In their default setting, VPN components are usually preconfigured with insufficient security mechanisms (or none at all). In many cases, the manufacturers pay more attention to user-friendliness and problem-free integration into existing systems than they do to security. If VPN components are insufficiently adapted to the actual security requirements of a given organisation, this will create vulnerabilities and corresponding points of attack. If, for example, passwords preset by a manufacturer are not changed, an entire VPN (and thus the internal network of the corresponding organisation) could be attacked.