Exhibit A(I): The VPN Patch Is Not the Control
A GlobalProtect exploit is not only a patching issue. It is an identity, evidence, and governance control failure.
A critical Palo Alto GlobalProtect VPN flaw is now reportedly being used by the Qilin ransomware gang in active intrusions.
That sentence sounds like a patching story. It is not.
It is an identity story, an edge-control story, and an evidence story. The patch matters, but the business risk begins at the moment an exposed remote-access service becomes the first trusted system in the attacker path.
Why this belongs in Exhibit A(I)
The AI lesson is not that ransomware crews have magical automation.
The lesson is that modern attackers are very good at turning one exposed control into a decision engine. They test the edge. They sort victims. They automate the boring parts. Then they hand the promising access to humans who know how to extort.
Defenders need the same discipline, but with evidence instead of vibes.
If a VPN authentication bypass is exploited, the right question is not only, "Did we patch?" The right question is, "Can we prove who authenticated, what changed, what moved, and whether any session survived the fix?"
The practical risk
VPNs sit in the uncomfortable middle of the enterprise.
They are security infrastructure, but they are also business continuity infrastructure. They carry privileged access. They often touch identity providers, administrator workstations, internal applications, and backup networks.
That makes them attractive to ransomware crews for one reason: a successful VPN compromise can make the attacker look less like an outsider.
Once the edge trusts the session, downstream systems may inherit that trust.
What to do this week
1. Treat patching as the start, not the close
Patch affected Palo Alto PAN-OS and GlobalProtect systems according to the vendor advisory.
Then document the exact time the vulnerable surface was exposed, the exact time the fix was applied, and the logs that cover the gap between those two points.
If you cannot answer that in one page, the incident record is already too thin.
2. Hunt for post-patch persistence
Look for new or modified local accounts, altered authentication settings, unexpected administrator sessions, and changes to VPN portals, gateways, certificates, or SSO configuration.
Do not assume the exploit stopped mattering when the patch landed.
Attackers do not need the front door twice if they already made a side door.
3. Force identity cleanup around the edge
Reset credentials and revoke sessions for accounts that authenticated through the VPN during the exposure window.
Prioritize administrators, service accounts, contractors, and users with access to backup, finance, legal, or executive systems.
MFA is not a time machine. It reduces future risk. It does not prove a past session was clean.
4. Use AI for triage, not conclusions
AI can summarize authentication logs, cluster suspicious sessions, and surface outliers faster than a tired analyst scrolling line by line.
It should not decide that the environment is clean.
Require every AI-assisted finding to point back to the underlying logs, timestamps, hosts, users, and configuration changes. No evidence, no conclusion.
The legal and governance angle
This is where many organizations make the wrong record.
They write, "The vulnerability was patched," and stop there.
That is not enough for counsel, insurers, regulators, customers, or a board that has to understand whether access occurred.
A better record separates four questions:
- Was the vulnerable system exposed?
- Was exploitation observed or reasonably suspected?
- What systems and accounts were reachable from that edge?
- What evidence supports the final containment decision?
The difference matters.
A patch proves remediation of a known vulnerability. It does not prove absence of compromise.
The executive version
If Qilin is using a GlobalProtect flaw, the control failure is not merely a missing update.
The control failure is letting a remote-access appliance become a black box at the moment it matters most.
Patch the device. Preserve the evidence. Rebuild the trust boundary around identity. Make someone prove the sessions were clean.
That is the standard.
