A patched VPN or a well-trained employee cannot be the only barrier between an intruder and an entire network. PacketWatch’s November 2 briefing uses two hypothetical intrusions to examine the controls that should still hold after initial access.
Start from the foothold
Its first scenario imagines an attacker exploiting a VPN appliance before a patch is available. PacketWatch asks what that device can reach, which credentials it holds and whether internal applications demand additional authentication. Limiting those permissions can keep a compromised appliance from becoming a direct route to privileged systems.
The second scenario starts with a fake IT-support call that persuades an HR employee to install AnyDesk. Here, the review turns to unauthorized remote-management software, application controls and the employee’s access rights. These are exercises for testing defenses, not reports that the imagined organizations were attacked.
Keep the edge secure
The Australian Signals Directorate’s edge-device guidance, published in February 2025, provides a useful maintenance baseline: inventory appliances, replace unsupported equipment, apply updates and vendor settings, restrict management access, and monitor activity. Planning for compromise complements that work; it does not make patching or secure configuration optional.
Check the next connection
The UK’s National Cyber Security Centre says access should be authorized before a connection is established. Being on the corporate network or connected through a VPN should not be enough. Users should reach only the resources they are permitted to use, with decisions informed by identity, device health and other signals.
NCSC also stresses that zero trust network access does not replace internal segmentation. Firewalls and access rules still constrain movement after entry. Centralized records of successful and denied requests then help investigators understand which identity reached which application, and why the connection was allowed.
Sources: PacketWatch: November 2 threat intelligence briefing; ASD: edge-device practitioner guidance; NCSC: how to implement ZTNA.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
