Stolen VPN Login Case Study: Rules Learned From Two Weeks of Traffic Stop 136 of 144 Attempts

Someone logs in to a company VPN as Alice from finance, with her stolen password, and tries 12 internal systems on 12 common ports. On a flat VPN all 144 attempts get through. Under rules Scope learned from two weeks of the company’s own traffic, 136 were stopped.

This was Scope, VPN Works’ engine for company VPNs, in version 0.2.0. Its demo office had 30 people in five teams using 12 internal systems, generated from a fixed seed so the same numbers come out every time. Scope read 20,232 connections from two weeks, kept no content, and drafted 39 team rules, 11 personal rules and 3 destinations for a person to review. Before anything was enforced, it replayed the following week against the draft: 12 of 10,387 connections would have been blocked, and both causes were worth a look.

What Got Through

The 8 attempts that got through reached the 6 systems Alice really uses, on the ports she uses: dns, mail, intranet, files, erp and payroll. The other six, from git to the backups, refused every attempt. Rules learned from behavior can’t tell a thief from the owner on the owner’s own systems. They take away everything else, and on a flat VPN, everything else is most of the damage.

Where Scope Is Now

VPN Works was rebuilt in October 2026 as one core with plugins, and Scope’s job maps cleanly onto it: read recorded traffic, write rules for a person to review. That’s an Advisor plugin. What it needs first is gateway mode, where vpnw takes the connections of every device behind a machine instead of one program’s. Scope comes back as an Advisor for gateway mode. Scope · Roadmap