29% of UK organisations experienced at least one incident connected to remote or hybrid working in the previous 12 months, and phishing accounted for 85% of recorded breaches. That points to identity, not the VPN itself, as the actual attack surface.

A familiar pattern plays out across MSP estates. A customer has a VPN, endpoint protection and a sensible remote-working policy. Then an employee reuses a password, responds to a convincing Microsoft 365 lure, or approves a suspicious sign-in. The attacker doesn't need to defeat the firewall. They use a valid identity and walk through the front door.

That distinction matters commercially. Remote access security isn't just a project for the network team. It affects identity governance, supplier access, incident response, customer retention and the services you can package into a recurring offer. If your remote access proposition stops at VPN deployment, you're leaving the most useful detection layer out of the conversation.

The Current State of Remote Access Security in the UK

The UK's remote access problem is already measurable. Government cyber reporting found that 29% of organisations experienced an incident connected to remote or hybrid working in the previous 12 months, while phishing represented 85% of recorded breaches in the same reporting set. The figures are summarised in UK reporting on phishing tied to remote work, and they change how service providers should frame the risk.

Remote working expanded the number of locations, devices and sessions that businesses must trust. Phishing then gave attackers a scalable way to capture the credentials used across those sessions. The weak point is often the account, session or recovery process rather than a failed encryption tunnel.

The exposure also rises with organisational size. The same UK reporting found incidents affecting 67% of medium-sized businesses and 74% of large businesses, compared with 43% across all UK businesses. Among affected organisations, 65% said phishing was the most disruptive attack. Those figures belong in board conversations because they connect remote access security with operational disruption, not just technical hygiene.

Remote work is now a standing operating model

Remote access also isn't a temporary condition that businesses can wait out. UK cyber-sector job postings that offered remote working peaked at 28% in 2022, fell to 26% in 2024, and reached 16% in 2025, according to the UK government analysis of cyber security skills. The same analysis reported that 26% of core cyber job postings had no regional location listed.

The direction of travel doesn't remove the requirement. It shows that distributed work has become embedded, even as job advertising patterns have eased. MSPs should therefore sell identity controls, device trust and monitoring as part of the customer's normal operating model, not as a pandemic-era add-on.

Commercial rule: If a customer can access business systems from outside the office, remote access security belongs in the service catalogue, the onboarding checklist and the monthly account review.

Identity as the New Perimeter

A VPN can protect the connection between a user and a service. It can't tell you whether the person using a valid password is the legitimate employee, a contractor whose access should have ended, or an attacker using credentials bought from a breach.

That makes identity the practical perimeter. The ICO-aligned guidance on remote access warns that exposed services such as RDP are common initial entry points because attackers scan them and then authenticate with stolen or guessed credentials. It also states that single-factor authentication shouldn't be used for internet-facing remote access where personal data could be reached, and that MFA or comparably strong controls should be enabled.

Put stronger controls around every identity

Start with the accounts that can reach sensitive systems. Require phishing-resistant or otherwise strong MFA where the platform supports it, remove dormant users, separate administrator accounts from everyday accounts, and review recovery methods with the same seriousness as primary sign-in.

Then make access conditional. A user connecting from a managed device during normal working patterns shouldn't automatically receive the same permissions as an unmanaged device attempting an unusual session. Use device compliance, application context, location signals and session duration to make access decisions proportionate to risk.

Credential hygiene also needs a detection component. A business may enforce password policies and still have an employee's password exposed through an unrelated breach. Email authentication helps reduce impersonation and phishing opportunities, so an SPF and DKIM checker can be useful when reviewing the controls around a customer domain.

Privileged access deserves its own service treatment. Don't place a domain administrator behind a general remote desktop workflow and call the job complete. Define who can gain higher privileges, which systems they can reach, how long access lasts and what evidence the customer receives afterwards. MSPs building this capability can use these guides on PAM for MSPs to shape a more disciplined offer.

Explain the shift in plain commercial language

Customers don't need a lecture about abstract zero trust principles to understand the point. Tell them that a password proves knowledge of a secret, not the identity of the person presenting it. Your service should verify the user, the device and the requested resource before access is granted, then continue checking during the session.

That explanation gives account managers a clear reason to sell MFA enforcement, privileged access management, identity monitoring and user education together. It also prevents the common mistake of treating the VPN as the finished product.

VPN vs Zero Trust – Choosing the Right Access Model

VPNs still have a place. They're familiar, widely supported and often quick to deploy for a small number of users who need access to a well-defined internal environment. They can also be the least disruptive option where legacy applications cannot work with modern access brokers.

The weakness is the trust they tend to extend after connection. A user may enter through one gateway and then gain visibility of more network resources than their job requires. If the account is compromised, the attacker inherits that reach.

Zero Trust Network Access takes a different position. It verifies each request rather than trusting a user because they are inside a network tunnel. The service can expose a particular application, service or administrative function without placing the user directly on the wider network.

Choose according to the customer's estate

Don't sell Zero Trust as a badge of maturity. Sell it where the reduction in network exposure justifies the implementation effort. A customer with a small, controlled estate may get better value from a hardened VPN, strong MFA, device checks and close monitoring. A customer with multiple applications, suppliers and administrator workflows should be assessed for application-level controls.

Make the operating model part of the decision

Cost isn't limited to licensing. Include policy design, identity integration, user support, application compatibility and the time required to troubleshoot access decisions. A technically stronger model can fail commercially if nobody can operate it or explain it to the customer.

For VPN estates, service providers should monitor authentication events, unusual connection patterns, configuration changes and capacity. A resource on infrastructure VPN monitoring can help frame the operational questions. If your business sells connectivity or managed networking, you can also examine how to build recurring revenue with VPNs rather than treating the tunnel as a one-off installation.

