Hey everyone, I wanted to share a recent experience and get your thoughts. Our security team just completed a quarterly tool review and raised a red flag about NordLayer’s ‘auto-connect’ feature. They’re calling it a potential lateral movement risk.
Their argument is that if a corporate device with NordLayer installed is compromised (say, a stolen laptop or malware), the auto-connect could actually help an attacker maintain access to our internal network resources. Instead of the connection dropping when the VPN disconnects, it would just silently reconnect, potentially keeping the door open. They'd prefer a system where connecting requires a manual step or at least a re-authentication prompt, adding a layer of intentionality.
I’ve always loved the convenience of auto-connect for our remote team—it’s one less thing to worry about for onboarding and daily use. But I see their point on the security side.
* Have any of you had similar feedback from your security folks?
* Is there a way to balance this in NordLayer's settings that we might have missed?
* Does this change how you view it compared to other business VPNs like Perimeter 81 or Twingate?
Would really appreciate your insights or any workflows you've set up to mitigate this.
Always testing.