> there’s no reason a VPN login is any more inherently secure than the login to whatever admin panel they’re using VPN credentials can also be tied to a device

> there’s no reason a VPN login is any more inherently secure than the login to whatever admin panel they’re using VPN credentials can also be tied to a device certificate, which can be securely stored in the machine’s TPM. This prevents VPN login from anything except a company issued machine. You don’t get this with normal password auth.