management path is identical. Critically: when you take the VPN down for emergency patching, your remote management keeps working — because it never depended on the VPN in the first place.
Per-device access instead of per-network access
This is zero trust applied to management access. A technician opens a remote session to the specific device, authenticated and fully logged — not "onto the client's network." For MSPs, client segmentation means a tech gets the devices they're authorized for and nothing else. The blast radius of one compromised credential becomes a defined device list, not a flat LAN.
Scripts, sessions, and monitoring in one timeline
AlertMonitor's script runner targets one endpoint or an entire device group — "all Windows 11 laptops at Client A." Results feed back into the monitoring data, right next to the alerts that prompted the action. Automated remediations and manual technician actions land in the same record. That's your audit trail for compliance, and it means no more tab-switching between the RMM, the monitor, the helpdesk, and a Notepad file of "what we did." Ticket → session → script → patch → resolution, in one timeline.
Patching decoupled from the network
Because the agent handles patch delivery, endpoints patch wherever they are — home, branch, or HQ. Patch cadence is no longer hostage to VPN health or "on-network" maintenance windows.
The workflow, side by side
Old way: ticket arrives in the helpdesk → open the VPN client → hope the tunnel is up → RDP over the VPN → open a separate RMM to run a script → copy results back into the ticket → verify against a separate monitoring tool. Six tools, roughly forty minutes, zero unified record.
AlertMonitor: ticket arrives → open a remote session from the same console → run the script → the agent reports results straight into the timeline → close the ticket. Minutes, with a complete audit trail.
Practical Steps You Can Take This Week
1. Audit what you actually do over the VPN. Pull a month of VPN session logs and categorize them: remote sessions, script execution, patch pushes, file transfers, versus genuine network-level application access. The first four categories are endpoint management — they all move cleanly to an agent-based model.
2. Close your agent coverage gaps. You can't retire the VPN from your management workflow if 15% of endpoints still have no agent. Get to 100% coverage, including the Windows Server boxes that "never leave the rack."
3. Build a tunnel-down runbook. These are scripts you should be able to fire through the AlertMonitor script engine today. The agent executes them locally — no WinRM, no RDP, no VPN required:
# Windows: quick patch compliance snapshot — the agent returns the 10 most recent hotfixes
Get-HotFix |
Sort-Object InstalledOn -Descending |
Select-Object -First 10 HotFixID, Description, InstalledOn
# Windows: disk usage snapshot — target any device group, every agent reports back locally
Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" |
Select-Object DeviceID,
@{n='SizeGB'; e={[math]::Round($_.Size/1GB,1)}},
@{n='FreeGB'; e={[math]::Round($_.FreeSpace/1GB,1)}},
@{n='FreePct'; e={[math]::Round(($_.FreeSpace/$_.Size)*100,1)}}
# Windows: restart the print spooler from the script runner — no VPN hop, no RDP session
Restart-Service -Name "Spooler" -Force
Get-Service -Name "Spooler" | Select-Object Name, Status
# Linux: verify the agent channel is active and list pending package updates
systemctl is-active alertmonitor-agent
apt list --upgradable 2>/dev/null | head -15
4. Shrink the VPN to what genuinely needs network-level access. Once endpoint management moves to the agent, what's left over the VPN should be a short list of specific application subnets. That's a radically smaller surface to patch, monitor, and enforce MFA on.
5. Verify the audit trail before the auditors do. Confirm that remote sessions, script executions, and patch installs all land in one timeline. If your techs are reconstructing "what we touched" from memory after an incident, that's the tool sprawl talking.
The Bottom Line
Zero trust isn't a SKU you buy — it's the removal of broad network access from daily operations, and management traffic is the best place to start. You control that traffic entirely, the agent model removes the attack surface instead of defending it, and you feel the benefit the next time a GlobalProtect-grade CVE drops on a Friday: your techs keep working, your endpoints keep reporting, and your VPN shrinks from mission-critical chokepoint to a small, boring, well-patched remnant.
Related Resources
AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.