If an organisation uses a VPN service provider that was not selected carefully, it could threaten the security of the organisation's entire network. The service provider's VPN access may not be secure, for example, and could thus be used by attackers to steal specific information.