> I mean the baseline case of a VPN that your employees use by both their work computers, personal computers, and phones. I can’t forcibly update all of those a

> I mean the baseline case of a VPN that your employees use by both their work computers, personal computers, and phones. I can’t forcibly update all of those and politically I can’t cut people off because the truth is that being able to get work done is more important to the business. Then your priority isn't security. Which isn't necessarily a criticism, it's just a statement of what your business's priorities are. Don't hide behind "well, IPsec supports all sorts of security knobs that can make it approximately as good as Wireguard, if you squint hard enough this is actually the more secure thing." Just say, no, security is not the top priority for this application, and we're going to design our systems around connectivity/reliability instead of security. You could decide security goes elsewhere the design, if you want, and add additional internal isolation once someone's on the VPN to avoid infected endpoints from messing with your corporate network. You could also just decide that a VPN isn't what you want, you want cloud services and BeyondCorp and the assumption of mostly-untrusted endpoints. (Then your users don't have to install VPN software at all, they just need a web browser.) Or for your partners with the out-of-warranty Cisco box - stick a firewall in front of them on your side and also arrange to use authenticated/encrypted application protocols as if you were connecting over the public network. Or say, security and reliability are both priorities but cost isn't, we're buying everyone a work-managed laptop and a work-managed phone. (Or, if you really want to connect from your personal device, you can use a fully-patched one, and if you don't have one, the company will buy you one. Or whatever.) But you cannot say that your priority is security and your priority is allowing unpatched devices to connect. (I don't know anyone with a horror story about turning off TLS 1.1 who originally turned it on because they wanted secure connections. All of those people supported TLS 1.2 and the good ciphers before anyone forced them to. I know people with horror stories because they turned on TLS because they needed to check some regulator's checkbox.)