let's not forget there is account lock out settings as well for any brute force attacks. Also I think most have a base user (non admin) for remote viewing / monitoring ...Oh please .... VPN is only as good as the unit running the agent. Also if you travel in places like China & IRAN, VPN is useless, you're better off using SSL.