The recommendation is straightforward. Use a VPN where it remains proportionate and controlled. Move towards Zero Trust when broad network access, application sprawl or third-party activity makes perimeter-based trust difficult to govern. In both cases, identity monitoring remains necessary because neither architecture tells you whether a credential has already been compromised.

The Hidden Risk of Third-Party and Supplier Access

Your customer may have strong controls for employees and still leave a wide-open route through an MSP, software supplier, contractor or support partner. External users often need legitimate access, which makes their sessions harder to distinguish from normal business activity.

UK research found that 51% of organisations experienced a breach or attack involving third-party network access in the previous 12 months, compared with 47% globally, according to the UK spotlight report on third-party network access. The same report identifies limited budget, resource constraints and a lack of centralised control as reasons supplier access remains difficult to manage.

Replace permanent trust with governed access

Every supplier account should have an owner inside the customer organisation. That owner should know what the account reaches, why access exists, when it should be used and when it must be removed.

A practical supplier access review should cover:

• Named accounts: Prohibit shared administrator credentials wherever the technology allows it, so actions can be tied to a person.
• Defined scope: Limit each supplier to the applications, servers or systems required for the contracted task.
• Time-bound permission: Use approval workflows or temporary elevation for maintenance and troubleshooting.
• Session evidence: Record sign-in activity, access decisions and relevant administrative actions.
• Offboarding checks: Remove accounts and tokens when a contract, project or support relationship ends.

Don't accept “the vendor manages it” as a control. The customer remains accountable for its environment, and the MSP remains responsible for explaining the risk in terms the customer can act on. Where a supplier has access to sensitive infrastructure, pentesting for vendor risk can support a broader assessment, but testing won't replace access governance.

Treat the supply chain as part of the customer estate

The UK's preparedness gap makes this a strong service opportunity. The Cyber Security Breaches Survey 2025/2026 found that 43% of businesses and 28% of charities experienced a breach or attack in the previous 12 months, while only 25% of businesses had a formal incident response plan. The survey reaction from NCC Group also reports that only 15% formally reviewed immediate supplier cyber risks and 6% reviewed wider supply-chain risks.

Offer customers a supplier access register, quarterly review process and incident escalation route. It creates visible value, improves retention and gives your service desk a reason to speak with decision-makers before an incident forces the conversation.

Proactive Detection and the Role of Dark Web Monitoring

MFA reduces the value of a stolen password, but it doesn't make the password irrelevant. Attackers can reuse credentials, target recovery channels, impersonate suppliers or exploit users who haven't enrolled correctly. You need to know when customer identities appear in exposed data, not just whether a sign-in fails.

That is where dark web monitoring fits remote access security. It provides an early warning layer between credential exposure and attempted account takeover. The service doesn't replace MFA, endpoint controls or incident response. It tells the customer which identities and domains need attention while there is still time to reset credentials, investigate sessions and contact affected users.

Give customers alerts they can understand

Business users don't want a complex dashboard filled with threat terminology. They need a clear alert that identifies the exposed email address or domain, explains the risk and gives them an action to take.

A practical offer should include:

• Continuous scanning for compromised email addresses, exposed passwords and breached domains.
• Clear alerts when credentials or company data appear in exposed sources.
• A response workflow covering password resets, session revocation, MFA checks and user contact.
• Account-level reporting that helps the customer see open issues and completed remediation.

GoSafe Dark Web monitoring is one example of this model. Its white-label platform continuously scans for compromised credentials and breached company data, then provides understandable alerts through email and a simple dashboard. Partners can brand it as their own service, sell it under their own company name and deliver it as a monthly subscription without building security tooling internally.

That makes white label dark web monitoring particularly suitable for MSPs, IT support firms, hosting providers, telecom companies, VoIP providers and technology resellers. It can sit alongside cloud services, connectivity, hosting, web services and managed support, with minimal operational overhead.

Teams that want more background on how to monitor dark web credentials can use that resource to shape customer messaging. The commercial point is simple: breached credentials create a timely conversation, and a timely conversation is easier to turn into a recurring security service than a vague promise to “improve cyber posture”.

Building a Resilient Remote Access Strategy

A resilient service doesn't start with a product catalogue. It starts with the access paths your customer's people, applications and suppliers actually use.

Build the offer around four decisions:

1. Verify identity properly. Require MFA for internet-facing access, separate privileged accounts, remove dormant access and apply conditions based on device and session risk.
2. Choose the access model deliberately. Keep a VPN where it remains controlled and proportionate. Use application-level access when broad network reach creates unnecessary exposure.
3. Govern third parties. Name account owners, restrict permissions, time-limit supplier access and retain evidence of sessions and approvals.
4. Detect exposed credentials early. Add dark web monitoring to identity services so customers can respond before a leaked password becomes a remote access incident.

Your operational checklist should include customer onboarding questions, access reviews, supplier records, incident escalation and a monthly report that a non-technical decision-maker can understand. The UK's education findings reinforce why this matters for organisations with large user populations. The Cyber Security Breaches Survey education findings recorded breaches or attacks among 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions in the previous 12 months.

For MSPs and resellers, this is a practical recurring revenue security services opportunity. Package identity reviews, MFA support, supplier access governance and white-label dark web monitoring as a managed service. Customers receive a clearer route to action, while you strengthen the relationship beyond break-fix support.

View the GoSafe reseller programme to see how you can sell dark web monitoring under your own brand, add it to your existing service stack and offer it as a monthly subscription.

GoSafe Dark Web monitoring scans continuously for compromised email addresses, exposed passwords and breached domains, then sends clear alerts that support rapid remote access response. Visit GoSafe Dark Web monitoring to see how the service works and decide whether it fits your customer offer.