One issue is that many organizations still run their VPN servers with only single-factor authentication. Even if patches are in place, attackers can still access networks using stolen, but valid credentials, says Tim Wade, technical director of the CTO team at Vectra.