Comment by chrisseaton

> you guys could perhaps put a firewall rule to drop all incoming traffic to the VPN

How could you ever trust an employee who did this with their access privileges?