If a VPN is not carefully planned, designed, and configured, vulnerabilities may occur that impair all the IT systems connected to it. Attackers will thus be able to access confidential information of the corresponding organisation.

For example, inadequate VPN planning can mean that users have not been properly trained. They could thus use a VPN in an insecure environment or connect to one from insecure clients. This in turn may enable attackers to access the respective organisation's entire network.

Attacks may also be detected too late if regular checks of VPN access have not been inadequately planned. It will thus not be possible to respond in time, and an attacker may steal data or sabotage entire processes without being detected.