2026-08-18 - Version 2 Limited

NordLayer VPN Split Tunneling: Feature Review

Feature Spotlight: NordLayer’s VPN Split Tunneling

For modern IT teams, finding the sweet spot between ironclad security and seamless network performance is a daily struggle. Routing 100% of your data through a VPN guarantees comprehensive protection, but it often bottlenecks essential applications. Conversely, bypassing the VPN entirely sacrifices administrative control and security.

NordLayer’s split tunneling offers the perfect compromise. This dynamic traffic management tool empowers organizations to dictate exactly how data flows—allowing you to encrypt all data by default with specific exemptions, or selectively secure only designated traffic. Instead of a rigid “all-or-nothing” approach, administrators can craft centralized policies tailored to their workforce’s unique operational needs.

The Mechanics of VPN Split Tunneling

A conventional corporate VPN funnels every byte of internet traffic through a secure, encrypted server. While this ensures total coverage, it unnecessarily increases latency for applications that don’t require external encryption—such as standard SaaS platforms or unified communications tools like Microsoft Teams.

Split tunneling fundamentally alters this architecture. It allows administrators to divide network data into two independent streams:

A secure, encrypted path routed directly through the VPN.
A direct, unencrypted path straight to the open internet.

Crucially, these pathways are dictated by centralized IT rules, completely removing the burden of choice from the end user.

Deploying Split Tunneling in NordLayer

Implementing split tunneling within NordLayer requires no external software; it integrates natively into your existing Control Panel alongside your standard network rules.

Configuration Steps

Gateway-Level (Include/Exclude): Navigate to the “Network” tab in the Control Panel, select “Gateways,” and pick your preferred mode. You can designate specific IP addresses or subnets for inclusion, or highlight IPs, subnets, and domains for exclusion. Once saved, this policy acts instantly across the organization.
Browser Extension (Exclude Mode): For browser-specific exclusions, navigate to “Settings,” click “Browser Extension Settings,” and input the domains, subdomains, or wildcard URLs you wish to bypass the VPN.

To streamline administration, NordLayer features automated presets for heavily utilized platforms like Zoom, Google Meet, and Microsoft Teams. Rather than manually updating a provider’s shifting FQDNs and IP addresses, IT simply enables the preset. NordLayer automatically manages the backend updates as the provider alters its infrastructure. These presets can also be layered seamlessly with your own custom manual entries.

Availability Note: Gateway-based Include and Exclude modes are standard on both Core and Premium tiers. Browser extension Exclude mode is a Premium-exclusive feature. Premium users can further enhance their setup by pairing gateway split tunneling with advanced features like Firewall as a Service (FWaaS) and site-to-site connectivity.

Include vs. Exclude: Understanding the Two Modes

Split tunneling operates in two distinct, highly complementary modes to address different architectural needs.

Feature	Include Mode (Opt-In)	Exclude Mode (Opt-Out)
Core Logic	Only explicitly listed traffic uses the VPN. All other traffic goes to the open internet.	All traffic uses the VPN by default, except for explicitly listed exceptions.
Ideal Use Case	When the VPN is only needed for a handful of internal resources (e.g., admin panels, private cloud environments).	Broad, zero-trust protection where only a few highly trusted or latency-sensitive apps bypass the tunnel.
Configuration Scope	Gateway only (IP addresses and subnets).	Gateway (IPs, subnets, domains) & Browser Extension (domains, wildcards).
Primary Benefit	Minimizes gateway load and keeps the VPN scope extremely focused.	Maximizes default security while allowing safe, direct paths for trusted apps.

The Strategic Advantages of Split Tunneling

At its core, split tunneling is designed to maximize both security and productivity. The cascading benefits affect everyone in the organization:

Optimized Performance: By keeping non-essential traffic off the VPN, latency-sensitive applications (like video conferencing) run smoother and faster.
Reduced Infrastructure Strain: Limiting tunnel traffic directly decreases the bandwidth load on your VPN gateways, ensuring highly responsive connections for critical tasks.
Frictionless Access to Blocked Sites: Certain government portals and financial institutions actively block VPN traffic. Exclude mode allows users to access these necessary sites directly without dropping their overall VPN protection.
Maintenance-Free Presets: Automated updates for major SaaS platforms mean IT administrators no longer need to hunt down and manually update changing IP lists.

