Home / Security
SECURITYRedesigned from the ground up
to address why VPNs get targeted.
You may have seen news about VPN devices being attacked. There are specific, well-documented reasons for that. ForceLink is designed to reduce those attack vectors at the architecture level.
Four reasons VPNs get targeted.
Weakness 1 — The device is directly exposed on the internet
Serious vulnerabilities in legacy VPN appliances have led to a significant number of incidents.
ForceLink: The admin console is not exposed to the internet. Only the minimum necessary entry point is published, keeping the exposed attack surface small by design.
Weakness 2 — Cross-tenant blast radius / overly broad access
A single compromised device can enable lateral movement and spread the impact.
ForceLink: Each company gets an isolated network. Tenant traffic does not mix, reducing the risk of cross-tenant incidents.
Weakness 3 — Password-only access
If credentials are stolen, an attacker can connect as a legitimate user.
ForceLink: The tunnel is not opened with a password. Your private key is generated inside your PC and never leaves it (with the standard dedicated Windows app).
Weakness 4 — The full LAN is reachable after VPN connection
Legacy VPNs tend to allow a connected user to reach everything on the internal network — one compromised endpoint can lead to lateral movement across the organization.
ForceLink: The goal is least-privilege access after connection. The internal resource and route control (Secure Route Control) means that even after a VPN connection is established, the full office LAN is not opened — the ForceLink BOX enforces per-user access to only the internal PCs, servers, and NAS units each user needs (at the destination IP, port, and protocol level). In the event of a compromised endpoint, this design helps limit how far lateral movement can spread.
Why legacy VPNs attract attackers.
As remote work became widespread, VPNs enabling secure access from outside the office network proliferated rapidly. At the same time, reports of unauthorized access and ransomware incidents using VPN devices as the entry point have increased. There are three main reasons why a tool designed to be helpful gets described as "dangerous."
1. The device is exposed on the internet
Most VPNs require the VPN appliance (a router or gateway) to be published on the internet so it can accept inbound connections. Once published, connection attempts can arrive from anywhere in the world. If known vulnerabilities are left unpatched, those become potential entry points. Incidents where known vulnerabilities were exploited have been reported both domestically and internationally.
2. Password-only access
Configurations that accept only an ID and password mean that if credentials are leaked or reused, an attacker can impersonate a legitimate user and connect. Passwords extracted through phishing or past data breaches being misused is not uncommon.
3. Connecting means reaching the entire internal network
Traditional VPNs often leave the full office LAN visible once a connection is established. If one endpoint or account is compromised, the attacker can use it as a pivot point to perform lateral movement through the internal network, rapidly expanding the blast radius. The fact that the attacker can reach servers the user has no business accessing is a key enabler of damage escalation.
ForceLink is a remote access product designed not to pile on features arbitrarily, but to reduce those attack vectors at the design level. The guiding principles are: keep the admin console off the public internet; use key-based connections; isolate each tenant's network; limit each user to only the internal resources they need. (We do not claim "absolute security." We communicate honestly about the scope of protection and what is planned for the future.)
For definitions of VPN, zero trust, SASE, and related terms — see the glossary
Your private key never leaves your PC.
With the standard dedicated Windows app, the key pair is generated on the PC. Only the public key is sent to the cloud; the private key stays on the device.
Staff's PC (inside the device)
Cloud
Even if the cloud were somehow accessed by an unauthorized party, your private key cannot be extracted from there.
Note: The Mac/iPhone/Android case-by-case path uses a different method in which the administrator securely issues a configuration file (displayed once and not stored). The key-stay-local property described above applies specifically to the standard dedicated Windows app.
Limiting which internal resources each user can reach.
Administrators can configure, on the ForceLink BOX side, "who is allowed to access which internal resources (servers and ports)." For example, "accounting staff can only reach the accounting server." Access is enforced by the device, so staff cannot change it on their own. This is particularly relevant for industries that handle sensitive information, such as legal and medical practices.
Control is at the destination IP, port, and protocol level — application names and business systems are not auto-identified. Users with a policy applied are limited to only the permitted destinations; users without a policy can reach the full office LAN as before (the administrator configures policies incrementally).
A balanced look at the options.
We do not claim to be superior to full SASE. ForceLink is designed to address the well-known weaknesses of legacy VPNs, without the overhead and cost of a full SASE deployment — a different point on the spectrum.
| Legacy VPN | ForceLink | Full SASE | |
|---|---|---|---|
| Device exposed on the internet | Yes (an attack target) | Admin console not publicly exposed | No |
| Authentication method | Password-centric | Key-based (standard Windows: key generated on device) | Identity + MFA etc. |
| Deployment effort / scale | Heavy | Place BOX + distribute codes | Large-scale |
| Access control granularity | Full network | Per-user, per-destination (IP, port, protocol) | Per-app (finest-grained) |
| Operational practicality | △ | ◎ | High cost |
We do not cover everything a full SASE product covers.
ForceLink is a VPN redesigned for the modern threat landscape. It uses modern cryptography and addresses the design-level weaknesses common in legacy VPNs. It does not cover the full feature set of enterprise SASE products (web filtering, etc.), but it is designed to deliver secure access to internal systems without unnecessary complexity.
Common questions about security.
Is VPN inherently dangerous?
VPN itself is not inherently dangerous. The problems lie in specific design and operational choices: leaving a device publicly exposed on the internet with unpatched vulnerabilities, allowing access with only a password, or permitting a connected user to reach the entire internal LAN. ForceLink addresses these weaknesses at the design level — the admin console is not publicly exposed, connections are key-based, and each user is limited to the internal resources they actually need.
What is key-based authentication? How does it differ from password-based access?
Password-based access is essentially a shared passphrase — if the passphrase leaks, anyone who obtains it can connect. Key-based authentication verifies the user's identity using a cryptographic key pair unique to their device. With the standard dedicated Windows app, the private key is generated inside the device and never leaves it; only the public key is sent to the cloud. This design helps prevent impersonation via credential theft.
What does "not exposing the full office LAN" mean?
Traditional VPNs typically allow a connected user to reach the entire internal network, which means a single compromised endpoint can become a launchpad for lateral movement. ForceLink's internal resource and route control lets you limit, per user, which internal PCs, servers, and NAS units are reachable — enforced by the ForceLink BOX (at the destination IP, port, and protocol level). Resources the user has no business accessing are simply not reachable.
Is the communication encrypted? Which segment?
The VPN segment from the staff member's PC to the ForceLink BOX in the office is encrypted using modern cryptographic techniques. ForceLink's role is to protect the contents of that segment from being read in transit over the internet. Communication within the office LAN depends on the protocols of each individual system.
Does ForceLink support multi-factor authentication (MFA)?
VPN connections use key-based authentication. MFA is not currently supported; support is under consideration. If IdP/IDaaS federation or an organization-wide zero-trust platform is a hard requirement, a full-scale ZTNA/SASE solution would be a better fit.
Is ForceLink a "zero-trust" solution?
We do not claim to deliver complete zero trust. However, features such as the internal resource and route control — which limits each user to only the internal resources they need — reflect the principle of least-privilege access, designed to be practical to introduce and operate. We also do not claim "absolute security." We communicate honestly about what the product does today and what is planned for the future.
We're happy to walk through the security design in detail.
"How does this protect our specific environment?" — We can discuss that concretely in a free consultation. Technical questions are welcome.