Additionally some VPNs route through legitimate devices. The only way I’ve seen this somewhat work is to have a complex system that pulls apart the connection

Additionally some VPNs route through legitimate devices. The only way I’ve seen this somewhat work is to have a complex system that pulls apart the connection info, and then you use a combination of data science + threat intel + good ol’ reversing to make decisions of if something is malicious or not. Then you need multiple teams to run and tune these functions as attacks change.