What goes wrong when share vpn credentials is shared insecurely

• Shared accounts erase the audit trail. When `vpnuser` is logged in by six people, the RADIUS or syslog entry tells you nothing about who exfiltrated which file. AnyConnect, FortiClient, and OpenVPN attribute sessions by username — collapse that to one identity and incident response becomes guesswork.
• Split-tunnel DNS leaks the request. Split-tunnel configurations on AnyConnect and OpenVPN often route DNS to the local resolver instead of the corporate one. Your laptop queries `internal.git.company.local` against the coffee-shop router, exposing internal hostnames to anyone running tcpdump on that LAN.
• Captive portal interception during connect. Hotel and airport portals require unencrypted HTTP to load the login page. Many VPN clients fall back to system DNS during this window — an attacker on the same SSID can serve a spoofed portal that captures the credential before the tunnel comes up.
• Offboarding revocation gap. A terminated employee whose Okta account is disabled often retains a working WireGuard key for days, because revocation lives in the concentrator's separate config. Pritunl and self-hosted WireGuard require explicit deletion — Tailscale and Twingate tie the tunnel to identity directly.