Impact by Stakeholder

For IT Administrators: Gain centralized, granular control over data routing without touching individual devices. It drastically reduces support tickets regarding slow apps or blocked sites, freeing up time for strategic initiatives.
For End Users: Experience a frictionless workflow. Collaboration apps run at peak speed, and strict banking sites load normally. There is no need to manually toggle the VPN on and off; the intelligence operates invisibly in the background.
For the Organization: Lower operational costs and maximize cloud tool performance. It enables a pragmatic Zero Trust architecture—protecting highly sensitive internal data while giving trusted, low-risk traffic a high-speed direct lane.

Is NordLayer Split Tunneling Right for You?

If your current blanket-VPN strategy is generating complaints about sluggish video calls, preventing access to essential banking websites, or overloading your gateways, split tunneling is the definitive solution.

It shines brightest in hybrid or remote setups where employees constantly bounce between private internal resources and public SaaS applications. Include mode is your go-to if you only have a few private apps to protect. Exclude mode is ideal for maintaining comprehensive security while letting known-safe traffic bypass the bottleneck. Furthermore, the browser extension makes domain-level exclusions incredibly simple for teams living in web apps.

While split tunneling does not negate your overarching compliance requirements, its centralized management ensures that administrators maintain strict oversight regarding exactly what data is permitted to bypass the encrypted tunnel.

Take Command of Your Network Routing

Stop letting rigid VPN defaults dictate your network’s efficiency. With NordLayer’s split tunneling, you design traffic flows that match your organization’s actual operational habits.

Empower your IT team to secure what truly matters while letting the rest run fast and unimpeded, all manageable from a single, intuitive dashboard.

About the Author

Agnė Srėbaliūtė | Senior Cybersecurity Copywriter

Bringing over ten years of expertise spanning PR, media, and advertising, Agnė specializes in translating complex cybersecurity and technology concepts into accessible insights. Her focus areas include zero trust architecture, internet infrastructure, networking, and IP address management.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Endpoint Security Management: Controlling Risk

Endpoint Security Management: Taking Control of Device Risk

The Core Concept: Command your endpoint security by unifying device visibility and automating defenses to safeguard a remote, distributed workforce.

The traditional mindset dictates that securing the corporate perimeter is enough to protect a business. However, the reality of the modern workplace is that the “office” exists wherever a Wi-Fi connection is found—a living room, a café, or an airport lounge. This paradigm shift means every device is a potential vulnerability. If you fail to monitor and secure these decentralized access points, your centralized network defenses are effectively useless.

This guide cuts through the noise. We will explore exactly what you must do to maintain control, identify the friction points that bottleneck IT teams, and demonstrate how integrating platforms like NordLayer and CrowdStrike allows you to govern everything from a single pane of glass.

Defining Endpoint Security Management

Endpoint security management is the comprehensive discipline of discovering, authenticating, and shielding every device that touches your network, all governed from a central hub. This encompasses company-issued laptops and smartphones, IoT devices, and personal hardware permitted under Bring-Your-Own-Device (BYOD) protocols.

While legacy security guarded the physical office doors, this modern approach utilizes endpoint management tools—crucially, Endpoint Detection and Response (EDR)—to enforce rigorous policies regardless of a user’s location. By fusing patch management, access controls, and live monitoring, IT departments can secure remote access and defend data without bottlenecking productivity.

The Business Case for Endpoint Management

Centralizing your security isn’t just about passing compliance audits. When every staff member operates as an independent micro-branch, every unpatched OS or rogue smartphone introduces risk that ultimately demands exhausting, manual remediation. Breaking this reactive cycle requires robust endpoint management solutions.

Reducing Operational Strain and Costs

The sheer number of devices in a distributed workforce makes manual oversight impossible. You cannot treat every laptop as a bespoke IT project. You need solutions that provide a unified view of your entire hardware inventory. This consolidation drastically reduces the hours dedicated to routine maintenance, preventing overhead costs from ballooning as your team scales.

Driving Efficiency via Automation

By reclaiming those lost hours, you can deploy automation to enforce security standards effortlessly. Speed is paramount for maintaining control; you cannot afford to configure devices individually during rapid hiring phases or immediate zero-day vulnerability threats. Automated policy enforcement eliminates the repetitive grunt work that bogs down IT, empowering your team to focus on strategic initiatives.

Accelerating Threat Mitigation

With automated policies active, your capacity to neutralize a live attack increases exponentially. In a breach, seconds matter. Active EDR and endpoint protection mean your infrastructure recognizes anomalous behavior instantly. Real-time alerts allow you to quarantine a compromised laptop or deploy an emergency patch in minutes, rather than hours.

