After FortiBleed: Is It Time to Replace Your VPN?
This month the FBI and Secret Service warned that attackers hold working credentials for more than 86,000 Fortinet firewalls and VPNs. They got them with passwords, not a new exploit. For many small businesses, that VPN is the one door to everything.
October 2026
On October 6, the FBI and U.S. Secret Service issued an advisory on a campaign researchers call FortiBleed. The attackers collected credentials for more than 86,000 Fortinet devices in 194 countries. Once inside, they created their own admin accounts, sometimes changed or deleted the owner's accounts to lock them out, and moved on into Active Directory. Researchers have tied the access to ransomware groups including INC, Lynx and Payload, and the threat intelligence firm SOCRadar has confirmed at least 12 ransomware deployments that started this way.
The uncomfortable part is how they got in. The advisory names no new vulnerability. The attackers used reused and leaked passwords, password spraying, credentials pulled from infostealer logs, and offline cracking of weakly stored password hashes.
Fortinet isn't alone. In the same month, attackers began exploiting an authentication bypass in Ivanti Connect Secure VPN appliances (CVE-2026-104935), first observed by Volexity on October 3. CISA gave federal agencies until October 16 to patch. Whether the way in is a stolen password or a brand-new flaw, the internet-facing VPN keeps showing up as the starting point.
October is Cybersecurity Awareness Month, and this year the National Cybersecurity Alliance's theme is "Don't Make It Easy for Them." A VPN login page on the open internet, protected by a password someone has used before, is about as easy as it gets.
If you run a FortiGate, or any VPN, do this now
These steps come from the FBI, CISA and the researchers tracking FortiBleed. Hand this list to whoever manages your firewall.
End active sessions and change the passwords
Terminate every active SSL VPN and administrative session, then reset all VPN and admin passwords. A password change alone doesn't kick out someone already connected.
Look for admin accounts you didn't create
The advisory lists account names the attackers commonly add, including "fortiAdmin," "forticloud-sync," "support_fortinet," "adminsslvpn" and "itadmin." Review every local and API account on the device.
Take the admin page off the internet
The firewall's management interface should never be reachable from the open internet. Restrict it to a short list of trusted addresses.
Require phishing-resistant MFA
Put strong multifactor authentication on VPN and admin logins. A stolen password should never be enough on its own.
Fix how admin passwords are stored and update firmware
CISA recommends storing administrator credentials with PBKDF2 rather than legacy hashing. Bring the firmware current while you are in there.
Read the logs
Check for VPN logins at odd hours or from unexpected countries, configuration changes nobody made, and new accounts.
If you find an account you didn't create, don't just delete it and move on. The attacker may already be past the firewall. Isolate the device, preserve its logs, report it to the FBI at ic3.gov, and treat it as a security incident. Our incident response team can help.
Why VPNs keep getting hit
It puts a login page on the internet
Anyone in the world can try passwords against it, around the clock. Password spraying and leaked credential lists are cheap, and FortiBleed shows they work at scale.
One login opens the whole network
A traditional VPN usually drops the user onto the network itself. That is how FortiBleed attackers moved from the firewall into Active Directory and file shares.
It is another box to patch and watch
VPN appliances are often set up once and forgotten. When a critical flaw lands, as it did for Ivanti this month, someone has to notice and patch it within days.
It sits outside your identity controls
Your Microsoft 365 sign-ins may require MFA, a managed device and a low-risk location. The VPN often checks none of that, so it becomes the weakest way in.
What Microsoft Global Secure Access does differently
Global Secure Access is Microsoft's cloud network security service, and Microsoft positions it as a core part of a SASE (Secure Access Service Edge) strategy. It has two main pieces. Microsoft Entra Private Access replaces the VPN for reaching internal file shares and applications. Microsoft Entra Internet Access protects users as they browse the web and use SaaS and AI tools.
With Private Access, a laptop doesn't connect to a box in your office. The Global Secure Access client on the device sends traffic into Microsoft's network, and a small connector running inside your network carries it the rest of the way:
No inbound port for remote access
The connector only makes outbound connections, so you no longer publish a VPN login page to the internet.
Every connection checks Conditional Access
The same policies that protect Microsoft 365, such as MFA, compliant devices and sign-in risk, apply before anyone reaches an internal app.
Access to apps, not the whole network
You can narrow access so each person reaches only the servers and ports they need. That stops one compromised account from scanning and spreading.
Access ends when risk changes
Universal Continuous Access Evaluation lets access be revoked quickly when an account is disabled or flagged as risky, without waiting for a session to expire.
Single sign-on to on-premises resources
Kerberos single sign-on lets users reach file shares and Active Directory-based apps without extra prompts.
Web and AI protection with Internet Access
The Internet Access add-on brings web content filtering, threat intelligence, TLS inspection, shadow AI discovery and prompt injection protection.
What it costs
Every option requires Microsoft Entra ID P1, which is already included in Microsoft 365 Business Premium, E3 and E5. These are Microsoft's U.S. list prices at the time of writing, billed annually.
