I cannot upvote this hard enough. I see this all the time with VPNs. By having everything behind the company VPN, application security isn't taken as seriously

I cannot upvote this hard enough. I see this all the time with VPNs. By having everything behind the company VPN, application security isn't taken as seriously. As a result, lateral access becomes trivial at these companies. Keeping everything public internet exposed from the start actually results in better security.