Essential Capabilities of a Management System

For these tools to be effective, they cannot exist in silos; they must function as a cohesive ecosystem, moving seamlessly from device discovery to active defense.

Unified Visibility & Central Console: You cannot protect what you cannot see. The foundational step is maintaining a live inventory of every connected device. This complete visibility makes it simple to identify rogue BYOD hardware or obsolete machines that pose a threat to your data.
Policy Administration: Visibility demands action. Policy management allows you to establish a security baseline—such as mandatory disk encryption—that all devices must meet to connect. Non-compliant devices are automatically restricted until remediated.
Vulnerability & Patch Management: Policies degrade without upkeep. Automating the rollout of crucial patches ensures that known vulnerabilities are sealed across your entire fleet simultaneously, beating attackers to the punch.
Continuous Health Monitoring & Telemetry: A fully patched machine can still act maliciously. Continuous telemetry monitors system behavior in real-time, detecting the earliest indicators of compromise, such as a laptop attempting to contact a known command-and-control server.
Posture Checks & Access Control: To protect sensitive data, you must verify a device’s health at the exact moment of login. If a device fails the posture check, access is denied until organizational standards are met.
Audit-Ready Reporting: Security actions must be logged to satisfy stakeholders and regulators. Automated reporting transforms device data into a transparent audit trail, instantly proving your security posture.

Navigating Common Security Roadblocks

The concept of a “secure perimeter” is obsolete when your workforce is decentralized. Endpoint management focuses on the vulnerabilities created by this dispersion.

The Visibility Gap: Remote work easily obscures which devices are handling corporate data. These blind spots allow unpatched software to linger. A forgotten, connected tablet can easily become the entry point for a major breach.
The BYOD Consistency Nightmare: Maintaining uniform security across a chaotic mix of corporate and personal devices is notoriously difficult. When IT teams waste time troubleshooting bespoke compatibility issues for individual users, high-level, fleet-wide security enforcement suffers.
Security vs. Productivity: If endpoint policies strangle productivity—via excessive lag or relentless authentication prompts—employees will circumvent them. This breeds “Shadow IT,” pushing sensitive data into unsecured, invisible channels.
Alert Fatigue: A system that flags every minor configuration tweak alongside critical threats will eventually cause analysts to miss a genuine attack. Hackers rely on this fatigue to move laterally through your network undetected.

Best Practices for Rock-Solid Endpoint Management

Effective management shifts the security burden from the user to the system. Implement these practices daily:

Inventory Before Securing: Utilize automated discovery to log devices the instant they request network access. A real-time inventory ensures no unmanaged hardware slips through the cracks.
Automate Patching: Do not rely on users to hit “update.” Push critical patches silently in the background to close vulnerabilities fleet-wide without creating a backlog.
Enforce Least Privilege: Restrict access to the absolute minimum required for a specific role. This ensures that if an endpoint is compromised, the blast radius is severely limited.
Continuous Enforcement: Setup is not a one-time event. Background compliance checks ensure that devices drifting from your security baseline are automatically corrected or quarantined.
Monitor Telemetry: Look beyond basic status updates; monitor actual device behavior. EDR telemetry moves you from guessing to acting on hard evidence.
Prioritize Usability: Frictionless security (like SSO and silent health checks) prevents workarounds. When doing the right thing is the easiest thing, productivity and security coexist peacefully.
Generate Actionable Reports: Use reporting tools to highlight coverage gaps and compliance trends, turning audits from chaotic fire drills into routine reviews.

Clarifying the Terminology

Misunderstanding these core concepts creates dangerous gaps in your architecture:

Endpoints: The actual hardware (laptops, phones) connecting to your network. They are the frontline where work happens and risk enters.
Endpoint Security: The active defense layer (malware detection, isolation) residing on the device, designed to neutralize threats at the point of origin.
Endpoint Management: The administrative engine (deploying software, enforcing policies) that ensures the entire fleet remains consistent, updated, and compliant.

Bridging the Gap: NordLayer and CrowdStrike

The fatal flaw in running siloed network and device tools is a lack of communication. An infected laptop might retain full access to private servers simply because the network layer is unaware of the device’s compromised state.

Integrating NordLayer with CrowdStrike bridges this gap. NordLayer dictates access control (who reaches what data), while CrowdStrike provides elite endpoint protection.

The immediate benefit is streamlined administration: you can oversee your CrowdStrike Falcon licenses directly within the NordLayer platform, unifying billing and seat management. More importantly, the tools actively collaborate to neutralize threats.

