Unmanaged Device VPN Access

An adversary with valid remote-service access may use an Internet-facing VPN from an unmanaged device when the gateway or identity policy does not enforce device-compliance requirements. Unmanaged status alone is not an exploit; accepted authentication does not establish that device controls were bypassed or that every internal resource is reachable.