Depending on the type of VPN appliance or service used, VPN logs can provide detailed records of user activity. These logs typically include information such as user IDs, device types, IP addresses, and connection timestamps. By analyzing VPN logs, security teams can identify deviations from normal usage patterns, such as connections from unusual geographic locations, access during odd hours, or unusually large data transfers. Anomalies in VPN usage can serve as early indicators of suspicious behavior, potentially signaling attempts at data exfiltration or other unauthorized activities. Alerts triggered by these irregularities allow for further investigation to assess potential threats.

Sections

ID	Name	Description
IF020	Unauthorized VPN Client	The subject installs and uses an unapproved VPN client, potentially violating organizational policy. By using a VPN service not controlled by the organization, the subject can bypass security controls, reducing the security team’s visibility into network activity conducted through the unauthorized VPN. This could lead to significant security risks, as monitoring and detection mechanisms are circumvented.
IF002.010	Exfiltration via Bring Your Own Device (BYOD)	A subject connects their personal device, under a Bring Your Own Device (BYOD) policy, to organization resources, such as on-premises systems or cloud-based platforms. By leveraging this access, the subject exfiltrates sensitive or confidential data. This unauthorized data transfer can occur through various means, including copying files to the personal device, sending data via email, or using cloud storage services.
MT017.001	Nation-State Alignment	The subject is a current or former asset of a nation-state intelligence service, operating inside the organization with pre-existing loyalty to, or direct affiliation with, a foreign government. Unlike insiders who develop espionage motives post-employment, this subject is often inserted, recruited prior to hiring, or cultivated externally over time and then encouraged to seek access to a target organization. Their motive is the advancement of strategic objectives on behalf of a foreign nation-state. These objectives may include extracting sensitive information, degrading operational resilience, manipulating internal systems or decisions, weakening public or partner trust, or embedding long-term access for future exploitation. Such subjects may be formal intelligence officers, contract operatives, ideological affiliates, or individuals acting under recruitment, coercion, or influence. Example Scenarios: A subject recruited during university by a foreign security service secures a role in a telecommunications provider and enables covert surveillance access for state-level eavesdropping. A subject hired into a biopharmaceutical firm has pre-existing links to a state-sponsored “talent program” and transfers research data to affiliated institutions abroad via covert cloud channels.