By leveraging NordLayer’s Custom Integrations, you can dictate automated, cross-platform responses. For instance, if CrowdStrike identifies malware on a laptop, the integration instantly forces a user logout and severs their connection to your NordLayer gateways. This automated action isolates the threat in seconds, eliminating the manual intervention that typically delays incident response.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

2026 Nord Security NordLayer

Mastering Multi-Tenant M365 Mailbox Security for MSPs

Executive Summary

Identity is the New Perimeter: Compromised Microsoft 365 (M365) mailboxes almost always stem from stolen, yet valid, credentials. Consequently, monitoring user behavior and identity is paramount.
Identify Red Flags: Be vigilant for impossible travel, rogue OAuth app permissions, hidden inbox rules, sudden eDiscovery privileges, and massive data exports.
Filter the Noise: To prevent alert fatigue, always establish behavioral baselines, correlate multiple suspicious signals, and verify context before escalating an issue.
Scale with Standardization: MSPs must utilize centralized dashboards, tenant-specific baselines, and automated triage to manage security across dozens of clients profitably.

A breached Microsoft 365 mailbox is a ticking time bomb for an entire business. Once inside, an attacker can silently monitor communications, understand corporate hierarchies, and eventually launch devastating invoice fraud from a trusted internal address. Worse, those same compromised credentials often unlock shared documents, connected SaaS applications, and access to other employees.

This level of access is highly lucrative. The Microsoft Digital Defense Report 2025 highlights a staggering 32% spike in identity-based attacks during the first half of the year. For threat actors, a mailbox is the ultimate prize—the hub of relationships and financial documents necessary to execute convincing scams.

For Managed Service Providers (MSPs), the mandate is clear: detect the breach before it paralyzes the client. While securing a single tenant is straightforward, scaling that vigilance across 50+ diverse client environments—each with unique definitions of “normal” behavior—is a massive operational hurdle.

This guide dissects the telltale signs of an M365 mailbox compromise and provides a blueprint for MSPs to detect them at scale without drowning in false positives.

The Root Cause: Why M365 Breaches are Identity Crises

Mailbox hijackings rarely involve malware or zero-day exploits. They begin when a hacker logs in using a valid password acquired via phishing, session hijacking, or the dark web. Because the login is technically legitimate, traditional endpoint security solutions are entirely blind to the attack.

Microsoft’s data reinforces this: over 97% of identity attacks utilize brute force or password spraying. The attack starts with a successful login, not a malicious file.

Therefore, your defense strategy must pivot from perimeter security to identity and behavioral analysis. You must constantly ask: Does this current session match this specific user’s historical behavior?

An isolated event—like a login from a new country or an unfamiliar app request—might be benign. But when analyzed against a user’s established baseline, these events often paint a picture of an Account Takeover (ATO). For MSPs, this means prioritizing sign-in logs, audit trails, and mailbox configurations. Crucially, because a traveling sales team behaves differently than a localized HR department, these behavioral baselines must be customized per tenant.

Red Flags: Deciphering the Signals of a Compromised Mailbox

ATO attacks usually leave a trail of distinct, recognizable actions. While one signal isn’t definitive proof, it demands investigation. Knowing what to look for in M365’s audit logs is half the battle.

The Signal	What to Look For	Why it Matters
Atypical Sign-ins & Impossible Travel	Logins from two geographically distant locations in an impossibly short timeframe, or from entirely new countries/IP ranges.	Strongly suggests an attacker is using stolen credentials simultaneously with the legitimate user.
Rogue OAuth App Consent	A user grants broad permissions (file/mailbox access) to an unknown third-party application.	Attackers use OAuth grants to maintain persistent access to data, even if the user changes their password.
Malicious Mailbox Rules	Creation of rules that automatically forward emails externally, move them to hidden folders, or delete specific replies.	This is a classic Business Email Compromise (BEC) tactic to silently exfiltrate data and hide the attacker’s tracks from the victim.
Unexpected eDiscovery Role Grants	An account is suddenly granted eDiscovery Manager or Compliance roles, followed by tenant-wide content searches.	Legitimate users rarely need new grants for this. This indicates an attacker actively hunting for sensitive financial data or additional credentials.
Mass Data Export/Sending	A massive spike in outbound emails or bulk downloading of mailbox contents.	Indicates immediate data exfiltration or the mailbox being weaponized to launch internal phishing campaigns.