Microsoft Entra ID P1 (included in Business Premium)
Microsoft traffic profile and Universal Conditional Access for Microsoft 365 traffic.
Microsoft Entra Private Access
VPN replacement, per-app access, app discovery, private DNS and single sign-on.
Microsoft Entra Internet Access
Secure web gateway, web filtering, TLS inspection, threat intelligence and AI controls.
Microsoft Entra Suite
Private Access and Internet Access together, plus additional Entra identity features.
Compare that against your VPN appliance's support contract, the hours spent patching it, and what a single compromised VPN account costs if it leads to ransomware.
How we roll it out
Microsoft's own guidance is to start by matching what the VPN does today, then tighten it. That means nobody loses access on day one, and the VPN stays available as a fallback until the pilot proves out.
Map what the VPN is used for
File shares, line-of-business apps, remote desktop, printers: who uses what, and from where.
Get identity right first
MFA, Conditional Access and Intune device compliance need to be solid, because they become the gate in front of every internal resource.
Install connectors
At least two private network connectors inside your network for redundancy, so a single server reboot doesn't cut off remote staff.
Pilot with Quick Access
A small group gets the same reach they had on the VPN, through Global Secure Access instead. The VPN stays available as a fallback.
Tighten to per-app access
Application Discovery shows what people actually connect to. We use it to replace broad network access with access to specific apps.
Retire the VPN
Once everyone is moved over, the VPN service is switched off and its port closed. The firewall goes back to protecting the office network.
Is it right for your business?
A strong fit if you
- Already run Microsoft 365, especially Business Premium.
- Have file servers or internal apps that remote staff need.
- Manage company laptops with Intune, or plan to.
- Have a VPN appliance that is due for renewal or replacement.
Plan carefully if you
- Rely on older applications that haven't been tested through a connector.
- Have devices you can't install the Global Secure Access client on.
- Need site-to-site links between offices, which are a separate design decision.
- Have no clear inventory of what lives on your internal network yet.
Frequently asked questions
Does Microsoft Global Secure Access replace our firewall?
No. It replaces the remote-access VPN. You still need a firewall to protect the office network itself. What goes away is the VPN login page on the internet and the broad network access it hands out.
Is Microsoft Entra Private Access included in Microsoft 365 Business Premium?
No. Business Premium includes Microsoft Entra ID P1, which is the prerequisite and covers the Microsoft traffic profile. Private Access is an add-on at $5 per user per month, or part of the Microsoft Entra Suite at $12 per user per month, at Microsoft's current U.S. list prices.
We don't use Fortinet. Does FortiBleed matter to us?
Yes. FortiBleed worked because of reused passwords and an internet-facing login, not because of anything unique to Fortinet. Any VPN or firewall login exposed to the internet faces the same attack, and Ivanti VPN appliances were hit by a separate flaw the same month.
Can we run Global Secure Access alongside our VPN during the transition?
Yes, and that is how we recommend doing it. Microsoft's guidance is to start with Quick Access, which mirrors what the VPN provides, while the VPN stays available as a fallback until the pilot group is confident.
What is the difference between SASE, SSE and ZTNA?
Zero Trust Network Access (ZTNA) grants access to specific applications based on identity and device, instead of putting users on the network. That is what Entra Private Access does. Security Service Edge (SSE) adds web and SaaS protection, which is Entra Internet Access. SASE combines those security services with networking, all delivered from the cloud.
Not sure how exposed your VPN is?
We'll look at what's facing the internet, check your firewall and VPN against the FortiBleed guidance, and tell you whether Global Secure Access makes sense for your business.
Related Services & Resources
Cloud Security
Identity, Conditional Access and Microsoft cloud configuration hardening.
ServiceVulnerability Management
Find and fix exposed devices and unpatched systems before attackers do.
ArticleSecuring Hybrid and Remote Work
Why identity, not the network edge, is the new security perimeter.
Victor Peralta
Co-Founder & CEO
Vigil Cyber provides 24/7 managed security operations for small and mid-sized businesses across the Southeast. Our team combines rigorous operational discipline with enterprise security expertise.
Related Articles
Leaving GoDaddy's Microsoft 365: How to Move to Microsoft Without Losing Email
Bought Microsoft 365 through GoDaddy? How to move your tenant to Microsoft or a Microsoft partner, keep your mailboxes, and avoid the mistakes that delete data.
8 min read
StrategyMoving From Google Workspace to Microsoft 365: What to Plan For
What Microsoft's migration tools move, what they leave behind, the gotchas that cause downtime, and how to secure the new tenant on day one.
9 min read
StrategyConsolidating Your Security Stack
Too many tools create visibility gaps. Learn how to consolidate your security stack for better protection and lower costs.
6 min read
Stay Ahead of the Threat Landscape
Get monthly cybersecurity insights, threat intelligence, and compliance updates delivered to your inbox. No spam. Unsubscribe anytime.