Why PunchThru

The front door is where attackers knock.

For a small business, letting people work from home has usually meant one of two things: opening Remote Desktop to the internet, or buying a VPN box for the office. The incident reports of the last two years say the same thing again and again. That front door is exactly how attackers get in.

Every figure on this page comes from a named report, listed at the bottom with links. Last checked November 2026.

1. Remote access is the way in

Every year, Sophos publishes what its incident response team finds when it is called in to investigate a break-in. These aren't the millions of attacks Sophos's software blocks every day; they're 413 real intrusions at companies in 2024, each one taken apart to see how the attackers got in. In those cases, attackers got their first foothold through "external remote services" (VPNs, Remote Desktop and similar) in 71% of cases. Remote Desktop itself was abused in 84% of the attacks [1].

The reason is simple. A Remote Desktop port open to the internet, or a VPN login page, is a door that anyone on earth can walk up to and try. Attackers don't need to trick anyone. They try stolen passwords, guess weak ones, or use a flaw in the box itself.

Stolen passwords top the list, and the next report shows why that matters: in 59% of the incidents, the victim had no two-step sign-in on the accounts that were used, or it wasn't set up fully [2]. Coveware, which negotiates with ransomware gangs for victims, reports the same pattern: in the third quarter of 2025, remote access compromise was "the dominant vector, accounting for more than half of all observed incidents" [7].

2. Small businesses get hit hardest

It is tempting to think attackers only go after big companies. Verizon's breach report, the largest study of its kind, says otherwise. Ransomware was present in 88% of breaches at small and mid-sized businesses, more than twice the rate at large organizations [3].

Small businesses are attractive precisely because they rarely have someone watching the network around the clock, and the same remote access setups (a forwarded port, a VPN appliance installed years ago) tend to stay in place long after anyone last checked them.

3. The VPN box became the target

The usual advice used to be "don't expose Remote Desktop, put a VPN in front of it." Attackers adapted. In Verizon's 2025 report, VPNs and other edge devices made up 22% of the systems attackers exploited, up from 3% a year earlier, nearly eight times as many. Only about 54% of those flaws were fully fixed during the year, and fixing them took a median of 32 days [3]. By the 2026 report, exploiting a security flaw had become the single most common way into a company, at 31% of breaches [4].

The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a list of security flaws that are being actively used in real attacks. The VPN and firewall makers small businesses buy from appear on it year after year, and every one of the flaws below is marked as used in ransomware campaigns [5]:

Year each flaw was added to CISA's Known Exploited Vulnerabilities catalog. VPN, firewall and Remote Desktop products only; every one is marked "known ransomware use".

4. Once inside, they move fast

A traditional VPN puts a remote user on the office network, as if they were sitting at a desk. That's convenient, and it's exactly what an attacker wants too. Once in, attackers use Remote Desktop to hop from machine to machine: Sophos saw it used inside the network in 83% of cases [1], and Coveware saw attackers move sideways like this in 73% of incidents [7]. The median time from getting in to reaching a company's central login server (Active Directory) was just 3.4 hours [2].

This is why US government guidance has moved away from "inside the network means trusted." NIST's Zero Trust Architecture says there should be "no implicit trust granted to assets or user accounts based solely on their physical or network location" [8], and in 2024 CISA and its partners urged businesses "of all sizes" to move toward zero trust access instead of traditional remote access [9].

5. How PunchThru is different

• Nothing open to the internet. The office computer connects out to PunchThru and waits. There's no Remote Desktop port and no VPN login page for anyone to find or attack, and nothing to set up on the router.
• No VPN box to patch. There's no appliance in the office to fall behind on updates, the very thing behind most of the flaws in section 3.
• Only the computers you allow. Each person is given access to specific computers, not the whole network, in line with the zero trust approach NIST and CISA recommend.
• Two-step sign-in. Accounts can be required to use a code from an authenticator app, the protection missing in most of the incidents above.
• Encrypted end to end. Every connection is protected with WireGuard encryption, from the remote computer all the way to the office computer.
• Remote Desktop locked down. You can switch on a lockdown that blocks Remote Desktop from the network on each office computer, so the only way to reach it is through PunchThru.

6. Remote work isn't going away

In March 2026, 22.6% of all US workers teleworked [11]. Among people whose job can be done remotely, only about one in five now works fully on site [10]. Remote access is no longer an occasional convenience for the boss. It's how most office staff work, so it has to be safe by design.