These indicators frequently happen sequentially: an odd login is followed by a new forwarding rule, then an eDiscovery search, culminating in invoice fraud. Detecting the chain early minimizes the blast radius.

Cutting Through the Noise: Minimizing False Positives

Every signal listed above can be triggered by legitimate activity. A traveling CEO will trigger impossible travel alerts; a new accounting software might require broad OAuth permissions. If you don’t tune these alerts, your analysts will suffer from alert fatigue, and real attacks will be buried under routine noise.

To improve detection fidelity, implement these practices:

Contextual Validation: Don’t blindly trust an impossible travel alert; cross-reference it against known corporate VPN exit nodes or planned executive travel.
App Allowlists: Standardize approved OAuth apps. Only trigger alerts when consent is given to an app outside the sanctioned list.
Prioritize Mail Rules: External auto-forwarding and “delete on receipt” rules are rarely legitimate and should be treated as high-priority alerts.
Focus on the Grant, Not the Search: Compliance teams run eDiscovery searches constantly. The true anomaly is a new account being granted those privileges.
Correlate and Escalate: One weak signal is noise. Two weak signals in the same session (e.g., an odd login followed immediately by a new mail rule) is an incident demanding immediate action.

Scaling Operations: Protecting 50+ Tenants Efficiently

If every client generates five identity alerts a day, an MSP with 50 clients is looking at 250 daily alerts. Throwing more human analysts at the problem destroys profitability. The solution lies in smarter aggregation and automated triage.

Operational Strategy	How it Functions	The MSP Benefit
Centralized Aggregation	Funneling identity and mailbox signals from all tenants into a single pane of glass.	Eliminates the time-consuming process of logging into 50 separate M365 admin portals.
Tenant-Specific Baselining	Establishing unique behavioral profiles for each client organization.	Prevents one client’s normal behavior from triggering false alarms in another’s environment.
Risk-Based Prioritization	Scoring alerts based on severity and confidence, pushing the most dangerous to the top.	Ensures limited analyst time is spent investigating actual threats, not minor anomalies.
Automated Triage	Using software to enrich and correlate data, filtering out known benign activity before human review.	Drastically reduces the raw volume of alerts technicians must process.
Cross-Tenant Correlation	Linking identical malicious IPs or rogue apps attacking multiple clients simultaneously.	Uncovers coordinated, broad-scale attacks targeting the MSP’s entire portfolio.

Building a Repeatable MSP Workflow

To scale securely, MSPs must standardize their detection processes so that any technician can handle an incident without having to memorize a specific client’s quirks.

Baseline at Inception: Establish behavioral benchmarks the moment a new client is onboarded.
Standardize Severity: Define exactly what constitutes a Critical vs. Low alert, and apply that standard uniformly across the portfolio.
Isolate Exceptions: Maintain tenant-specific suppression lists (e.g., a known overseas contractor) so you don’t accidentally create blind spots in other clients’ environments.
Unified Queues: Route all validated, high-severity alerts to one central ticketing system.
Pre-Define Escalation: Document exactly who is responsible for action and how the client is notified, ensuring rapid response during an active crisis.

The Guardz Advantage: Unified Prevention, Detection, and Response

Managing multi-tenant M365 security requires a unified approach. Guardz consolidates these necessary workflows into a single platform, ensuring that prevention, detection, and remediation are deeply integrated.

Prevention: Powered by Check Point Harmony, Guardz embeds robust email security upstream, blocking phishing and BEC attempts before they ever reach the inbox, while also flagging suspicious internal mailbox rules.
Detection (ITDR): Guardz Identity Threat Detection and Response establishes custom behavioral baselines for every user across all tenants. It automatically correlates disparate signals—like impossible travel, OAuth abuse, and hidden inbox rules—into a single, coherent incident. Agentic AI handles the initial triage, ensuring that only high-fidelity alerts reach your dashboard, keeping a 50-tenant workload easily manageable.
Comprehensive Response: When an ATO is confirmed, resetting a password isn’t enough; attackers retain access via active sessions and OAuth tokens. From the Guardz console, MSPs can instantly revoke active sessions, clear refresh tokens, delete malicious OAuth grants, strip rogue mailbox rules, and suspend the account entirely—ensuring true remediation.

For MSPs seeking extra support, Guardz MDR provides a 24/7 team of elite SOC analysts and threat hunters. They investigate validated threats, execute targeted response playbooks for ATO and BEC scenarios, and maintain constant communication—allowing MSPs to scale their security offerings without sacrificing control or profitability.

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

Guardz 2026