If your company reaches its CRM, its ERP or any other internal web application (intranet, document manager, invoicing, admin panels, support tools or custom software) by typing a public address into the browser, those applications are visible to the entire internet. And whatever is visible can be attacked: anyone, or any automated bot, can find them, try passwords and look for flaws.

The good news is that there is a simple way to close that door without changing your tools: put your applications behind a private VPN. In this article we explain why the risk is more real than it seems, how this solution works and what to keep in mind to implement it properly.

In short: if your business applications have a public address, anyone can try to get in. A private VPN takes them off the internet: they can only be reached after connecting with a verified identity and two-factor authentication. You protect what you already have, without migrating anything.

Critical applications with the door open to the internet

At some point many companies made a reasonable decision: publish their web applications on the internet so teams could work from anywhere. Remote work arrived, sales reps started connecting from the road, and it worked. It worked so well that nobody ever reviewed it again.

The problem is what lives inside those applications. The CRM, the ERP and the intranet hold the most sensitive data in the business: customers, invoices, prices, contracts, payroll. And between all of that and the internet there is only a username and password screen.

Seen from the outside, every published application is one more door an attacker can knock on. The more doors there are, the more likely it is that one of them gives way.

Why leaving your applications exposed is dangerous

An attacker does not need to know you or target your company specifically. Most attacks are opportunistic: someone finds an open door and tries their luck. These are the reasons an exposed application is a serious risk:

• They are found automatically. Search engines and scanners crawl the internet around the clock looking for exposed applications. If your address is published, it ends up on their lists.
• Passwords get stolen and reused. If an employee uses the same password on another service that suffers a leak, the attacker only has to try it on your portal. No guessing required.
• All software has flaws. Any web application, commercial or custom built, needs security patches from time to time. If the portal is exposed and the patch is delayed for a few days, the attack window is open to anyone, not just to people who already have access.
• One access can end in ransomware. Getting into an exposed application is usually just the first step. From there the attacker moves through the network, encrypts the data and demands a ransom to return it.
• There are legal consequences. A breach involving personal data must be reported to the supervisory authority, generally within 72 hours, as the Spanish Data Protection Agency (AEPD) explains. On top of that come possible GDPR fines and, for many companies, the security requirements of the NIS2 directive.

None of these risks depends on the application being bad. They depend on it being visible.

How a private VPN protects your applications

The idea is as simple as it is effective: if an attacker cannot see your applications, they cannot attack them. With a private VPN, the CRM, the ERP and the rest of your internal applications no longer have a public address. They live on the company's internal network, and the only way to reach them is to connect to the VPN first.

That connection is not open to just anyone. Each person has their own identity, verified with a password and a second factor (for example, a code on their phone). Once inside, the employee opens their CRM or ERP exactly as before, through an encrypted tunnel.

For an attacker scanning the internet, however, your applications simply do not exist. There is no longer one portal per tool, but a single entry point that is monitored and controlled.

What you gain by putting your applications behind a private VPN

The change is small for users and big for security. These are the main benefits:

1. A smaller attack surface. Instead of one door per application, there is a single entry point that is much easier to protect and monitor.
2. Real control over who gets in. Access is granted to specific people, with multi-factor authentication (MFA), and revoked instantly when someone leaves the company.
3. Traceability. There is a record of who connects, when and from where. During an audit or an incident, that information is invaluable.
4. Same applications, same work. Your teams keep using the tools they know. The only new step is connecting to the VPN before they start.
5. Nothing to migrate. There is no need to change your CRM, your ERP or any other application. You protect what is already running.

That last point is key: many companies postpone security because they imagine a long, expensive project. Here nothing is rebuilt; only the access path changes.

A private VPN is not magic: how to configure it properly

A badly configured VPN does not remove the problem, it just moves it. The VPN itself becomes the front door, so it deserves the same care as any other critical system. INCIBE, Spain's National Cybersecurity Institute, lists in its VPN recommendations several of the practices we always apply:

• Keep the VPN up to date. The VPN software also receives security patches, and it is precisely the system that stays exposed to the internet.
• Require two-factor authentication for everyone. No exceptions for executives or "temporary" accounts.
• Give each person only what they need. A sales rep does not need the payroll panel, and an external technician does not need the whole network.
• Segment the internal network. If something fails at one point, it must not be able to spread to the rest.
• Review logs and access regularly. Users who no longer work at the company, connections from unusual countries, logins at odd hours.

With these measures, a private VPN stops being just a remote connection and becomes a real layer of protection for the whole business.

How MiTSoftware can help

At MiTSoftware we have been building software solutions for more than 35 years, and an important part of our work is helping companies secure their existing setups without rebuilding them from scratch. To protect your applications with a private VPN, our service includes:

• A review of which applications are currently exposed to the internet and the risk each one represents.
• Design and deployment of a private VPN tailored to your company and the way you work.
• Setup of two-factor authentication and access policies per user or group.
• Removal of unnecessary public addresses: CRM, ERP, intranets, custom software, admin panels and similar.
• Training for your team so the change is easy from day one.

This work is part of our cybersecurity services for businesses. If nobody has reviewed your platform in a while, you may also want to read what a preventive security audit can uncover. And if you are planning to connect your CRM or ERP to new tools, our practical guide to integrating AI APIs into your CRM and ERP shows why security should be sorted out before you open new connections.

Frequently asked questions

Do I have to change my CRM or ERP to use a private VPN? No. The VPN protects access, not the application. Your team keeps using the same tools; only the step of connecting first changes.

Will my employees notice the change much? Very little. At the start of the day they open the VPN, confirm their identity with the second factor and work as usual. With a short initial training, the change is absorbed within days.

What if an application has to be accessible to customers or suppliers? It is analyzed case by case. The usual approach is to keep public only the part external users really need and protect the rest, or to give them VPN access limited to the essentials.

Does a private VPN also work for custom software? Yes. It works the same way with commercial applications, in-house developments or admin panels: any internal web application can stop being exposed.

Want to know if your applications are exposed?

Tell us about your case and we will tell you what you have published on the internet, what risk it represents and how to protect it with a properly configured private VPN.